Patterns for replicating user data from one software to another

Question

I have a website that I've integrated with a popular forum software (phpBB). I have it setup so users that login to the main site automatically are logged in to the forum software as well. I do this by authenticating through the forum's API at the very same time.

When someone registers for the site, an entry goes in to the main site database and an entry goes in to the forum user database (using the forum API).

The primary id of the forum user table is stored in a column in the main site user DB. This is saved at the time of registration: the registration process first creates a forum user, then passes back the ID in to the query that creates the user in the main site.

When a user logs in, if they authenticate with the main site, that ID is pulled and passed in to the forum login API to login the correct person.

However, a weird thing seems to happen randomly: one in every 30 or 40 people that registers ends up with a forum user id that is not their own in the main site user table. I know how to look for these problems and fix them on case by case basis and have scripts in place to do so, but that seems like more of a bandaid, not a fix.

Is this a common problem when linking data like this, or does this seem like something more specific with the software? Because of the randomness of this issue its been hard to debug.

Answer 1

I would suspect Session Management. Are you intentionally or unintentionally reusing session ids?

Answer 2

I've done something similar with vbulletin, by directly using the forum's mysql database to autheticate the main site, and other sites (they're all on the same machine)...

In your case, I would add the site-specific fields that are not in phpBB database in the site's db, and link it to phpbb by user_id... It could be one form on the main sites that inserts into the two databases (some in the main site db, others in phpBB db - with some more privileges fields), I'd use my own non-standard captcha like generating a distorted image "what is x+y" with x and y as random numbers and + may be replaced by other operations, or an image of "type the word ORANGE", or "type your username again"

I would disable the default phpBB registration... there are so many bots that know how to use it...

This would guarantee you have one source for the info, and you fill all the info at once.