Help!

[webd]

I am trying to create a member system kind of like the Microsoft .Net passport, where users can register at any of my sites and be able to login at any of my sites, as well as customize their members area and create a profile, and if possible also be able to automatically register them for the message board. I am really stumped on how to be able to let them login to one site, and leave them logged in, untill they sign out, or the session times out, and let them move to one of my other sites and stay logged in. If anybody can help me, please reply.

[planetsim]

well if your sites networked with sites, then why not have the same members database..

Message Board(forums) well.. maybe that can be your members area. Or you can be really smart and make your own. Id suggest thats the better option if you want the forums, and members area integrated.

Well keeping them logged in. Theres no doubts about it, Cookies are your best option. But you can try and integrate a Cookies/Sessions function. Which will let the member decide whether to store cookies or not...

But its up to you there i guess.. Just remember forums arent easy to make, so if your not really interested in making one, then get your members database to be exactly the same as it. And when a person signs up for use in the forums they also sign up for use at your site.. Something like that..

I hope this all helps

[webd]

Yeah, that does help, I was thinking about using sessions, but I don't really know how to code that... Does anybody think they can help me out with that venture? And also, all my sites aren't on the same server... would that complicate things?

[mjlively]

This is a pretty complicated problem to just think about in a span of 5 or 10 minutes but I figure if I start rattling of some ideas something might pop out as being useful...so here we go.

Note: When I say 'client site' I mean any site that uses the member system

Establish a centralized site to service all the logins. (loginsite.com)
On this site create three files.

The first: login.php will handle the initial login. It will create a unique id for each successful login, and store it in a database. It will then redirect to a page specified by the client site (ie membersite.com). This page will be specified through a hidden form field on membersite.com. The unique id will be stored as a session variable with the user and passed through the query string to membersite.com (http://membersite.com?uniqueid=sdklfhalkj787wejkf)

The second: verify.php
This page will never actually be visited by a real person. Instead, membersite.com will connect with this page via the CURL library. This should be done on each page that needs to be secure. membersite.com will be passing the uniqueid given at login. If this is a valid uniqueid then this page will simply pass the number 1. If it is false, it will pass the number 0.

The third: doublecheck.php
This page will be used to establish the uniqueid with a client site. If the client site initially finds that a user is not logged in, as a last ditch effort the user will be sent to this page. Since the unique id is stored as a session variable whenever a client logs in, this page should be able to retrieve this value again. Then it can check and make sure it is valid. If it is, it can send the user back to the site with this unique in the url. If not it can send the user to a login page on the client site (This value can be passed to doublecheck.php via the query string).

---

Now on your client sites you will need to do the following

On the login page:
Include a hidden field of some type indicating the url to go to after login. This will be used by loginsite.com

On all pages:
First check the session variables for the unique id. If one is found then send it using CURL to verify.php. If verify.php reports it as a valid id, then display the page. If it is invalid or if a unique id was not found, then send the user to doublecheck.php passing the url to a login page in the query string.

If I have all my assumptions right that would lay the groundwork for how to do what you are trying to do. I would be curious to know exactly how Microsoft's Passport scheme works.

[planetsim]

Ok sessions are easy to code...

session_start();
session_register("session");

our session name is session that can be form a $var meaning say we register the username of someone who joins
$username = "Paul";
$users=$username;
session_start();
session_register("users");

our session name isnt users but its paul..

so when we want to see what users equal we just print $users... and well get Paul.

Now that registering them. What about Checking them...
We have to use our Globals $_SESSION['users'] in this case users being Paul.

Now i havent checked this but it should work..

session_start("users");
if(session_is_registered['users'] && $_SESSION['users'] == $users)
{
//its ok.. there session is registered 
} 
else
{
//not registered transfer them somewhere
}

Now about servers and such.. Well i dont think its a huge issue really but as long as you do everything correctly...

So lets say we have Server 1 where the members are stored etc..

we'd have a file which is gonna be included on every server thats in the network...

So that would be on Server 1..

Then pretty much just echo out or do something thats exactly the same as on server 1 and you'll be write..

The only issue about this is Server 1 if it goes down your in trouble..

Just think whats gonna need to be involved in it..etc..

And you should be right. Id prefer if it was on the same server as itd be easier to set out etc... and only 1database would have to be used for the whole network.

[mjlively]

If the sites are across multiple servers then you will have to use something other then cookies and sessions to get information back and forth. Neither one of those (alone) can be transportted across seperate domain names. So you have to have some way for the websites to communicate with eachother....hence the CURL library.

Checkout my first post, it does a better job explaining.

Note, if you don't mind the user having to login at each site they visit, this won't be an issue.