Custom Members area...

I've got a MODx Revo project that will require a user to login to view MODx documents. Of course, there's already ways of building this out in MODx (i.e. http://rtfm.modx.com/display/revolution20/Making+Member-Only+Pages). But here's the catch: we're going to be connecting to a MS-SQL database where the client already has the username and passwords stored of their existing members. Instead of trying to hack MODx to get it to connect to an outside MS-SQL database, would it be just easier to write a snippet that will handle permissions? Here's what I envisioned:

We'll create a simple login form. When the member enters their u/p into the form and it's correct, we'll grant them a session to the MODx pages for members only. We'll just run a snippet on each page and if they have a session to view the member's page, we'll output the MODx template. If not, we'll redirect them to a page saying they don't have access.

Am I on the right track here or should I try to work with MODx's permissions even though it's a different database outside of MODx (and is a MS-SQL database)? Curious if anyone else has been able to do this without having to hack at MODx's permission setup. One other thing to note: the client will not be maintaining the member's permission status in MODx. They'll be handling that solely by their admins in their SQL database. So at no time does the MODx manager need to handle permissions in this project. [ed. note: flinx777 last edited this post 14 years ago.]

This should be possible via the following flow:

1. Write a custom Snippet that accepts the username and password (as stored in the MS-SQL database).
2. When submitted, the Snippet would have to check the foreign database to see whether or not the login credentials are valid: typically this would mean hashing the password using the same algorithm as the foreign database. So you'd need to know how the password hashes were generated on the foreign database -- did they use md5, sha1, pbkdf2, etc? And were the passwords salted?
3. If the credentials are legitimate, then you can set a MODX session and grant the user access to a MODX User Group containing your "Members Only" pages.

Re #3, you may want to deconstruct some of the "Login" snippet... since you're not doing anything else with these users (e.g. no MODX profile etc.) the question will be "how do I leverage MODX permissions to grant access to restricted pages?"

Option 1: you could have a "placeholder user" with a known username and password. The public would never see or use the login credentials for that user, but your customized login flow could manually log that user in after successfully authenticating against the remote database. The effect would be that all of your users would look like a single user to MODX, sorta like when you log into MODX using 2 different browsers.

Option 2: create a pool of temporary users inside a given User Group (the one with access to the restricted Resource Group): if someone successfully authenticates, log them into MODX as one of the available temporary users. If the temporary users are all being used, then create a new one on the fly. This scenario would be more complicated, but if you need a paper-trail of specific users and their actions, then this is probably the more attractive option.

Option 3: forgo MODX permissions entirely and use a custom Snippet or a Plugin that would check the user session on page-load: if the user is not logged in, then the page would redirect to the login page. E.g. a little snippet at the top of your templates like



This option is appealing for its simplicity, but it offers no paper-trail and is decidedly low-tech.