headers
Adam Meyer | 1 May 2011 02:59
Picon

Using Ajax for single single sign on. How bad of an idea is this?

Im really not one for reasonable solutions if it means inconvenience to the user.

Im looking for ways to integrate single sign on for phpBB and mediawiki.

I have only found one solution, but im wondering how bad of an idea this is.

When a user goes to to mediawiki it does an AJAX call to a phpbb file and checks if the user is logged in or not. If
they are, mediawiki would then force a login for that user. If not, it would force a logout.

I know that the AJAX response can be faked pretty easily by setting a stop point in fire bug or console, and
changing the return value. So this would easily allow a user to change who they are logged in as.

But what if I included a salted hash and checked the values against that? I think it would only be as strong as
the algorithm.

I just can not keep requiring the 2 sign on thing - It is so confusing on my site.

-Adam
Permalink | Reply | 10 comments |
headers
Kilian | 1 May 2011 03:59

Re: Using Ajax for single single sign on. How bad of an idea is this?

There's no reason to use Ajax. Just have MediaWiki check on the server 
side whether the user is logged in. Have a look at:

http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration

-Kilian
Permalink | Reply | 9 comments |
headers
Adam Meyer | 1 May 2011 05:45
Picon

Re: Using Ajax for single single sign on. How bad of an idea is this?

Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa.

On Apr 30, 2011, at 9:59 PM, Kilian wrote:

> There's no reason to use Ajax. Just have MediaWiki check on the server 
> side whether the user is logged in. Have a look at:
> 
> http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration
> 
> -Kilian
> 
> _______________________________________________
> MediaWiki-l mailing list
> MediaWiki-l <at> lists.wikimedia.org
> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
Permalink | Reply | 8 comments |
headers
Adam Meyer | 1 May 2011 06:18
Picon

Re: Using Ajax for single single sign on. How bad of an idea is this?

I actually figured it out with almost no changes to core phpbb files. - Just renaming the user class ONLY if it
is called from mediawiki, so nothing in the forum ever see the change.
Ill see if I can make a single sign-on plugin for mediawiki/phpbb with instructions.

On Apr 30, 2011, at 11:45 PM, Adam Meyer wrote:

> Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa.
> 
> 
> 
> On Apr 30, 2011, at 9:59 PM, Kilian wrote:
> 
>> There's no reason to use Ajax. Just have MediaWiki check on the server 
>> side whether the user is logged in. Have a look at:
>> 
>> http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration
>> 
>> -Kilian
>> 
>> _______________________________________________
>> MediaWiki-l mailing list
>> MediaWiki-l <at> lists.wikimedia.org
>> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
> 
> 
> _______________________________________________
> MediaWiki-l mailing list
> MediaWiki-l <at> lists.wikimedia.org
> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
(Continue reading)

Permalink | Reply | 7 comments |
headers
Dorem - Jérémie Bouillon | 1 May 2011 09:01

Re: Right hook to use for head html element?

On 30/04/2011 22:37, Daniel Friesen wrote:
> Use the BeforePageDisplay hook and $out->addHeadItem if there is no more
> specific method for what you're trying to insert (ie: a<link>,<meta>,
> <script>,<style>, etc...)
>
> http://www.mediawiki.org/wiki/Manual:Hooks/BeforePageDisplay

Just what I was looking for, thanks a lot.

Is there a way to control exactly where the content is added?

I used the $out->addScript way to add my script, but it's not placed at 
the end (there's the sshover.htc IE call and a vector script added after 
it).
Permalink | Reply | 4 comments |
headers
Dorem - Jérémie Bouillon | 1 May 2011 09:09

Vector skin, <html> xmlns disappeared

Help me Obi, you're my last hope ^^

I got a strange thing, and can't find why.

I got no xmlns attribute anymore on my regular pages (1.16.4, Vector, no 
source hacking).

My HTML sources start as :

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html lang="fr" dir="ltr">
<head>

$wgXhtmlDefaultNamespace is correctly defined, I even try to add it a 
second time in LocalSettings.php, no effect.

And I can't remember when was the last time xmlns was there (been 
working for 2 days on my MW install, and didn't check closely that part 
of the rendered source before having some strange CSS issues and needed 
to validate the html).

