One Login Form (Server)

[jasny]

One Login Form (Server)

[jasny]

Than it would work pretty similar to CAS. The disadvantage is that you can only attach using a redirect and not client side, which is required to work with AJAX.

Note that this SSO implementation was made with the requirement that the use of the SSO server was hidden to end user and with the assumption that each broker can be trusted. However the lib has become more popular and I understand that others have other requirements.

I might add CAS compatibility in the future, since there is obviously a demand for it CAS compatible server in PHP.

[jasny]

This should work. It's hard to say why it doesn't without debugging it.

Find out what the $sid and session id are by setting a breakpoint on Server.php line 221.

When the login form is show, check the session cookie to make sure the value matches the earlier session id.

When GetUserInfo is called, check if $sid matches the earlier grabbed value by setting a breakpoint on Server.php line 71.

Check the session file to see if the expected session data is in there.

[syphernl]

Server-side logins would be a nice feature! That feels a lot safer than having to provide your login details to (potentially) insecure brokers, plus allows you to enforce a unified login style for all brokers.

[jasny]

Related to #69