2

I've got two (almost) similar Joomla sites (same users, configuration etc) forming an Intranet.

One site is integrated on the other using an iframe and I need the user to be logged in on both instances.

How can I avoid the user having to log in on both sites? In other words: How can I achieve the user being automatically logged in on the iframe depending on the parent website?

Here's what I tried so far:

This code is executed on the parent (non-iframe)

<?php
$user = JFactory::getUser();
$name = $user->username;
$pw = $user->password;
?>
<iframe height="500px" width="100%" src="http://[myurl]/Joomla-Test/pw?n=<?php echo $name;?>&p=<?php echo $pw; ?>"></iframe>

This code is executed on the child (iframe)

<?php
$name = $_GET["n"];
$pw = $_GET["p"];

$credentials = array();
$credentials['username'] = $name;
$credentials['password'] = $pw;

$options = array();
$options['remember'] = (bool) "false";

$app = JFactory::getApplication();

$app->login($credentials, $options)
?>

Keep in mind this is a closed Intranet, so security is not much of an issue. What this is supposed to do, is pass the username and encrypted password as GET parameters to the iframe (same users and passwords) and then log in using these parameters.

But the JFactory::getApplication()->login() always returns false (login failed).

How can I correctly implement this?

Edit:

I believe this could be achieved by passing the username and encrypted password to the right function at the right time. I just don't know which function uses the encrypted password or at what point the password is encrypted.

Can someone with better knowledge of the Joomla Codebase point me in the right direction?

  • Do you even know if this is possible? Ever seen it done before? I understand that you are not concerned with security for this application but "the powers" behind the evolution of the web realized (many years ago) the security ramifications of allowing certain behaviors within the (often cursed) iframe element. I'm leaning toward saying that this task is impossible via an iframe, but honestly I haven't researched -- it's more of a hunch. – mickmackusa Sep 19 '18 at 10:24
  • @mickmackusa It works as far as passing and retrieving the username and encrypted password. I believe this is a Joomla specific problem and I guess could be solved with more advanced knowledge about the login/authentication process joomla uses. – maikwuerth Sep 19 '18 at 11:26
1

Certainly what you have presented in your question, is not the way to do it.

One way would be to have shared user sessions for the 2 sites. There are some extensions that would help you with this:

https://extensions.joomla.org/extensions/extension/core-enhancements/multiple-sites/multisites-single-sign-in-for-domains/

https://alterbrains.com/joomla-extensions/administration/multisites-manager

Another approach, could be to write some custom user authentication plugins for the main and the iframe sites, and create a communication between them, so once the user logs in into the main site, your plugin will communicate with the other site to trigger the user authentication there as well - and the same should happen for the log-out.

I haven't tried it and it's also late here to think it a lot - but in theory something like this could work.

  • I haven't even thought about using a ready made extension. This should work. Thanks alot – maikwuerth Sep 20 '18 at 8:41

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.