Checked bugzilla, Google, doesn't seem to be a common occurrence. So I'm 
guessing I broke something somewhere, but I don't know where to start :-(

If that helps :

$grep -ir 'xmlns' *

config/Installer.php:<html xmlns="http://www.w3.org/1999/xhtml"
(Continue reading)

Permalink | Reply | 2 comments |
headers
Krinkle | 1 May 2011 13:31
Picon
Gravatar

Re: Right hook to use for head html element?

Dorem - Jérémie Bouillon wrote:

> On 30/04/2011 22:37, Daniel Friesen wrote:
>> Use the BeforePageDisplay hook and $out->addHeadItem if there is no  
>> more
>> specific method for what you're trying to insert (ie: a<link>,<meta>,
>> <script>,<style>, etc...)
>>
>> http://www.mediawiki.org/wiki/Manual:Hooks/BeforePageDisplay
>
> Just what I was looking for, thanks a lot.
>
> Is there a way to control exactly where the content is added?
>
> I used the $out->addScript way to add my script, but it's not placed  
> at
> the end (there's the sshover.htc IE call and a vector script added  
> after
> it).

Just out of curiousity, to avoid or perhaps solve a less-than-ideal  
construction,
why does it have to be at the end per se ? What is it you want to  
insert there ?

--
Krinkle
Permalink | Reply | 3 comments |
headers
Adam Meyer | 1 May 2011 17:32
Picon

Re: Using Ajax for single single sign on. How bad of an idea is this?

I have successfully created a true single sign on plugin for mediawiki and phpbb. Works on phpbb sessions
and does not use curl or anything of the sort. It authenticates using the AuthPlugin same as the LDAP
extension for mediawiki.

I am having my users test it to make sure it works correctly.

On May 1, 2011, at 12:18 AM, Adam Meyer wrote:

> I actually figured it out with almost no changes to core phpbb files. - Just renaming the user class ONLY if
it is called from mediawiki, so nothing in the forum ever see the change.
> Ill see if I can make a single sign-on plugin for mediawiki/phpbb with instructions.
> 
> 
> On Apr 30, 2011, at 11:45 PM, Adam Meyer wrote:
> 
>> Im using this extension. But when a user logs into the forum, it doesn't log them into the wiki - And vise versa.
>> 
>> 
>> 
>> On Apr 30, 2011, at 9:59 PM, Kilian wrote:
>> 
>>> There's no reason to use Ajax. Just have MediaWiki check on the server 
>>> side whether the user is logged in. Have a look at:
>>> 
>>> http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration
>>> 
>>> -Kilian
>>> 
>>> _______________________________________________
>>> MediaWiki-l mailing list
(Continue reading)

Permalink | Reply | 6 comments |
headers
Dorem - Jérémie Bouillon | 1 May 2011 21:00

Re: Using Ajax for single single sign on. How bad of an idea is this?

On 01/05/2011 17:32, Adam Meyer wrote:
> I have successfully created a true single sign on plugin for
> mediawiki and phpbb. Works on phpbb sessions and does not use curl or
> anything of the sort. It authenticates using the AuthPlugin same as
> the LDAP extension for mediawiki.

I'm interested in seeing this code if you release it. I would like to 
achieve the same thing for another forum software.
Permalink | Reply | 5 comments |
headers
Dorem - Jérémie Bouillon | 1 May 2011 21:04

Re: Right hook to use for head html element?

On 01/05/2011 13:31, Krinkle wrote:
> Just out of curiousity, to avoid or perhaps solve a less-than-ideal
> construction,
> why does it have to be at the end per se ? What is it you want to insert
> there ?

Two things. First, I'm starting to seriously use MW, so it helps me 
learning it :-)

Second in this specific case, it's for Google Analytics. Since they have 
changed it to a faster and asynchronous javascript handling, there's no 
extension with the appropriate code anymore, and they strongly advise to 
place it here (last thing before /head).

I'll adjust the code position in the future with more test and feedback 
when my site goes public, but right now I don't see the harm in 
following their recommendation, and perhaps more important to have the 
same result across the various part of my site (hence, having it placed 
on the same spot).
Permalink | Reply | 2 comments |

Gmane