To report back what solution I implemented:
1. Created a plugin that is basically a copy of page login.php (e. g. /externallogin/)
2. Plugin receives parameters (email, encrypted password and form security code) by the URL
3. Plugin processes login, without any redirect or alike.
4. Plugin uploaded to 2 external forums (that use the same userbase as the main site!)
Now:
5. Core hack of qa-include/pages/login.php to output the IMG embeds which load our external login scripts (plugin!). We encrypt our password to NOT send it as plain text. It is not 100 % safe but better than plain text! And all my sites are running on HTTPS/SSL. The following code comes after $topath = qa_get('to');
// Q2APRO HACK for Multiple Logins (single sign-on)
// first we must decrypt the password
$encryption_key = '12345678123456781234567812345678'; // your KEY
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc'));
$inpassword_encrypted = openssl_encrypt($inpassword, 'aes-256-cbc', $encryption_key, OPENSSL_RAW_DATA, $iv);
$inpassword_encrypted = $inpassword_encrypted . ':' . base64_encode($iv);
// decrypt
// $parts = explode(':', $inpassword_encrypted);
// $decrypted = openssl_decrypt($parts[0], 'aes-256-cbc', $encryption_key, OPENSSL_RAW_DATA, base64_decode($parts[1]));
$inpassword_encrypted = urlencode($inpassword_encrypted);
$formcode = qa_post_text('code');
// do multiple login requests using image embeds
$output = '
<html>
<head>
<script>
function do_redirect()
{
window.location="'.$topath.'";
}
</script>
</head>
<body onload="do_redirect()">
<div style="display:none;">
<img src="//www.myexternalsiteA.com/externallogin?eh='.$inemailhandle.'&p='.$inpassword_encrypted.'&c='.$formcode.'"/>
<img src="//www.myexternalsiteB.com/externallogin?eh='.$inemailhandle.'&p='.$inpassword_encrypted.'&c='.$formcode.'"/>
</div>
</body>
</html>
';
echo $output;
return;
// END HACK
Hope that helps.
There are other ways to achieve single sign on / multiple logins, here are a couple of links that give you some ideas:
