Announcement

  •  » Engine
  •  » Single Sign On to Piwigo from your Wordpress account

#1 2021-08-01 15:56:04

Rob Visser
Member
2021-07-28
2

Single Sign On to Piwigo from your Wordpress account

Hello all,

How about integrating them, and have the best of both worlds?



Below I describe how I implemented a (working) prototype that provides “Single Sign On” (SSO) from Wordpress to Piwigo.

This is how it works:
1: The user logs in into Wordpress with username and authenticates with password.

2: Upon successful login, a randomised one-time- token is placed in the piwigo_users table.
   If the piwigo user does not yet exist then the user is created in the piwigo site.

3: The shortcode [PIWIGO_LOGIN] in Wordpress pages and/or text widgets is replaced by a link to the Piwigo site. The link contains username ant one-time token.

4: By pressing the link, the piwigo site checks the token in the url by comparing it to the toke stored in the piwigo_users table.

5: If equal the you are logged in, both in Wordpress and Piwigo with the same username.


Some implementation details:
In my prototype both Piwigo and Wordpress use the same database.

Wordpress:
The plugin “wp-pwglogin” provides an admin panel to fill-in:
— the URL of the piwigo site
— the admin user name and password (used to add users to piwigo).
It provides code that handles the shortcode [PIWIGO_LOGIN] in posts or text widgets. The shortcode is replaced by a login link to the piwigo site with username and on-time token.

Piwigo (see forum folder):
A template extension:
../template-extension/distributed/wp_login_menubar.tpl
Extends the menu bar to intercept the username and one-time-token from the invoking url.
If present then a cookie is set with the one-time-token content. Also the login button is triggered.
Note: in the piwigo Configuration-Templates menu the menubar.tpl must be replaced by wp_login_menubar.tpl

A piwigo plugin:
The plugin wp_login extends the normal piwigo login by means of adding the mywp_login function to the try_log_user event.
The my_wp_login function compares the username and one_time_token from the URL (which was passed as a cookie) with the one_time_token in the piwigo_users table.
Upon token equality success is returned by my_wp_login. The user will be logged in.

Note:
A column “one_time_token” must be added to the piwigo_users table like so:
ALTER TABLE piwigo_users ADD COLUMN one_time_token VARCHAR(16);



My code can be found:
https://github.com/Rob-V53/wordpress-to … less-login

Offline

 

#2 2021-08-02 12:47:31

dummer-esel
Member
2017-01-25
44

Re: Single Sign On to Piwigo from your Wordpress account

Thanks a lot for sharing, Rob Visser!

I am looking for this functionality for a long time, as I also have a private blog and picture gallery for family & friends! :-)

Question 1: Are those plugins publicly available or only by manually using your code from github? I couldn't find them online, so I guess it's the latter.

Question 2: how could it work if it's two different databases? Of course, I installed PWG and WP in two different DBs for security reasons.

Question 3: Is it compatible with the current stable PWG version (11.5) and WP (5.8)? And do you think keep working on it? This would be really nice!

Thanks a lot for you work, I guess I'll test it out one day ^^

Offline

 

#3 2021-08-09 23:49:50

Rob Visser
Member
2021-07-28
2

Re: Single Sign On to Piwigo from your Wordpress account

My hope is that someone picks it up and creates a full flash set of plugins from it.

Answers:
1: Only in GitHub
2: The current prototype is simple: same host/and same database
3: It works with the latest versions (as far as I know)

Offline

 

#4 2021-08-27 21:57:28

dd-b
Member
2018-04-16
53

Re: Single Sign On to Piwigo from your Wordpress account

Given that the basic mechanism requires the Wordpress site to add rows to a Piwigo table, it's going to have to have write access to both databases. So not sure there's much security benefit of making them separate databases, might not be worth the effort.

I found this because I'm searching for way to do something like this myself. I may instead just restrict the blogging to being done in a Piwigo plugin; I'd spend a LOT less time getting the shared authentication going that way! Not sure I'd desperately miss the fancy theming options that Wordpress offers, or that it offers much else I hugely care about (I'm not looking for commerce plugins or anything like that).

Interesting to see what other people have done in this area! Thanks very much.

Offline

 
  •  » Engine
  •  » Single Sign On to Piwigo from your Wordpress account

Board footer

Powered by FluxBB

github twitter newsletter Donate Piwigo.org © 2002-2021 · Contact