Question

I have main site example.com where users can register and login or just login with openid.
Logged in users can create their own sites with subdomains like mysite.example.com.
Every user can have multiple sites.
Every site is cakephp app.
Every cake app has its own ACL.

How do I deploy authorization so users logged in to the main site, are also logged in to their own sites.

Answer 1

Two main requirements here:

1. Client-side cookie needs to be valid for all applications

   Check the cookie set by CakePHP on the client side (FireCookie is good for this). The domain part of the cookie needs to read .example.com (not www.example.com) in order for it to apply to sub-domains. This might work in bootstrap.php:

   ini_set('session.cookie_domain', '.example.com');
   

2. Server-side session storage needs to be accessible by all applications

   In core.php for each application, set a common session storage. Options are:

   • php: This will use the PHP defined session storage directory, which should be the same for all applications.
   • database: If all applications use the same database, this could be an option.
   • cake: For this to work, you would need to define a common /tmp directory for each application.