php curl - sending form data to external website

Question

Hello.

I have a login form set up on my domain (eg: www.example.com/login).

When the user enters their login information, I need those details to be passed through a login form on an external website and the user directed to the application that they are logging into.

So to add the user steps to this: 1. User enters login information on www.example.com/login 2. User is directed to and has access to application on www.external.com/application without having to re-enter login details at www.external.com/login

The problem is, I'm not sure how to go about doing this. I found some references to cURL which from what I could gather is the best approach to take.

Any help with this would be appreciated .. I'm a PHP novice! Also ... the application on the external website is ASP.NET (I'm not sure if this has any factor on getting this to work).

Thanks for your help, Mark.

Answer 1

Depending on how your application works, what could work is have your login form on example.com/login point to external.com/application

so your form tag would look like this:

<form action="external.com/application" method="post">

Now your external.com/application will have to be setup to accept the data from the login form. When the form is submitted the browser should direct itself to external.com/application.

Answer 2

This is a possible approach :

• On www.example.com/login, do a classic login form which is submitted on itself

• On www.example.com/login, when a $_POST is detected :

  • check that the credentials are good
  • if yes, store within a table in you db server an hash dedicated to this user (by hashing his id/user/etc... whatever you wish)
  • redirect to www.external.com/login?hash=the_generated_hash

• On www.example.com/verifyHash.php:

  • create a simple php file that take a hash in $_GET and echo "true" if this hash exists in your db

• on www.external.com/login

  • check that a hash is passed in $_GET
  • if yes, do a simple $result = file_get_contents("www.example.com/verifyHash.php?hash=$_GET["hash"]");
  • if the result is true then you can assume that the user has valid credentials.

Of course, you can optimize this whole thing by passing a user id along your hash, by implementing some security when your asking remotly verifyHash, etc...