Building cross-platform login system with OTP

by: alcalbg date: 06/05/2014


I often get these questions:
- how can I connect users from WordPress with SocialStrap
- I want users from Drupal/Joomla to be automatically logged in to SocialStrap
- I have a forum and I don't want my logged in users to login again with SocialStrap

Although I never had a time to build such system with SocialStrap (each platform/cms require a different one) I will try to explain the basic concept here. This is a generic #tutorial not limited to SocialStrap, it should work for any two platforms. Note that I am very bad at explaining things, particularly in English

The only requirement is to have the same and unique usernames on both sides. This means that mark78 is the same guy on SocialStrap, Drupal, WP, Joomla or whatever. The key of success is to tweak authentication methods of both platforms. They will recognize their users through OTP - One Time Password.

OTP is something that will be regenerated at each page load and stored in a separate (intermediate) database table, let's call this table 'cross_login' and it will look something like this.

mysql explain cross_login;
Field | Type
=====================
username | varchar(50)
otp | varchar(255)
lifetime | datetime

Both platforms must be able to write/read to this table. Once we got this working we will append a simple get parameter to all the links to our second platform. For example, mark78 is now at SocialStrap site and he clicks on a simple top-menu link to our second, WordPress site: http://wordpress.example.com/?otp=d981-isud-d3d3-3d11 (note that d981-isud-d3d3-3d11 is a random string that will change at each page load but the cross_login table will hold the latest, valid value: mark78 / d981-isud-d3d3-3d11)

At the other end, somewhere in WordPress galaxy, far, far away, there will be a system that will listen and catch this url parameter. If the user is not logged in and the url contains OTP string that can be matched against cross_login table (search for d981-isud-d3d3-3d11 yields mark78 ) we have a valid user coming to us. At the end of the process, WordPress has to login mark78 seamlessly using its own authentication methods.

So there you go, this is how I would do it. FYI, I have done this before, on my other projects and it still works great, even on separate domains and different technologies.

Payments

We partnered with 2Checkout because of its proven success in processing billions of dollars in transactions, its focus on security, and its global reach.

Support & Help

If you need more info or our support please send an email to info@socialstrap.net and we will get back to you.

Contact

SocialStrap
info@socialstrap.net


Copyright © 2014 - 2017 SocialStrap, All Rights Reserved.