Create Single sign-on using Magento sessions

Question

I have an application hosted on a different server, and I want to authenticate using Magento instead of maintaining two separate user lists. I've already done this for applications on the same server using the common method:

require_once('path/to/app/Mage.php');
umask(0);
Mage::app('default');
Mage::getSingleton('core/session', array('name'=>'frontend'));
$session = Mage::getSingleton('customer/session');

if($session->isLoggedIn()) {
    echo "logged in";
} else {
    echo "not logged in";
}

How do you do this without direct access to Mage.php? I've attempted setting up a helper script that uses the above code, and making an AJAX call to it, but it always returns "not logged in".

Has anyone else ran into this issue?

Answer 1

Your AJAX-Request won't submit your current Sessioncookie to the remote Domain. Even if it would be submitted the remote Shop won't be able to associate your Cookie to the account given.

This is an typical Cross-Domainproblem. You could use jpillora/xdomain, CORS or mudco to solve this.

Answer 2

Please have a look at this link where the
Session cookie management field descriptions
are, this may help with what you are looking for, I have wrote a script myself however I am using mage.app unfortunately (but on another domain).

http://www.magentocommerce.com/wiki/modules_reference/english/mage_adminhtml/system_config/edit/web

---

REVISION The code is located outside of magentos scope

<?php
//MAGENTO CONNECTION AND CUSTOMER INFORMATION
require_once '../../app/Mage.php'; // location of mage
umask(0);
Mage::app('');
Mage::getSingleton('core/session', array('name' => 'frontend'));
$session = Mage::getSingleton('customer/session');           
//Zend_Debug::dump($session->isLoggedIn());
if(!Mage::getSingleton('customer/session')->isLoggedIn())
    Mage::getSingleton('customer/session')->setBeforeAuthUrl(Mage::helper("core/url")->getCurrentUrl());
?>

LOGIN SECTION (PHP)

switch($_REQUEST['action']) {
    case 'login':
        try {
            $login = $session->login($_POST['username'],$_POST['password']);
        } 

        catch(Exception $e) 
        {
            echo $message = $e->getMessage();
            echo 'Click <a href="WERE YOU WANT TO LINK">HERE</a> To login';  
        }
        header("Location: ");  //REDIRECTS IF SUCCESSFULL
        break;

    case "logout":
        $session->logout();
        header("Location: "); // REDIRECTS WHEN YOU LOGOUT 
        # Redirect or give a status message, etc
        break;

    default:
        # If the customer is not logged in, show a login form
        # If the customer is logged in, show a logout button
        if($session->isLoggedIn()){ ?> LOGGED IN CODE <?php } else { ?> NOT LOGGED IN <?php } ?>

LOGIN FORM

<form method="POST" action="index.php">
            <label for="username" >Email</label><br />
                <input type="text" name="username" size="40" /><br /><br />
            <label for="password" >Password</label><br />
                <input type="password" name="password" size="40" />
            <input type="submit" name="submit" class="button-link" value="LOGIN" />
            <input type="hidden" name="action"  value="login" />
        </form>

This is basically a self submitting form, mage app will check the user supplied info run the action and create a session. Let me know how you get on :)

Answer 3

We have implemented two solutions for the SSO with Magento 2

1 - With the Social Engine

2 - With the WordPress

you can have a look if any of them works for you. Following are the links of those extensions :

1) http://www.ipragmatech.com/products/magento-socialengine-sso/

2) http://www.ipragmatech.com/products/magento-wordpress-sso/