Single sign-on (SSO) is a method of access control, that enables a user to authenticate once, and gain access to the resources of multiple software systems. Well in my case, the task i have given is to authenticate a user in a PHP and a JAVA (Web) system simultaneously.
My PHP web application is the well known Joomla CMS, and my JAVA web application is based on JSF and custom built. After some thinking and research I found several resources which are worth reading (JOSSO, OneSign ), but i couldn’t take any help from them, mostly those SSO frameworks are complex ( yeah :) I couldn’t understand ) and aimed on a general pourpose and most of them are not for free.
So yeah I thought of doing some Hack to joomla and also make some changes in my Java web app’s authentication method. After talking with some of my geeky Friends (Sandaruwan and Anjana). I came up with two approaches. both are involved in handling the cookies manually up to certain extent.
The 1st approach is (Which i didn’t try and had to give up due to the reason that I am using JSF as the web application framework) to log-in to the Joomla site and after loged in to Joomla create a random named temp file in the server (possibly in /home/secrets with 777) with the user-name (if a valid log in) and set a cookie using set_cookie(“name”,$filename) and direct to a jsp page to do the java side authentication.
in this JSP, page read the secret file name from the cookie and read the file from the http server in-order to take the username of the loged-in user. By passing this to the authentication method of the java web app, the java side also can be authenticated.
yup it is pretty simple, but i had to give it up mainly because I use JSF. if I do the user authentication in the above way in the java side. I cannot add the user object to the FacesContext which will be used by my other java side components. so even though i log in. later on in other jsf pages my loged user cannot be found. (Shortly my java login process is not happening according to the JSF implementation procedures.) and secondly i had to give up this method because my Project manger didn’t like the idea of saving temp files in the server. :)
So the Second and the method which i have implemented is, automating the Joomla log-in process by making an http request to the http server from my JSF backing bean. and set the PHP cookie manually via Http Servlet response.
There are two different scenarios.
1. User can visit teh home page of the joomla site 1st and the PHP Cookie is already set.
2. User visit the Java site PHP Cookie is not available.