Password Hash

MODx always starts a session anyway; you can access it by setting the session_name to the one in your MODx manager/includes/config.inc.php file (around line 17) before the session_start() function in the second application. You would just need to use a MODx plugin, using the OnWebLogin event, to set the session values the second application needs.

http://il.php.net/session_name

Quote from: sottwell at Jun 06, 2009, 03:15 AM

And if you need more than one? Perhaps integration with a forum and an ecommerce application?

The xPDOObject->encode() function is generic and nothing to do with integrating anything. It does allow you to support various password hashing algorithms easily and in a sharable way (i.e. in standard ways that all kinds of components can use).

All user integrations I am endeavoring on will use the concept of remote passwords, i.e. you will configure a derivative modUser class + a plugin (for Authentication against the remote system, adding new user instances on first login, creating profile/membership/authorization data for MODx, etc.) and as a result MODx will never store the password in the local user table; it will always delegate authentication to the remote application. This "federated" approach to user integration avoids most of the headaches associated with synchronization solutions.

Session hijacking can be a useful technique, but it almost always requires hacking one system or the other. IMO, that’s just not a sustainable solution, but in some cases may be your only choice, especially if you want to accomplish SSO with systems that simply were never made to talk to each other.

Quote from: rthrash at Jun 05, 2009, 07:01 AM

What about upgrading from prior MODx versions? That is a reason to keep using MD5 passwords.

Or an opportunity to convert to something more secure.

Converting from already hashed passwords isn’t straightforward and should technically be impossible, even though they can be cracked. You’d have to force your users to change their passwords and go through some "interesting" machinations.

Everybody’s doing it. Seriously though, given the nature of users in general as regards passwords it’s worth the momentary, one-time inconvenience to get them to update.

Quote from: rossco at Jun 05, 2009, 04:22 PM

I recently tried to integrate SMF with MODx but since it’s 2 different hashing, I can’t simply copy encrypted passwords between the 2 databases.

SMF has a great feature that’s called Integration Hooks, which enables you manage your user session with an external application - in this case, Modx.

For more informations, you could look at :
http://www.simplemachines.org/community/index.php?topic=173483.0

It was of great help for me when I created my own snippet to integrate SMF, even though it’s still not a perfect one.

Check here for my snippet, I’m pretty sure it still needs to be enhanced.

http://modxcms.com/forums/index.php/topic,32824.msg199884.html#msg199884

I used the SMF hooks as well but I never managed to get it working very well... I will take another look at your snippet and see if I can get it sorted out.

Thanks

Quote from: Thalion at Jun 07, 2009, 03:36 AM

SMF has a great feature that’s called Integration Hooks, which enables you manage your user session with an external application - in this case, Modx.

For more informations, you could look at :
http://www.simplemachines.org/community/index.php?topic=173483.0

Every time I start looking into using the SMF hooks, my brain freezes as soon as I try to understand how these "hooks" work. Just give me some classes I can override already! Or how about some SOAP or REST-based web services I can call from my applications?

Quote from: OpenGeek at Jun 07, 2009, 03:28 PM

Every time I start looking into using the SMF hooks, my brain freezes as soon as I try to understand how these "hooks" work. Just give me some classes I can override already! Or how about some SOAP or REST-based web services I can call from my applications?

As for me, my brain freezes as soon as I try to understand your classes !!! (which is probably why I have so much troubles with the access permissions for web user, but that’s another story)

These "hooks" are IMHO quite easy : first you make a link between an event name and the name of a function you created.
When SMF encounters this particular event, it then calls this function, and the returns overides the normal behaviour. As such, you can say a user is logged into SMF by using another user database, and even create this user if it doesn’t exists already into SMF.
From my point of view, this is very well thought, and in a way, is similar to the events and plugins in ModX.