Magento Authentication

Question

I have 2 sites. A Magento store and a site that was created in asp(on a subdomain). I'm looking to be pointed in the right direction as to how i can achieve the following:

When being logged into magento as a customer, i want the asp site to recognize that the person is logged in. My issue is that my users need to login to 2 different sites and i would like to consolidate that into just using magento credentials.

Thank you in advance

Answer 1

Magento has a Cookie model, Mage::getModel('core/cookie'), which provides methods for manipulating cookies. The basic approach you would take would be to drop a cookie which is submitted to both sites (via the cookie's domain property).

However, using this for authentication is a bad idea--it's much, much better handled by an established cross-site security protocol such as OAuth, which is (moderately) documented on the Magento site.

With OAuth the basic flow is:

1. User lands on Site A, which handles authentication. They login and establish a session.
2. When user goes to Site B Site B can initiate a handshake with Site A. If the handshake succeeds then user is briefly redirected to Site A to respond to a "Are you sure you want to provide permission to Site B" prompt (or they are prompted to login to Site A, if they haven't done so).
3. When the user confirms the prompt they are returned to Site B, with a token indicating their authentication at Site A.