I am needing help with single sign on. I have siteA.com that requires login credentials, once you are in SiteA.com you can do many things and one of them is access another application siteB.com. If you click on the option to go to this other application, the other application also has a login screen whose credentials are the same as siteA.com, so siteA.com and siteB.com have login screens of their own with the same credentials.
I am trying to make it a single sign on is there anyway I can remote login or pass credentials from siteA.com to siteB.com?
I am interested in:
Solved exactly same problem (actually also for 4 domains). The only solution I’ve came up with was, to include 3 hidden iframes on the ‘Successful login page’ and those iframes just load http://www.domain1.com/register_session.php, http://www.domain2.com/register_session.php, etc….
As a parameter for register_session.php I use ‘sid’ which contains session ID:
session_id($_GET['sid']);
session_start();
This is actually for keeping session alive on all those domains but the same would be for your case with cookies.
I think this could work but the problem is given the credentials, how can I make the script login to siteB.com?
I have done something which KIND of works…I copied the html of siteB.com and added that to hidden in siteA.com and at siteA.com made it do a double POST, one to siteA.com’s login and another to siteB.com’s login. This works only if the user has logged in to siteB.com lately, I think that logging in to siteB.com it sets a cookie to control access thats why doing the double POST allows you to fool the login system and as long as the correct credentials are provided it does a successful grab of login cookie, allowing you to login.
Store the user’s information in a cookie( such as the user’s id in the database ) then on the login page, look for that cookie. if it exists and is a valid user, go ahead and log them in.
When creating a cookie, you should be able to set it’s domain to the domain of siteB.com so that siteB.com can see it. Simply create one cookie for each domain that needs to be able to read that cookie, and set acceptable expires settings on each cookie so that they either expire on session end or after x days.
Depending on how much security you need, you may need to put some kind of protection to prevent someone from simply creating their own cookie to get in freely (such as encryption)