Member Avatar for CoolAtt

hi all,

i have 3 php websites , each one requires login (same username+password for all of them)
they run on apache virtual hosts on the same machine.

i want to centralise login on a single page by adding 3 forms on a page so that when i click on a button the logins are submitted to the respective websites.

can anyone advise if this is possible ??

please advise on this.thanks.

  • 8 Contributors
  • 9 Replies
  • 272 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Single-sign-on is the right pattern here — try to avoid hacks that push session IDs in URLs or that pretend to “log in” the browser by server-side cURL. The cURL idea from can automate POSTs to each app, but a server cannot set cookies for other domains/hosts in the user’s browser, so that approach quickly becomes brittle. The warning from about URL session IDs is also important: URLs get logged, bookmarked and leaked.

Practical, ordered options that work cleanly and safely:

  • Use a proper SSO/IdP (OpenID Connect, SAML or CAS). Deploy a small IdP (Keycloak / SimpleSAMLphp / similar) and register phpBB3 and MediaWiki as clients (both have SSO/LDAP plugins). Roundcube can be made to trust the same backend or via a plugin. This gives standard token handling, logout, expiry and avoids fragile hacks.
  • If all sites are subdomains of one parent domain, share a cookie + central session store (DB/Redis). The central login issues a signed cookie for domain=.example.com; each app validates the signed token and creates a local session on first visit. That is simpler than a full IdP but requires small plugins or bootstrap code inside each app.
  • Handle auth at Apache level (reverse proxy / mod_auth_openidc or mod_auth_cas): authenticate once in front of the apps and pass REMOTE_USER to backends. This minimizes app changes but requires server configuration.

Minimal illustrative pattern (signed token cookie — conceptual only):

$payload = json_encode(['uid'=>$userId,'exp'=>time()+3600]);
$token  = base64_encode($payload) . '.' . hash_hmac('sha256', base64_encode($payload), $secret);
setcookie('SSO',$token, time()+3600, '/', '.example.com', true, true);

On each app verify the signature, check expiry, then create a local session for the uid.

Security & operational notes: always use HTTPS, set Secure and HttpOnly, use short token lifetimes, provide logout/revocation, and don’t roll your own crypto in production — use established JWT/OpenID libraries. Account for session overwriting (Member #120589’s point) by mapping SSO IDs to local sessions rather than blindly replacing sessions. For Roundcube remember it authenticates via IMAP — either give Roundcube the same auth backend (LDAP/SSO plugin) or accept its specific integration requirements.

Recommended Answers

All 9 Replies

Member Avatar for xylude

Just an idea, but you could have the forms submit to your first PHP login processing file, then pass the rest of the info along to the other login processing files with curl from your first script.

Member Avatar for cliffordpg

Why don't you just use cookies for when they login sites, retrieve cookie data and verify based on last login (in ur db) and expiry of cookie

Member Avatar for CoolAtt

each of the 3 web applications use their own session management.
one of them is RoundCube webmail which uses cookies to store the sessionID.
i wanted to modify it so that it does not use cookies to store the session id but adds it on the url.
but the code looks difficult ... and will take some time :(

in this way i could use curl to log on behalf of a user then get the sessionID.
once i get sessionID i can use it on a real browser.

the other 2 web applications i have are phpBB3 & MediaWiki

Member Avatar for metalix

really try to avoid posting data through the URL.
remember guys that this can be bookmarked.
and the session id can change each time and this compromises security if an old one and new one get mixed up.
and you can use cookies and sessions together.
but alot of people block cookies.
try to set up a system where it uses cookies, and then goes to sessions if cookies are disabled,

Member Avatar for janfkowalski

This maybe quite late answer, but its possible to achieve with mixture of headers(301,302), pass encrypted data using the GET array. If you add CURL and smart use of JSON you may be also able to register the users on all sites at the same time.

Member Avatar for vsolute

why don't use a list box? if you use list to give the user where they want to logon to and use if statement with redirect function to redirect to different web site address.

Member Avatar for vsolute

let me know if you need guild on how to code it ok

Member Avatar for Member #120589

2 year old thread. I doubt the OP is going to benefit from this. However if you feel the need to post some nifty solutions with code, please do so. This thread is well and truly dead from the OP's point of view, but others may benefit from your solutions.

So, we have some sugegstions for headers, cURL/JSON and list box redirects. Interesting.

One thing to bear in mind - overwriting sessions. Logging in members who are actually already logged in - session expiry may be different on each site.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.