User Login passthrough in iframe

Question

I've got two (almost) similar Joomla sites (same users, configuration etc) forming an Intranet.

One site is integrated on the other using an iframe and I need the user to be logged in on both instances.

How can I avoid the user having to log in on both sites? In other words: How can I achieve the user being automatically logged in on the iframe depending on the parent website?

Here's what I tried so far:

This code is executed on the parent (non-iframe)

<?php
$user = JFactory::getUser();
$name = $user->username;
$pw = $user->password;
?>
<iframe height="500px" width="100%" src="http://[myurl]/Joomla-Test/pw?n=<?php echo $name;?>&p=<?php echo $pw; ?>"></iframe>

This code is executed on the child (iframe)

<?php
$name = $_GET["n"];
$pw = $_GET["p"];

$credentials = array();
$credentials['username'] = $name;
$credentials['password'] = $pw;

$options = array();
$options['remember'] = (bool) "false";

$app = JFactory::getApplication();

$app->login($credentials, $options)
?>

Keep in mind this is a closed Intranet, so security is not much of an issue. What this is supposed to do, is pass the username and encrypted password as GET parameters to the iframe (same users and passwords) and then log in using these parameters.

But the JFactory::getApplication()->login() always returns false (login failed).

How can I correctly implement this?

Edit:

I believe this could be achieved by passing the username and encrypted password to the right function at the right time. I just don't know which function uses the encrypted password or at what point the password is encrypted.

Can someone with better knowledge of the Joomla Codebase point me in the right direction?

Answer 1

Certainly what you have presented in your question, is not the way to do it.

One way would be to have shared user sessions for the 2 sites. There are some extensions that would help you with this:

https://extensions.joomla.org/extensions/extension/core-enhancements/multiple-sites/multisites-single-sign-in-for-domains/

https://alterbrains.com/joomla-extensions/administration/multisites-manager

Another approach, could be to write some custom user authentication plugins for the main and the iframe sites, and create a communication between them, so once the user logs in into the main site, your plugin will communicate with the other site to trigger the user authentication there as well - and the same should happen for the log-out.

I haven't tried it and it's also late here to think it a lot - but in theory something like this could work.