How to: CakePHP logging in without password?

Question

I'm trying to find a way to log in user without password.

The reason is that I have phpBB3 forums in my site and the users already log in there. So I'm now building an expansion to the site to have more than just the forum (Using CakePHP). I thought that I could attach automatic account creation to CakePHP when user creates an account to forums (And ofcourse other link for the existing users). So the users would get CakePHP account that has the same username that they have registered in forums. That means that the only way to register to CakePHP part of the site would be to register to the forums first.

Now I'd like to handle the whole logging thing by phpBB3 login so users would still login to forums, and then I'd attach a piece of code that would also login them to CakePHP part of the site with the username they used to login to forums.

This way I could do also put users to their own ACL groups by their status in forums.

Thats what I'm after and I need to know the way to login users this way. I'm not looking for complete code I'm just looking for an answer that explains how I log in users in CakePHP without them having passwords at all.

I have also looked http://bakery.cakephp.org/articles/wilsonsheldon/2009/01/13/phpbb3-api-bridge but it just doesn't quite look what I'm looking for...

score 7 · Accepted Answer · answered Apr 03 '11 at 22:22

As far as I recall, Auth requires two pieces of info for a login. You can change which fields in the users table are checked by auth with.

$Auth->fields = array(
    'username' => 'username',
    'password' => 'password'
);

So if you you want to be able to log in users according to their nickname and shoesize:

$Auth->fields = array(
    'username' => 'nickname',
    'password' => 'shoesize'
);

IMPORTANT:
The AuthComponent expects the password value stored in the database to be hashed instead of being stored in plaintext. (I think it is a sha1 of the password and Security.salt)

In the above example, if any entries already existed in the database you'd have to overwrite the shoesize field for each of them with hashed versions of the shoesizes.

To generate a hashed password yourself you can use $Auth->password('A Password');

Quick and Dirty

If you fill the password fields in your users table with the return value of: $Auth->password(null);

Then you can use the following:

$Auth->login(
    array(
        'User'=>array(
            'username'=> USERNAME_FROM_PHPBB3,
            'password'=>null
        )
    )
);

Less Quick and Dirty

When creating a new user. Set the password field to the md5 hash of some random input.

$this->authUser[$this->User->alias][$Auth->fields['password']] = $Auth->password(md5(rand().rand()));

Use the Username from phpBB3 to retrieve the relevant record from the users table in the database.

$this->authUser = $this->User->findByUsername( USERNAME_FROM_PHPBB3 );

If the query was successful Log in the user

if($this->authUser){
    if($Auth->login($this->authUser)){
        // Login Successful
    }
}

So the way to register users is just to give them random or whatever passwords and then logging in does not really require any user password input and I can directly log them in by just their username? Do you know how I could get the PHPBB username from its session data to the CakePHP side? — Pehmolelu, Apr 04 '11 at 13:15

score 0 · Answer 2 · answered Jun 20 '13 at 12:38

This function will solve your problem:

public function forceLogin($userName = NULL) {
    $this->_setDefaults();

    $this->User = ClassRegistry::init('User');
    $this->User->recursive = 0;
    $user = $this->User->findByUsername($userName);

    if (!empty($user['User'])) {
        $this->Session->renew();
        $user['User']['id'] = null;
        $user['User']['password'] = null;
        $this->Session->write(self::$sessionKey, $user['User']);
    }

    return $this->loggedIn();
}

score 0 · Answer 3 · answered Apr 03 '11 at 19:43

0

From your cakephp app you can check if a user exist in the phpbb forums table and you can use the phpbb session to check if a user is logged in.

answered Apr 03 '11 at 19:43

Mika

1,539
15
22

Yes, I was going to do something like that but I'd have to log in the user in CakePHP aswell to manage that user's sessions in CakePHP wouldn't I? And the problem is I dont know how. – Pehmolelu Apr 03 '11 at 20:40
1

http://groups.google.com/group/cake-php/browse_thread/thread/a6fd496315109e62 Read this – Mika Apr 03 '11 at 20:56
Oh, and if you know how then please tell me how I check in my CakePHP app from PHPBB session if a user is logged in? - EDIT: Sorry, Didnt notice at first our link post, thank you :) – Pehmolelu Apr 04 '11 at 13:17

How to: CakePHP logging in without password?

3 Answers3

Linked