URL Authentication and linking directly to some course

URL Authentication and linking directly to some course

by Eric Ledoux -
Number of replies: 7
Hi,
We have developped a web portal that is used by hundreds of schools in the province of Quebec. We're looking at the possibility of using Moodle as a complement to our existing portal. What we would like is to be able to redirect an already logged in user from our portal via URL or some other way directly to a course in Moodle.

I have found a way and I'm pretty sure another "cleaner" way of doing this must exist. I have found through these discussion groups (thanks to all who contribute) the file post.php which I have slightly modified. It now looks like this :
<?php
$username = stripslashes($_GET['username']);
$password = stripslashes($_GET['pass']);
$id = stripslashes($_GET['id']);
?>
<form action="http://linux.grics.qc.ca/moodle/login/index.php" method="post" name="login" id="form">
<p><input type="text" name="username" value="<?php echo $username ?>">
<p><input type="hidden" name="password" value="<?php echo $password ?>">
<p><input type="hidden" name="id" value="<?php echo $id ?>">
<script language="JavaScript">
function Validate()
{
document.login.submit();
}
Validate();
</script>
</form>
?>

All I did is to add the notion of "id".
I then hacked the file login/index.php. Around line 168 the "else" now looks like this:
else {
$id=$frm->id;
if ( $id == "" )
{ $id = 01; }
$urltogo = $CFG->wwwroot.'/course/view.php?id='.$id;
unset($SESSION->wantsurl); /// Just in case
}

It works. All I have to do is to send a URL that looks like this :
https://mycompany.qc.ca/moodle/post.php?username=user&pass=password&id=xx
and I get logged in and redirected to the course I wanted.
Now for my questions...
Is there a more proper way to do this? If there is, I would really appreciate someone telling me. I am asking because the fact that I had to "hack" login/index.php means that everytime someone is going to upgrade his/her Moodle, my phone is going to ring... unless it becomes part of Moodle itself.
Thanks in advance.
Average of ratings: -
In reply to Eric Ledoux

Re: URL Authentication and linking directly to some course

by Jan Dierckx -

Like Shane mentioned in the post you got this from: this is not very secure. The redirect login containing username and clearly legible password shows up in the browser history, sometimes even in the address bar. While this may be a nice way of sending some demo accounts (like in the original request), I would not use this on a webportal that hundreds of schools will be using.

I guess the proper way of doing this would be to have Moodle look up the authentication of a user in the database of the webportal. Look at the different authentication methods provided on Moodle's admin page. which one wiil depend on the authentication method you are using on the webportal.

Average of ratings: Useful (1)
In reply to Jan Dierckx

Re: URL Authentication and linking directly to some course

by Eric Ledoux -

I agree completely with you, that is not secure at all.

I realize I forgot to mention that our webportal is not running on the same server as Moodle. The credentials and course number have to be passed on the wire somehow. I used URL because I don't see how else our webportal  can "tell" Moodle  that some already authenticated user wants to access some course. Even if both servers (webportal and Moodle) authenticate to the same database, they are entirely different apps. 

The only interface I know to pass credentials to Moodle is the login page.

In reply to Eric Ledoux

Re: URL Authentication and linking directly to some course

by Michael Penney -
Hi Eric, have you looked at Shibboleth?
http://en.wikipedia.org/wiki/Shibboleth_%28Internet2%29

Another single sign on solution (think U of Wisconsin uses this?) is pubcookie:
http://www.pubcookie.org/
In reply to Michael Penney

Re: URL Authentication and linking directly to some course

by Eric Ledoux -
Thanks Michael,

I have taken a very quick look at both projects, and they do seem to solve my authentication problem. Understanding and trying them should keep me busy for a few days. Thanks again.
In reply to Eric Ledoux

Re: URL Authentication and linking directly to some course

by David Shields -

I'm in a place somewhere similar to you.

Our web server serves our intranet (http://myschoolnet/) and our external network (http://www.myschool.org/) .

Now, when someone visits the external network, and goes to www.myschool.org/internal we have apache set up to use LDAP auth against Active Directory to validate users before this areas pages are served. This works, by the way. At this point, once LDAP validated, there are 2 extra php variables available to pages in .../internal : $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'].

My query is:

Which module in moodle displays 'You are logged in as' or 'You are not logged in' - as it would seem simplest to modify this to pick up those variables.

PS - we are still working on autologin for the intranet - it loks likely that mod_ntlm might be the trick, but I'm still building a new server at the minute.

In reply to David Shields

Re: URL Authentication and linking directly to some course

by Nic T -
Hello David,
are you find a way for an autologin?
I need it for our System.

THNQ