Using Ajax for single single sign on. How bad of an idea is this?

List overview All Threads
Download

newer

older

Vector skin, <html> xmlns...

Re: [Mediawiki-l] Solving the...

Adam Meyer

1 May 2011 1 May '11

2:59 a.m.

Im really not one for reasonable solutions if it means inconvenience to the user. Im looking for ways to integrate single sign on for phpBB and mediawiki. I have only found one solution, but im wondering how bad of an idea this is. When a user goes to to mediawiki it does an AJAX call to a phpbb file and checks if the user is logged in or not. If they are, mediawiki would then force a login for that user. If not, it would force a logout. I know that the AJAX response can be faked pretty easily by setting a stop point in fire bug or console, and changing the return value. So this would easily allow a user to change who they are logged in as. But what if I included a salted hash and checked the values against that? I think it would only be as strong as the algorithm. I just can not keep requiring the 2 sign on thing - It is so confusing on my site. -Adam

Show replies by date

Kilian

1 May 1 May

3:59 a.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

There's no reason to use Ajax. Just have MediaWiki check on the server side whether the user is logged in. Have a look at: http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration -Kilian

Adam Meyer

5:45 a.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa. On Apr 30, 2011, at 9:59 PM, Kilian wrote:

...

There's no reason to use Ajax. Just have MediaWiki check on the server side whether the user is logged in. Have a look at: http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration -Kilian _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Adam Meyer

6:18 a.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

I actually figured it out with almost no changes to core phpbb files. - Just renaming the user class ONLY if it is called from mediawiki, so nothing in the forum ever see the change. Ill see if I can make a single sign-on plugin for mediawiki/phpbb with instructions. On Apr 30, 2011, at 11:45 PM, Adam Meyer wrote:

...

Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa. On Apr 30, 2011, at 9:59 PM, Kilian wrote:

_______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Adam Meyer

5:32 p.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

I have successfully created a true single sign on plugin for mediawiki and phpbb. Works on phpbb sessions and does not use curl or anything of the sort. It authenticates using the AuthPlugin same as the LDAP extension for mediawiki. I am having my users test it to make sure it works correctly. On May 1, 2011, at 12:18 AM, Adam Meyer wrote:

...

Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa. On Apr 30, 2011, at 9:59 PM, Kilian wrote:

_______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Dorem - Jérémie Bouillon

9 p.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

On 01/05/2011 17:32, Adam Meyer wrote:

...

I'm interested in seeing this code if you release it. I would like to achieve the same thing for another forum software.

Adam Meyer

9:56 p.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

I broke the code up into 2 parts so it is abstracted so it will be really easy to make work for any forum software... As long as you can get access to the forum session data for Username Email address and a clean version of the username (may not be needed) And lastly some way of knowing if the forum user is anonymous If I hear back from my wiki/forum users that it is working I will be releasing it in the next few days. On May 1, 2011, at 3:00 PM, Dorem - Jérémie Bouillon wrote:

...

On 01/05/2011 17:32, Adam Meyer wrote:

I'm interested in seeing this code if you release it. I would like to achieve the same thing for another forum software. _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Platonides

2 May 2 May

12:50 a.m.

New subject: [Mediawiki-l] Using Ajax for single single sign on. How bad of an idea is this?

Adam Meyer wrote:

...

That's an extension that should get a place into MediaWiki svn.

Adam Meyer

1:02 a.m.

New subject: [Mediawiki-l] phpbb Single Sign-On extension - Working beta

It is a true beta, and needs any work you can do to it. Feel free to make edits as needed. Let me know if you have any issue following the directions or it not working. I did this pretty quickly. http://www.mediawiki.org/wiki/Extension:Phpbb_Single_Sign-On I hope this helps many of you who like me have been waiting for such a plugin. -Adam On May 1, 2011, at 6:50 PM, Platonides wrote:

...

Adam Meyer wrote:

That's an extension that should get a place into MediaWiki svn. _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Curulan Angelicos

1:17 a.m.

New subject: [Mediawiki-l] phpbb Single Sign-On extension - Working beta

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2011-05-01 19:02, Adam Meyer wrote:

...

Quick clarification: Does this allow for separate MediaWiki and phpBB databases, or do the tables all need to be in the same one? I have multiple web apps (each with its own database), but I eventually want to create a single, site-wide login for all of them, so this extension would at least cover part of that (phpBB/MW). - - Tom - -- Curulan Angelicos Leader, Clan Titan OpenPG KeyID: 0x7ACEBA53 Clan Website: http://clantitan.org

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJNveofAAoJEJpTIX56zrpTgYcP/25N+oD0Rn69/sR2LdqYvaaJ DrUWP3ZovzVlgnbgodnu0bcxsNJbAvLkllHIEVQ+UlMBEFn+apWpDI07d7rNaRi4 UrTl/CiwVaGFWFSgNWKYm2VjZMTXNb3ofLgfq9LnhgaO/W31mGD/vcatI9irTjEk ekWVH9mZs8rJRFRLgjqbzYFi/QvPY8NszXI3eiTrAtA8X1IuVmEQlIIDMSnYa11u 4eStFYHRbuCoMRVdv1nvS0TDZ6m24h9ZZdOqCYOVQAgyb+lDf5R6O0e8buq6GUcO Q8TIf/YkBreAsY8Eeb4u0zMobvsinWj5IiAHWcLwsL1XFyyJwyYt9HQgRIhSsb5f drs1RaYks603Lwr6aF2covZ1G4yPC6t21nZUQbMLFprDZOWxZb31ccWKD7t1yiK8 CVxzgV+xI0k/v6DiWRKBk+2t8gLg9lWP0BJ9rtOcYszTLcNybyB+4mr+yJFAPnoS FtVEPAs3QIZxG4sGSXRwdRE2NgtR4Ky5/6119re6/pgeMA7LNffi72LbcmSYA5aB K0VpPjE5DsWRlNcj9/Okhc98TJ9cbC72jciOfTrGTc1Kh7mggdRV4BQZ40BykTLi D7jddBaPb0nZBy6YHYQY4RAFWZhj7mspQ8q9ndPHJtUKa5bbCgrwkJiZSOxiVdgi eqChHD2pSK5Vj+cNijFB =W0rB -----END PGP SIGNATURE-----

Adam Meyer

1:43 a.m.

New subject: [Mediawiki-l] phpbb Single Sign-On extension - Working beta

Id does all for separate DBs. There is no database usage at all in this plugin. On May 1, 2011, at 7:17 PM, Curulan Angelicos wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2011-05-01 19:02, Adam Meyer wrote:

...PGP SIGNATURE...

_______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

4742

days inactive

4742

days old

mediawiki-l@lists.wikimedia.org

Manage subscription

10 comments

5 participants

tags (0)

participants (5)

Adam Meyer
Curulan Angelicos
Dorem - Jérémie Bouillon
Kilian
Platonides