Automatic login to phpBB from my site's login script

[Noxwizard]

Try moving this out of inc_left.php and to the top of newindex.php:

Code: Select all

define('IN_PHPBB', true);
$phpbb_root_path = './../forums/';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);

// Start session management
$user->session_begin();
$auth->acl($user->data);
$user->setup(); 

[zalhain]

Not entirely sure why I didn't think of that one but thank you!

[nchmura]

I have an existing site with it's own security system. What I want to do is: Whenever a user logs into our site with the current security tools, they will also automatically be logged into phpBB. I've been pointed to this page (http://www.phpbb.com/kb/article/phpbb2- ... tegration/) several times while reading the forums here. The first problem is that I'm using phpBB3 and the second is that this talks about sending the user to a login screen. I don't want to send them to a second login screen, I just want to log them in based on the fact that they passed our site's own authentication. I've found lots of examples that come close, but nothing that answers my specific situation. I can't imagine I'm the only one who wants to do this.

Any ideas?
Thanks,
Nate

I have a similar situation with phpbb2 - i have my own authentication system and I integrated phpbb2 into it. It is working fine and, but yeah, it's a mess. So I am considering upgrading to phpbb3 and was wondering if you would entertain a quick question from me?

I am curious what you are doing to sync up your security systems users with phpbb3's users?

In my v2 system, when a user signs up into my security system, I am inserting a record into phpbb's user table and going from there - all the while making sure the "common fields" (name, location, website, IM's, password, etc..) between the 2 stay in sync.

Kind curious if you came up with anything a little more clever

Thanks for any help!

Nate (also)

[nchmura]

Another quick question on this login business: I have my password accessible as a md5 hash, and Noxwizards wonderful bit of code works (for me) only when I pass in a plain text password.

Is there anything unobtrusive I can do to tell it to use the md5'd password? I see a few ways I can muck around with the forum code to get past this, but would rather not.

Of course, if worst comes to worst, I can do the plain text thing.... it would just be an extra step

Thanks again. This is great stuff, I am really digging phpbb3 so far!

[Noxwizard]

Generally the login script grabs the password directly from the form, so plain text is how it would be received. phpBB will then use its hashing algorthim and check the validity, and then log the user in.

Code: Select all

//Grab the user's data from the form
$username = request_var('username', '', true);
$password = request_var('password', '', true); 

If you have an intermediate step which intercepts the data first, and then sends it off to the login scripts, then you'll need to keep a plaintext copy for the phpBB login.

[nchmura]

Thanks!

I did end up doing the plain text thing, it works quite nicely.... apart from one strange little thing - I did a conversion from my phpbb2 data, and this auto login thing only works when the users password has been "upgraded" - it looks like the conversion stuck them all in as straight up md5 values, but when you first log in it prompts you with an image challenge and relogin, which then updates the user_pass_convert field to 0 and the password looks like it undergoes some other form of encryption.

I think I can interface/yank out the password generating stuff in phpbb3 and use the same password encryption/logic when I sync up my users database with phpbb3s.

In theory at least

Thanks for your help!

[SGr33n]

Hi,

I need to do something like this, but for an asp auth system, coded by myself.
Is it possible? I guess that the only way is to open a javascript popup, right?

Thank you.

[Noxwizard]

It may be possible, I don't know. I've never tried running a script between PHP and ASP.

[ecwpa]

Try adding this into the <form>.

Code: Select all

<input type="hidden" name="redirect" value="../index.html">

Where ../index.html is the path to the file you want to redirect to.

wow, that was a great help for me, thanks!

there is any way to do the same when loggin out? i tried the same trick but didnt worked for me, it allways send you to the main forum

[Noxwizard]

The built-in logout function does not take redirects.

[Remote_Control]

Recently I got a note from my hosting company that I needed to update my forum to phpbb3. Updating isnt an issue as I have done it before.
My problem is using mIRC to read a socket and log into the phpbb3 forum to read the latest posts and msg these posts to a specific chat room. I have this type system working just fine for my phpbb2 forum version, but the login method has changed for logging into phpbb3. I will post how I am logging into phpbb2 forum below. I am hoping someone can correct this method to actually login into phpbb3 using the new format.

Code: Select all

hunny POST /hostforum/login.php login=1&redirect=/&username=SiteAdmin&password=mypassword&autologin=on&Submit=login

The coding above sends correct Username and Password information to log into phpbb2 type forum. Since this forum is only for registered users, its completely hidden unless you are logged in. Any assistance correcting this method of logging in would be appreciated.

[Noxwizard]

The change isn't really major, just the name of the file:

Code: Select all

hunny POST /hostforum/ucp.php?mode=login redirect=/&username=SiteAdmin&password=mypassword&autologin=on&Submit=login

[Remote_Control]

Ok this is getting me closer, but it still isnt redirecting to index.php. So that part of the code for mIRC doesnt appear to be correct. I did try the following, but still not correct.

Code: Select all

/hunny POST /testing2/index.php?mode=login redirect=/&username=SiteAdmin&password=mypassword&autologin=on&Submit=login

This is what I get reading the socket using whats posted above. Which tells me it still isnt right. I tried using the ucp.php? as you posted above, but get same result. Still isnt logging in correctly.

Code: Select all

HTTP/1.0 200 OK
			<div class="inner"><span class="corners-top"><span></span></span>
							<li class="rightside"><a href="#" onclick="fontsizeup(); return false;" class="fontsize" title="Change font size">Change font size</a></li>
1 -- 			<label for="username">Username:</label>&nbsp;<input type="text" name="username" id="username" size="10" class="inputbox" title="Username" />
1 -- 			<label for="password">Password:</label>&nbsp;<input type="password" name="password" id="password" size="10" class="inputbox" title="Password" />

[Noxwizard]

Try:

Code: Select all

/hunny POST /hostforum/ucp.php 
mode=login&redirect=/&username=SiteAdmin&password=mypassword&autologin=on&Submit=login

It needs to go to ucp.php because it does the login handling.

[Remote_Control]

Nope that still doesnt work. I keep seeing this in the html of the page.

<li class="icon-logout"><a href="./ucp.php?mode=login" title="Login" accesskey="l">Login</a></li>
<li class="icon-home"><a href="./index.php" accesskey="h">Board index</a> </li>

What exactly does this "accesskey="?" part mean? Is that something that could be causing the issue of not being logged in?