473,837 Members | 1,541 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

maintain a single session across multiple servers

Hello,

I am trying to find a solution to a login mechanism for different
domains on different servers with PHP5.

I have one main domain with the user data and several other domains that
need a login to show data.

I want the user to login only once when he visits any of my domains.

The first idea is had is to use the same session for all domains. Is
this possible?

Any help or hint is appreciated.

Thanks in advance

Best regards
Samir
Jun 10 '07
13 8689

"Gordon Burditt" <go***********@ burditt.orgwrot e in message
news:13******** *****@corp.supe rnews.com...
>>The problem here is the remote servers will have no idea what the
current
status is from the central server - they'll have no way to communicate
anything, even the session id.

Assuming you can solve the problem of the session identifier
(something that can be dealt with by making the servers all have a
common domain with different subdomains), it is possible to use a
session save handler to store the session data in MySQL, not a local
file directory. This has potential to make the session data available
to multiple servers (a setup commonly used with round-robin DNS to
spread the load over several servers serving identical content).
You might have locking issues with changing the content of the
session, though. That might be solved with key changes (logging
in, logging out) handled by one specific server.

If you insist on no more than one session per user, you can use the
user id as a key for locating session data.

>>Why is this? There surely could be something implement sorta like
callbacks.. . or ajax.

essentially on the remote computer you have a php script that is called by
the central server when something chances or to pass on information. The
php
script then could either write them to a file or use shared memory or
maybe
run in the same process space as the session.

Having the central server call all the other servers can give you trouble
if one of them goes down. (On the other hand, a central database can be
a single point of failure for the whole group of systems if not designed
carefully).
>>Sure there would have to be negotiations at the start but I don't see a
problem with it. Instead of passing session through a url, say, your doing
it over a remote connection.

For example,

User logs into RS(remote server). RS establishes a "session ID" for this
user and calls central server and passes this session ID. All other
servers
are signaled that this user as logged into this server(or they could
request
each time a user logs onto them). Every time a state is changed its
reflected back and forth. This isn't optimal of course and technically
isn't
probably very good but it should work.

I prefer to stick all this information in a database where the various
servers can access it. If necessary, the database can be replicated.
>>The main problem, I suppose, is creating a unique ID for the user. Would
have to atleast be the IP but then that causes problems with proxies and
stuff. Maybe there is a way though...

If a user is required to log in, his user id may serve that purpose.
No... You have to have some way for the other servers to recognize who the
user is when he comes to their page. Now if he is required to log into each
server then thats ok.. But if you want one server multiple logins then its
more difficult... although I suppose you could just broadcast the login
information to each one and they can create there own session id(although it
will then be hard to synch if they all have different session ids.

I was just giving some ideas though. I do not by any means think its
impossible. Just might require a little work.

Jon
Jun 11 '07 #11
Jerry Stuckle <js*******@attg lobal.netwrote in
news:3P******** *************** *******@comcast .com:
>>How many other sites do you see where
one signon covers multiple domains?

Yahoo! (Flickr), Google (Blogger, Orkut)

And specifically which of those domains have one sign-in which then
allows you access to the other domains without having to sign in
again?
you can sign in at any location and be signed in across all related sites.
Jun 11 '07 #12
Jon Slaughter wrote:
"Jerry Stuckle" <js*******@attg lobal.netwrote in message
news:Vp******** *************** *******@comcast .com...
>Jon Slaughter wrote:
>>"Samir Chouaieb" <ch******@nospa m.arcor.dewrote in message
news:46****** *************** **@newsspool3.a rcor-online.net...
Hello,

I am trying to find a solution to a login mechanism for different
domains on different servers with PHP5.

I have one main domain with the user data and several other domains that
need a login to show data.

I want the user to login only once when he visits any of my domains.

The first idea is had is to use the same session for all domains. Is
this possible?

Any help or hint is appreciated.

Thanks in advance

Best regards
Samir

Why not just a central server that handles the the cookies? That way
they are stored w.r.t to the centeral server but the other servers can
get the information(thr ough a request to the centeral server).

e.g., when the user wants to be "remembered " they would be temporarily
redirected to your centeral server where the cookie processing will take
place and it will probably need to contain more information such as which
server the request came from(or since you don't seem to care it would
just save it as normal).

Then any time cookie retrival needs to happen the opposite thing will
happen.

I think the only issue here is if multiple servers are serving to the
same users then there would need some way to synchronize but I thnk this
isn't that big of a problem.

If you go the central route then you could keep everything on that
central server and really just dish out stuff over the different domains.
You just need to write an interface for what you want.

Jon
Jon,

The problem here is the remote servers will have no idea what the current
status is from the central server - they'll have no way to communicate
anything, even the session id.

Why is this? There surely could be something implement sorta like
callbacks... or ajax.
OK, please explain exactly how you will do it. Ajax can't do it -
security restrictions (if properly implemented) limit Javascript calls
to the server the javascript was loaded from, for instance.

