JForum Integration SSO

[ver woo]

I need some helps on JForum integration SSO. I am aware this discussion https://coderanch.com/t/574564/jforum/Single-Signon-automatic-login which is out updated and doesn't match the current code base. Please advise how the integration need to take place.

[Mark Page]

Please confirm which version of JForum you are using?

[ver woo]

Mark Page wrote:Please confirm which version of JForum you are using?

2.3.5-SNAPSHOT

I believe that it is the latest version.

[Mark Page]

OK, I'm going to be working on the latest stable version in a week or two. I was involved with the original SSO code back in the day and SSO is a requirement of the project I'm about to work on.

What is it you are having a problem with specifically, i.e. just don't know where to start or are you getting errors?

[ver woo]

Mark Page wrote:OK, I'm going to be working on the latest stable version in a week or two. I was involved with the original SSO code back in the day and SSO is a requirement of the project I'm about to work on.

What is it you are having a problem with specifically, i.e. just don't know where to start or are you getting errors?

Is the following integration logic correct?

1. After a user signs in the application, encrypt this user’s unique identifier and save this encrypted value in a cookie.

2. This cookie can be used to authenticate the user in JForum. A filter/interceptor will be created to verify the authorization for any JForum URLS with a pattern of “/forum/*”

3. When a user navigates to a JForum page, the cookie value will be used to verify user’s credential against the JForum database. The cookie value will be decrypted for usage, of course.

4. If it is the first time for the user using JForum (that is the user account data doesn’t exist in JForum DB), a web service call will be issued to retrieve this user’s profile data, namely screen name, email, and encrypted password, from our app. And those user data will be stored in the jforum_users table of the JForum database.

5. When the user log off her/his account or a session timeout, the cookie will be removed.