Need an expert : How would you do a single login for multiple admin areas?

PHP
1

Hello,

I have this new clients that needs to login to 7 different admin areas :

  1. His wordpress area,
  2. PHPBB3 forums
  3. Some tool to help with his SEO,
  4. his webmail interface on the hosting i provide,
    …) and 3 other logins related to managing servers from different providers, not hosted locally.

I want to relieve some of this complexity and provide him a single login prompt to all of these, through an interface i make. But I am not yet sure on the best way to do this properly.

In short what i want to do is create and admin area. The client would login once to this panel (of my making) and he can access his 7 other panels in the form of links/buttons. He would be able to access everything with a simple click without the need to login to them individually.

Ideas I had that didn’t work out :

  1. Store all his logins/passes into a database, have my server login remotely to all the different admin areas, then copy the cookies and replicate the session from the panel i create. Idea won’t work since I can’t possibly set cookies on my client’s machine on behalf of remote websites.
  2. Make a script that would login to the remote admin areas, read the html pages, then displays them on my panel. After tweaking the html to change urls etc to make the pages work properly. It would work as a kind of proxy… But this doesn’t work either as I don’t know how to make a server/script behave like a browser and create cookies/sessions to be able to do the login part.

I can do a lot with PHP, but the “remote access/login” problem is what I need to figure out.

Any ideas or suggestions are welcome.

2

You will probably have to rewrite authentication methods in wordpress, phpbb and all your other tools to make use of the same values in $_SESSION
then after user loggs in from some main login form you will authenticate user, add something to $_SESSION like $_SESSION[‘userid’]
Then all those scripts will only have to check $_SESSION[‘userid’], make sure it exists and them possibly check against a database record to make sure that the userid corresponds to user who has all the necessary permissions to do stuff.

You just need to study all those scripts like phpbb, wordpress to see how their user authentication works and then think of some changes you can make to them.

3

Studyging the contents of the headers of each system might help, on FF install LiveHttpHeaders add-on.

Then getting cURL to emulate each of those headers would then be the next challenge …

4

lampcms, your solution would definitely work. The only problem is that it won’t cut it for external sites.

Cups, I will look into that. Thanks both of you for the suggestions.