Download: WordPress SSO Integration

[Alex]

File Name: WordPress SSO / Login Integration
File Submitter: AH Modding
File Submitted: 04 Jul 2011
File Category: Hooks and Plugins

This hook will enable Single Sign On integration between your IP.Board and WordPress installs. In short, if users are registered and logged in to WordPress on your website, and they then visit your forums an account will be made behind the scenes and they will automatically be logged in. Similarly, forum users can sign into WordPress with the username and password they use on the forums.

Why have users log in twice with two separate accounts when they can have one seamless experience?

This purchase entitles you to free updates.

New in 1.3.0: SSO and Login Authentication is now separated. What does this mean? SSO is the part of the hook which automatically logs you in to the account if you are logged into WordPress, or vice versa. If you don't want this functionality, you can now turn this part off but still allow users to login via the login forms. 1.3.0 now fully supports the IP.Board 3.3 series.

New in 1.2.0: WordPress now has automatic login, so users do not have to re-enter their username and password, creating a truly seamless experience. Also, an option has been included to sync passwords between WordPress and IP.Board accounts.

New in 1.1.0: Users can now log in on IP.Board side with their WordPress accounts instead of having to visit WordPress first, allowing you to use the more advanced IP.Board login/registration methods over WordPress. Also, I have completed the integration WordPress side - users can sign into WordPress with their IP.Board accounts!

Key Features

• Highly configurable, no need to mess about with files - can be controlled via your IP.Board Admin CP.
• Can choose to sync usernames, or allow new users to pick their own display names upon first visit to IP.Board.
• Can choose to sync administrators from WordPress, making them administrators in IP.Board.
• Can choose the default user group that WordPress members are put into.
  

Requirements

• Requires at least IP.Board 3.1.4
• Requires at least WordPress 2.5
• Requires the WordPress Root Cookie plugin, to enable the WordPress cookies across your whole site so IP.Board can access them.
  

Known Issues

• This authentication does not work if IP.Board has a cookie prefix set, simply remove the cookie prefix if you are having issues with auto login.
  

Click here to download this file

[I am Freddy G]

Question: Does it work the other way around? My community has recently installed wordpress and It would be great if the login's can just be maintained via IP.Board because of our existing users.

Thanks,
Freddy

[AH Modding]

Unfortunately no, that would require an very intimate knowledge of WordPress - this requires the users to be on WordPress, sorry.

[Christophe]

Couple of questions:

- you are maintaining two user databases then right? One in WP and one in IPB?
- what if someone changes their email in the forums or in WP...do they sync?

This is a very interesting idea. Any chance you could also make a plugin that uses IPB's user account to comment on WP and so basically use the IPB comments on WP posts instead or WP's?

[*Salvo*]

What is - wp side - visible? Users logged in? Or is it only a sync of accounts?

[AH Modding]

Couple of questions:

- you are maintaining two user databases then right? One in WP and one in IPB?

- what if someone changes their email in the forums or in WP...do they sync?

This is a very interesting idea. Any chance you could also make a plugin that uses IPB's user account to comment on WP and so basically use the IPB comments on WP posts instead or WP's?

Two user databases are maintained, correct. But there are options to sync usernames, (emails are automatically synced). In the backend IP.Board stores the users 'wordpress ID', so that if they change anything, we can still track them by ID. Usernames *can* be synced if the admin wishes, but you also have the option of allowing members to set their own display names independent of WordPress. (The same goes for syncing administrator privileges)

What is - wp side - visible? Users logged in? Or is it only a sync of accounts?

I'll try and give you a rundown.. User registers at WordPress, or a admin already has a WordPress set-up, then instead of registering at IP.Board the user already has their account on the forums - technically they have two accounts, but to them it's a single-sign on and they have the same ID everywhere. If you log out of the forums, you log out of WordPress, if you log into WordPress, you log into the forums etc.

Because it's an IP.Board hook, no file edits are needed on WordPress - therefore IP.Board routes all login/registration through WordPress's functions, and then returns them to IP.Board. This makes sure they are logged into both.

[*Salvo*]

OK, it's a perfect way to concept the converge. I don't have users (apart the writers) on my home (wp), and even me, administrator, of course I act with 2 different accounts. I don't care to have people logged in my home, BUT if people from home can reach the forum, can register an account, and can be visible their name in a widget in home, well, this is a perfect never coded solution. Even IP Converge, almost useless to me.
This is to me one of the most important goals.

[AH Modding]

Just to clarify: you already have members in IP.Board? If so, I will be looking at writing a member importer tomorrow, members *must* be in WordPress for the SSO to work, due to how sessions are handled.

Writers would automatically have an account waiting for them on IP.Board yes, as for the widget you're talking about - that's probably needed as a custom hook? This is purely an authentication hook.

[AH Modding]

Question: Does it work the other way around? My community has recently installed wordpress and It would be great if the login's can just be maintained via IP.Board because of our existing users.

Thanks,

Freddy

I am looking at this today to see what I can do. :)

[AH Modding]

1.1.0 is now out - this will enable WordPress users to login using IP.Board itself, and logins are no longer redirected to WordPress, making it even more seamless.

Passwords are also synced on IP.Board, meaning if you disable this hook or get rid of WordPress, all WordPress accounts will still have an IP.Board account with the same password!

Also, 1.1 allows IP.Board users to access WordPress using their IPB logins, meaning you can use it with a recently setup WordPress and not worry about your existing users on IP.Board!

[*Salvo*]

Is there a way to see in action the program-hook-widget?

[Dannyarr]

1.1.0 is now out - this will enable WordPress users to login using IP.Board itself, and logins are no longer redirected to WordPress, making it even more seamless.