How are you going to callback a script on another server?
essentially on the remote computer you have a php script that is called by
the central server when something chances or to pass on information. The php
script then could either write them to a file or use shared memory or maybe
run in the same process space as the session.
OK, you call the remote computer and pass along the session id. But you
still can't pass that session id from the browser to the remote computer
- at least not by a cookie. And passing by get/post leaves you open to
all kinds of potential security problems.
Sure there would have to be negotiations at the start but I don't see a
problem with it. Instead of passing session through a url, say, your doing
it over a remote connection.
But you still need to relate that session to the user's browser. That's
the problem.
For example,

User logs into RS(remote server). RS establishes a "session ID" for this
user and calls central server and passes this session ID. All other servers
are signaled that this user as logged into this server(or they could request
each time a user logs onto them). Every time a state is changed its
reflected back and forth. This isn't optimal of course and technically isn't
probably very good but it should work.
That's fine. But the other remote servers won't get the cookie
containing the session id, as noted above.
The main problem, I suppose, is creating a unique ID for the user. Would
have to atleast be the IP but then that causes problems with proxies and
stuff. Maybe there is a way though...
IP won't do it. Many corporations, for instance, have a single IP for
all of their outgoing connections. And that IP, if dynamic, can change
at any time. Also, some corporations (and even ISPs like AOL) use
multiple proxies - and the IP address can change with every request.
I really don't see the issue though. After all you could have two servers
running on the same computer but one listens on a different ip. Surely they
would not have any issues sharing a session? (it might require some new
software to handle it efficiently though) Doing it remotely shouldn't be
that much more of a problem(aside from the security issues).
They sure will - because of security restrictions noted above.
of course I could be missing something but I don't think your reasoning is
valid as its pretty easy to synchronize status.

Jon

Yes, you're missing a lot. Mainly security related. The security is
there for a reason. You might be able to bypass it through clever
programming. But then you open yourself and your customers up to all
kinds of possible hacks.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===
Jun 11 '07 #13
Samir Chouaieb wrote:
Hello,

I am trying to find a solution to a login mechanism for different
domains on different servers with PHP5.

I have one main domain with the user data and several other domains that
need a login to show data.

I want the user to login only once when he visits any of my domains.

The first idea is had is to use the same session for all domains. Is
this possible?

Any help or hint is appreciated.

Thanks in advance

Best regards
Samir
Hello again,

thanks a lot for all your comments and suggestions.
It is interesting to read submits of experienced people.

I will try to combine several ideas concerning central login mechanism
with secure hand shake.

I will present the results on this forum when i get some.

So "see you" later.
Best Regards
Samir
Jun 12 '07 #14

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
1390
by: Mark C via AccessMonster.com | last post by:
Ok bare with me on this one.... I have 1 table "Expenses" that holds about 50 fields broken down into sub categories. I have a Subform tied to a main form so that when I pull up a client it will show all of that clients expenses divided out by the sub categories onto seperate tabs. To view it everything is fine; however, when I want to enter expenses for a new client I have an error.
2
5728
by: TaeHo Yoo | last post by:
Hi all, I have a solution which contains multiple projects. Those multiple projects should share the same session. For example, users login, create the session for users then these session information should be accessed by multiple projects. How do I archieve this? Any tutorial out there? Thanks
1
1834
by: Larry Page | last post by:
What started off as a request for a Single Sign On solution is grown to the point where I need to make some long term design decisions and I'm hoping to get some input on how others are handling the same issues. I've spent the last two years moving applications to an intranet web portal, which morphed into a Internet portal, and now is providing extranet data feeds via web services. The latest twist came when users began to question why...
1
1496
by: Punisher | last post by:
Is this possible? We have 7 webservers servering up the same content, but each has a different viewstate. How can we make them all have the same one?
1
1436
by: NAT | last post by:
I am using session mode as "InProc"(entered in web.config). I have deployed my ASP.NET appln. on a server which uses Load Balancer. i.e I have two servers. I am using session across pages.The problem I am facing is that sometimes I find the session and sometimes not. I beleive this is happenning because of multiple servers. Because session is created on a worker process on one server and the second time it must be hitting the other server...
3
1896
by: NAT | last post by:
I am using session mode as "InProc"(entered in web.config). I have deployed my ASP.NET appln. on a server which uses Load Balancer. i.e I have two servers. I am using session across pages.The problem I am facing is that sometimes I find the session and sometimes not. I beleive this is happenning because of multiple servers. Because session is created on a worker process on one server and the second time it must be hitting the other server...
3
3998
by: Ben Holness | last post by:
Hi all, I have a php/mysql website where people can upload their own graphics for the buttons and background of pages on the website. This used to run on one server, but I have now been asked to set it up on multiple servers. The problem is that when someone uploads a file, how do I distribute it to all of the servers? Should I use php to send it to all of the servers once
4
2363
by: Vinnie123 | last post by:
I can't seem to get my PHP Session to continue across multiple pages. Here is a sample code I wrote: test.php <?php session_start(); $_SESSION = "feona"; header("Location: http://partynd.com/test2.php");
6
1616
by: alfasol | last post by:
I have a search module which has a search form and a php script to search. Now i have to use this search module over multiple sites . If i do that it shows path of search script on browser than the site's address .How to avoid. Please Help.
0
9839
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
9682
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10871
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
1
10621
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
1
7806
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
6998
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5668
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5846
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
2
4039
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.