A couple years back I wrote a small and very incomplete component that authenticated users coming from outside of Joomla! i.e. a mobile application.
Is there a proper or preferred way of handing this?
2
-
Are there any security considerations? Will the other application be storing their username and password to authenticate or do you want to utilize a system that wouldn't have to store username/password combos in the other app?– David FritschCommented Apr 25, 2014 at 20:55
-
I think I would prefer a system that didn't store the credentials client-side. The applications login would fire a request to authenticate and if successful receive a token.– Nestor LedonCommented Apr 25, 2014 at 21:04
Add a comment
|
3 Answers
Based on your comment, you are looking for an OAuth setup. As far as I know, Joomla has Oauth classes built in to the core, but these classes are to allow Joomla to act as the client (your mobile app is a client in your case). They do not give you the option to run as a server.
I just recently used this package to set up an OAuth2 Server on the Joomla Framework: https://github.com/bshaffer/oauth2-server-php. It worked very well. This will definitely take a few days to get all set up and running, but you can definitely set this up within Joomla.
There are a couple different methods to authenticate a user within OAuth2. The common approach is to have the client redirect the user to your site to enter their login information. Then you redirect the user back to the client with a code that the client turns into an access token.
Since it sounds like you also control the mobile application, this is unnecessary. You trust the client (I hope), so you can just have the user login to the application.
You would then use the "Resource Owner/Password Credentials" option outlined here: http://bshaffer.github.io/oauth2-server-php-docs/overview/grant-types/. This has the mobile app just ship the user/password entered over to your Joomla site, and then the Joomla site ships back a token for validation. The token can be saved and used the next time instead of having them login again.
This gives you control on the Joomla site to invalidate tokens to force mobile users to login again.
answered Apr 25, 2014 at 21:16
You can use the following code:
JFactory::getApplication()->login($credentials);
where:
$credentials = Array('username' => string, 'password' => string);
-
I found the following in the Joomla! documentation, are there significant differences in this approach? docs.joomla.org/… Commented Apr 25, 2014 at 19:16
-
1The method
loginabove use the JAuthentication::authenticate method which trigger the onAuthenticate event. So this documentation tells us about one part in joomla login cycle. Its purpose is provide a way to interact with the joomla login cycle and do a custom login. In this cycle we have the onUserAuthorisationFailure, onUserLogin and onUserAfterLogin events too Commented Apr 25, 2014 at 19:41
You want to use something like OAuth/OAuth2. My idea here is not true OAuth but based on my knowledge of Joomla the easiest way.
Validate the user via API call to the component in Joomla to create a token that is attached to their IP, then redirect them with a GET request that validates that token and creates the session for them. The token is easy to secure since it relies on the IP to authenticate the already authenticated user, best way is to make sure it can only be used once. For the API call it should be a SSL encrypted POST request for the best results.
So send a POST request to you component containing the users IP, username and password. If it is all valid then you send back a token. You then redirect the user to your component containing that token to set the session. I do not know how the Joomla API can be used to log a person in, but I am sure there is something for it.
Edit: Seems csbenjamin answer has went into the API for logging in.
answered Apr 25, 2014 at 18:53
