Logging in user without getting password from them

Question

My requirement is something like login by Facebook, so the user does not provide password but gets logged in. I want to make a user logged in from within extension code by knowing his user id and/or username but not password.

How do I do that? I also tried to get user's encrypted password from database and put user name and that password in the login() method and then something went wrong, getting username and password mismatch error, although logged in!

I also found some codes from googling -

JPluginHelper::importPlugin('user');
$options = array();
$options['action'] = 'core.login.site';
$response->username = "user_name_here";
$result = $app->triggerEvent('onUserLogin', array((array)$response, $options));

It seems to work, but I don't know if there is any chance of this becoming wrong later when doing this in both 2.5 and 3.0 versions.

Answer 1

As far as I am aware, no piece of this is deprecated, so this code should definitely continue to function correctly in 2.5 and 3.0 installs. Even if something gets deprecated, you should be able to run this at least through version 4.0.

That being said, none of these pieces is likely to get removed. You are importing the user plugins and then triggering the onUserLogin event. This is the standard method to trigger plugins, so it should be consistent for a while.

The only other piece to remember is that you are undermining the security of requiring a user to login with their password. Do make sure that the piece that you are using to replace that is also secure.

---

Update per comment

The triggerEvent call runs through the different user plugins (found at plugins/user/ and calls the onUserLogin method if it exists. The key function is the one in the joomla plugin. I'm copying the entire function below:

public function onUserLogin($user, $options = array())
{
    $instance = $this->_getUser($user, $options);

    // If _getUser returned an error, then pass it back.
    if ($instance instanceof Exception)
    {
        return false;
    }

    // If the user is blocked, redirect with an error
    if ($instance->get('block') == 1)
    {
        $this->app->enqueueMessage(JText::_('JERROR_NOLOGIN_BLOCKED'), 'warning');

        return false;
    }

    // Authorise the user based on the group information
    if (!isset($options['group']))
    {
        $options['group'] = 'USERS';
    }

    // Check the user can login.
    $result = $instance->authorise($options['action']);

    if (!$result)
    {
        $this->app->enqueueMessage(JText::_('JERROR_LOGIN_DENIED'), 'warning');

        return false;
    }

    // Mark the user as logged in
    $instance->set('guest', 0);

    // Register the needed session variables
    $session = JFactory::getSession();
    $session->set('user', $instance);

    // Check to see the the session already exists.
    $this->app->checkSession();

    // Update the user related fields for the Joomla sessions table.
    $query = $this->db->getQuery(true)
        ->update($this->db->quoteName('#__session'))
        ->set($this->db->quoteName('guest') . ' = ' . $this->db->quote($instance->guest))
        ->set($this->db->quoteName('username') . ' = ' . $this->db->quote($instance->username))
        ->set($this->db->quoteName('userid') . ' = ' . (int) $instance->id)
        ->where($this->db->quoteName('session_id') . ' = ' . $this->db->quote($session->getId()));
    $this->db->setQuery($query)->execute();

    // Hit the user last visit field
    $instance->setLastVisit();

    return true;
}

This plugin does not check the password at all (that is done by the authentication plugins). So this mostly just checks that the user is not blocked and can login before setting the user's data into the session.

That session storage is the key to showing the user as logged in. Naturally you could just use this code directly, but it would actually be way more complicated than just letting this plugin do the work of checking that the user isn't blocked, storing their information in the session, and marking the last visit time.

Answer 2

If you change this, it'll work:

JPluginHelper::importPlugin('user');
$options = array();
$options['action'] = 'core.login.site';
$response = array(); //Add this line
$response['language'] = ""; //Add this line
$response['username'] = "user_name_here"; //Change this line
$result = $app->triggerEvent('onUserLogin', array((array)$response, $options));