Passwords are also synced on IP.Board, meaning if you disable this hook or get rid of WordPress, all WordPress accounts will still have an IP.Board account with the same password!

Also, 1.1 allows IP.Board users to access WordPress using their IPB logins, meaning you can use it with a recently setup WordPress and not worry about your existing users on IP.Board!

So now it's a full solution which goes both ways - correct? If I take a existing WP install and a existing IP.Board install both userbases will have access to the other software and they will be automatically logged into both on each login?

[AH Modding]

Is there a way to see in action the program-hook-widget?

I'll try and see if I can set something up, these sort of things are hard to set up as demo's though..

So now it's a full solution which goes both ways - correct? If I take a existing WP install and a existing IP.Board install both userbases will have access to the other software and they will be automatically logged into both on each login?

Correct. Both share the same user details, IP.Board will automatically log you in if you logged into WordPress first, WordPress won't automatically log you in if you were at IP.Board first *just* yet, today was purely about writing the WordPress plugins, going to have to do some cookie searching on WordPress, but it's on my to-do list and is top priority. Shouldn't take too long at all.

[Dannyarr]

I see. Here's a feature request:

Add the option to make WP accessible only to users logged in to IP.Board but without creating users in the WP install. Most security issues in WP need a user to perform the exploit and most sites don't really require users to be within WP. The goal here is to put a WP install behind a IP.Board authentication wall. This should actually be pretty simple as far as WP goes, just not sure how simple it will be as far as IP.Board goes. You can hook in a auth check into the 'template_redirect' hook (happens pretty early in the chain but not too early). If you need any help on the WP side let me know, I'd be glad to help (I run a WP dev company) - I just have zero dev experience with IP.Board. If IPS ever creates proper dev documentation this product would be a dev dream...

[*Salvo*]

I see. Here's a feature request:

Add the option to make WP accessible only to users logged in to IP.Board but without creating users in the WP install. Most security issues in WP need a user to perform the exploit and most sites don't really require users to be within WP. The goal here is to put a WP install behind a IP.Board authentication wall. This should actually be pretty simple as far as WP goes, just not sure how simple it will be as far as IP.Board goes.

Totally agree..this is the point. I don't need users into WP, except the writers (3 on 550 users and I can handle it manually) and me.

put a WP install behind a IP.Board authentication wall

nothing else to say. ;-))

[AH Modding]

Salvo, for your scenario you can turn off the SSO (checkbox in WordPress settings) WordPress side. Your writers will be able to log into IP.Board with their WordPress accounts, but IP.Board users won't be able to login to WordPress with their accounts.

Or you could do it the other way around for people that would need that, allow IP.Board into WordPress, but not WordPress into IP.Board.

[*Salvo*]

but IP.Board users won't be able to login to WordPress with their accounts.

That's my meaning. The authors already have an account, and my wp installation hasn't some special private section. So, I don't care about special features-
I would see a way to allow people go to IP Board via wp (yes, able to login or get a new account) but not necessary vice-versa. To me, nothing changes really.
AH Modding, sorry if I'm making confusions..I really care for this product before buy it. But in the past I had bad experiences with coders that tried to act what your're concretely doing, so, I want to really understand if for my needs is eventually useful or not.

• Login -register a new account via wp to the forum (not vice-versa)
• widget with users online and the all values add with the time.
  

This is my meaning. understand me: I don't have an academic english, it's brutal and rude my way to express my needs.

[AH Modding]

That's my meaning. The authors already have an account, and my wp installation hasn't some special private section. So, I don't care about special features-

I would see a way to allow people go to IP Board via wp (yes, able to login or get a new account) but not necessary vice-versa. To me, nothing changes really.

AH Modding, sorry if I'm making confusions..I really care for this product before buy it. But in the past I had bad experiences with coders that tried to act what your're concretely doing, so, I want to really understand if for my needs is eventually useful or not.

• Login -register a new account via wp to the forum (not vice-versa)
• widget with users online and the all values add with the time.
  

This is my meaning. understand me: I don't have an academic english, it's brutal and rude my way to express my needs.

I understand you wanting to make sure this is what you need.

Your WordPress writers will be able to register an account on IP.Board, and you can disable it so it does not happen the other way (IPB to WP).

By Widget, are you referring to WordPress's side or IP.Boards?

[*Salvo*]

WP side, of course.
Users logged in (home or forum) and some extra stuff, but the main thing is...example: you check my home, see "Register an account" and you do. Your account will allow you to use the forum as a common logged in forum's user (same conditions and so on). Don't care vice-versa. I can sync the users. All the extra fields (commons in a classic bridge) will be the welcome. But if you're not calling the program "bridge", maybe it isn't.
Thank you for your patience ;-))

[AH Modding]

A widget would not be included in this, as it's custom to whoever needs it - this is an authentication bridge, simply allowing a user to have one account to log in to both things, it can do what you are saying above - minus the widget, as that's more of a WordPress mod.

[*Salvo*]

Yes, sorry. Widget= wordpress :wink:
unfortunately the SSI integration is really poor in IPB. With SMF ssi.php I was able to display everywhere login form (not integrated if not specified), latest posts, topics, users online and so on.

[*Salvo*]

Another question: how is the mask for the login? Is it to /wp-login or....?

[AH Modding]

They can login through the standard IP.Board login or the WordPress wp-login.php side, up to them!

[Christophe]

looks very very promising. A hook that replaces WP's authentication and displays IPB threads/comments within WP is exactly what I have been looking for for years.

[*Salvo*]

Yup.
I'm checking this thread 1 time every 5 minutes. :afro: