Login automatically from mobile App to website without need to re-insert credentials

Question

The mobile App has been designed by myself (easy to manipulate). However, the website was designed by an outsourced developer (Joomla) and he is not available anymore. What I need to add is link the website to the mobile App such that the user can navigate to the website from the mobile App (and not the opposite) without being prompted to insert username and password again.

Both App and website linked to different DB's, however, they have identical usernames and passwords for each user. I can store the credentials in local variable storage and pass them to the website to validate them and then (somehow at the backend) allow the user to navigate directly to his home page in the website without going through login page. What I understand is that the website using the default Joomla login. But since I'm totally new to Joomla, I do not know where to start and where login process actually happens and if it is possible to amend it.

The system security requirement is very low and I'm free to bypass any complications as long as the user can see his profile in the website and not someone else's profile.

I checked the following threads:
Facebook Login - Tell joomla to login
What is the URL for user login (aka How to hide the login form?)
Logging in user without getting password from them
Single Sign On (SSO) Joomla with other System

And the first, is this possible using the default joomla login or you recommend using other plugins that are easier (specially for beginner Joomla user).

In case default login is recommended, what is the logic of using it? (how to send the credentials to joomla, and how joomla is going to receive them and navigate the user directly to the home page)

In case default login is not recommended, what plugins you recommend to use that require minimum manipulation (I'm very beginner in Joomla) and what is the logic should be followed?

Notice the username and the password are NOT encrypted, and security is not important here.

Answer 1

A couple of thoughts/options:

1) Since the separate databases share the same user credentials, you might be better served creating an authentication plugin for your website which authenticates against your mobile application database. This way, when a user logs into the mobile application they already have a transportable session.

2) Joomla core comes with other authentication options and there are many available through the extension directory. You could use Gmail, LDAP, cookies (core) or find a more robust offering from a third party developer for Facebook, OAuth2 or two factor authentication. The idea here being to abstract authentication to a third party service handle sessions which both your mobile and website application have application access keys.

3) Create a public facing endpoint you could execute a RPC from the mobile app to Joomla. There a good article (link below) on doing this. You could authenticate the post with the session token from the mobile app, having Joomla query the mobile database to verify it is legitimate and then server required content.

JSON Response with JResponse - Joomla CMS

Ultimately, my answer would be to migrate to just one authentication authority; whether its Joomla, your mobile database or a third party service. If not, suggestion three would be your next best bet provided you don't send user credentials in plain text.

I must contest your closing sentence however! :)

Notice the username and the password are NOT encrypted, and security is not important here.

Security is always important, regardless of personal perceptions. You are exposing your user base to unnecessary risk with the assumption. For example, one human error often exploited is everyone's propensity to use the same one or two passwords for everything. Meaning once a system has been exploited, the hackers will turn around and attempt to use those same credentials in other web services for a wide variety of nefarious activities; none of which end up well for the victims. In addition, you are exposing yourself and your hardware to unnecessary risks. You might wake up one day to find your website selling viagra, or get an insane bill due to usage because your server has been hijacked and acting as a proxy.

Good luck

Answer 2

I suggest creating your own API since it will be easier for you, or if you have any problems with the api, you can also check this plugin https://techjoomla.com/rest-api-for-joomla