Finally got back to this, made some progress.... It's not pretty, but it ~kinda~ works:
<?php
$username = $_GET['username'] ? $_GET['username'] : 'null';
$lifetime = '3600';
$rememberme = 'true';
$loginContext = 'web';
$addContexts = array();
$user= $modx->getObjectGraph('modUser', '{"Profile":{},"UserSettings":{}}', array ('modUser.username' => $username));
$user->addSessionContext($loginContext);
$_SESSION['modx.' . $loginContext . '.session.cookie.lifetime']= $lifetime;
$postLoginAttributes = array(
'user' => $user,
'attributes' => array(
'rememberme' => $rememberme,
'lifetime' => $lifetime,
'loginContext' => $loginContext,
'addContexts' => $addContexts,
)
);
$modx->invokeEvent("OnWebLogin", $postLoginAttributes);
$url = $modx->makeUrl(1, $loginContext, '', 'full');
echo $url.'<br />';
header("Location: ".$url);
exit;
called from this page:
[[!ShowMySessionInfo]]
User Internal Key: [[!+modx.user.id:userinfo=`internalKey`]]<br />
User name: [[!+modx.user.id:userinfo=`username`]]<br />
Full Name: [[!+modx.user.id:userinfo=`fullname`]]<br />
Role: [[!+modx.user.id:userinfo=`role`]]<br />
E-mail: [[!+modx.user.id:userinfo=`email`]]<br />
so right now I am just forwarding the administrator from a CMP with a username in the url... super insecure at the moment. However it does kind of work.
- the administrator cannot click on the link & get a user's session, if you copy the url into another browser [without an active admin session] THEN it will log you in as the requested user.
- the user seems to need to browse to another page before the session stuff shows up [hence the redirect]
- I think I need to make sure there are no active web context sessions in the user's browser to clear that little bit up ... I think, not sure!
- the admin needs to be able to get a session as these users, not sure what it preventing the browser/user logged in as admin from getting a user session.
- I also need to make sure that the user/browser/agent requesting the url is authenticated as an administrator BEFORE doing anything.
Any thoughts/advice on how to proceed from here?
