1

Suppose there are 2 web site: example.com I don't own and example2.com I own. I want to extend the functionality of example.com somehow.

example.com doesn't have any API. I want the users of example.com to be able to login at example2.com using their logins and passwords of example.com. However, since example.com doesn't have any API, it is not easy to do, perhaps, it is even impossible.

No doubt, no one would agree to enter their credentials of example.com at example2.com due to many obvious reasons.

So, is there any way to authenticate the users of example.com at example2.com (or somewhere else) using their original credentials?

  • 2
    I don't think so. That would mean you could steal their credentials for example.com. – Bart Oct 5 '13 at 14:35
2

As far as I know, you need one (or more) of the following things to do single sign-on:

  • A shared root-level domain, e.g. all sites are subdomains of example.com. They can share a cookie this way, assuming both sites understand the format.

  • A shared credential database (SQL, LDAP, etc.) with both sites knowing how to validate the credentials (e.g. type of hashing used on the passwords).

  • A trust system such as WS-Federation supported by all participating sites.

  • An authentication API supported by at least one of the participating sites (such as OAuth).

From your rather vague description, it sounds like you lack any of the above, so the answer is no, you can't do this - not without tricking the users in an essentially criminal fashion.

1

In this case, you need to ask the owner of example.com to share with you his authentication method with you (if it's a friend of you, or a partner, otherwise it's very unlikely he accept to share something as sensitive with you).

Assuming the owner of example.com is using a MySQL database with a specific table for users and password and that he is willing to help you with this, here is a example of what to do:

  • he needs to create for you a remote MySQL user with read access to the users table from example2.com (e.g.: auth%[ip.of.example2.com]);
  • he also needs to permit remote connection to his MySQL database (firewall –preferably with ip filtering- and my.cnf);
  • then, he has to provide to you the way he store the password (hash algorithm, salt method…);
  • at this point, when a user try to login to example2.com, you just have to create a MySQL connection to his server, and check the credentials…

Even if all this is really moot, I hope this will help a little.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.