Did some tests with this Single Sign On and has enough problems...
For example, if in the main website the user can change the email or username, when logging in, will not login, but instead a new account will be created (and this is right, because email or username are different).
But at the same time, even if you edit in the database the values to the new one (the new email or username the user actually has), the user can't login anyway. This is because the password is generated with a token from the first username and email...
This is a big problem - and at the same time I think there should be a column in the users DB which refers to an external ID (a bit like how Zendesk's JWT auth works). This way even if the user change email and username, he will be "recognized" by the "external ID" and probably the token could be generated using this ID and the random string (using other methods, maybe). But the column isn't present by itself in Flarum at all. I never did a Flarum extension, but how can you add a DB column? And at the moment I can't find any Flarum documentation about Listeners and APIs (internal, not REST). It seems apidocs.flarum.org is offline
I'd like to help you (pulling on GitHub or something other) but I need some documentation about Flarum
Other than this, I think that on my main website I could do something like this (even if it is really strange... it should be done in Flarum's side, as it should be kept simple).
I think I will:
- Create a new table in my main database, in which I have "internal_id", "flarum_id"
- When the user tries to login, the website creates a token (with some encryption, I still don't know) based on the internal user_id and will store in DB the "internal_id".
- Now will make a request to register the user on Flarum. Flarum will answer with the user ID. This will be taken by the main website and saved in the DB as "flarum_id". Flarum will create the password using the token generated by the internal_id
Of course now the user can login, as username/email and password are right and if the user changes email or username on the main website, we will can send a REST API request to Flarum to make it change email or username of the user, checking in the previously mentioned DB table that the userID of which data must be changed corresponds to "flarum_id". In fact, in this way, the password will always be the same (as it is generated by the internal id) and the email or username will change because the REST API id the trick. So the user will can login without problems. It is just to be setup on the other website rather then Flarum..
But if there is any better method let me know. I just think that password must not be generated by something that could change (like username and email).
I know too (reading other posts... I don't remember which) that there is a kind of problem about usernames as if they get changed the mentions and other things could broke; so maybe we should allow just the change of email.
But the thing I want to know is this: when the user makes the login in the main website using SSO, which data gets send to Flarum to login? Username or email?
