This article mainly introduces examples of PHP single sign-in implementation solutions. It has certain reference value. If you need it, you can learn more.
Abstract:
This article mainly introduces the analysis and design of a universal single sign-on system using webservice, session, and cookie technologies. The specific implementation language is PHP. Single sign-on, also known as Single Sign On in English, or SSO for short, is an important part of the comprehensive processing of users in current enterprises and network businesses. The definition of SSO is that in multiple application systems, users only need to log in once to access all mutually trusted application systems.
Motivation:
Friends who have used ucenter’s full-site login method should know that this is a typical observer pattern solution. The user center is a subject, and the registration and deletion of its observers are unified in the backend of ucenter. Each sub-application site corresponds to an observer. Every login action in the user center will trigger a js script to call back the w3c standard subsite login interface (api/uc.php).
The shortcomings of this method, I think, are mainly two points: 1. When there are too many sub-sites, the callback interface will increase accordingly. This is limited by the number of distributed sub-sites. How to control it so that the login efficiency will not be affected? Too low and difficult to grasp; 2. When a problem occurs with the callback interface of a certain substation, the default login process will be stuck (the execution time of the login program can be limited, but if there is a corresponding problem, the callback interface of the substation behind the substation will be called No more.
Based on the above problems, during the actual development process, I designed another single sign-on system.
1. Description of the login principle
Technical implementation mechanism of single sign-on: When the user accesses application system 1 for the first time, because he has not logged in yet, he will be directed to the authentication system to log in; based on the login information provided by the user, the authentication system performs identity verification , if it passes the validation, an authentication credential - ticket should be returned to the user; when the user accesses other applications, he will bring this ticket with him as his own authentication credential. After the application system receives the request, it will send the ticket Go to the authentication system for validation and check the validity of the ticket. If it passes the validation, the user can access application system 2 and application system 3 without logging in again.
It can be seen that to implement SSO, The following main functions are required:
a) All application systems share an identity authentication system;
b) All application systems can identify and extract ticket information;
c) Application The system can identify users who have logged in, and can automatically determine whether the current user has logged in, thereby completing the single sign-on function
Based on the above basic principles, I designed a set of single sign-on system programs in PHP language , has now been put into official production server operation. This system program uses the ticket information with the unique session id of the entire system as a medium to obtain the current online user's entire site information (login status information and other user-wide site information that needs to be processed).
2. Process description:
Login process:
1. Log in to a site for the first time:
a) The user enters the username and password and sends a login request to the user verification center
b) When currently logging into the site, through a webservice request, the user verification center verifies the legitimacy of the username and password. If the verification is passed, a ticket is generated to identify the user of the current session, and the site identifier of the currently logged in sub-site is recorded in the user center. Finally,
c) return the obtained user data and ticket to the sub-site. stand. If the verification fails, the corresponding error status code is returned.
d) According to the result returned by the webservice request in the previous step, the current sub-site logs in the user: if the status code indicates success, the current site saves the ticket through the cookie of this site, and the site records the user's Login status. If the status code indicates failure, the user will be given a corresponding login failure prompt.
2. In the logged-in state, the user goes to another page:
a) Verify the user's login status through the site's cookie or session: If the verification is passed, enter the normal site processing program; Otherwise, the user center verifies the user's login status (sends a ticket to the user verification center). If the verification is passed, local login processing is performed on the returned user information. Otherwise, it indicates that the user is not logged in.
Logout process
a) The current logout site clears the user’s login status of the site and the locally saved user’s unique random ID
b) Through the webservice interface, clear the unique random ID recorded in the entire site. The webservice interface will return, log out the javascript code of other logged-in sub-sites, and this site will output this code.
c) js code accesses the W3C standard logout script of the corresponding site
3. Code description:
The relevant code involved in this article has been Package and upload. If you are interested, you can click to download at the download link at the end of this article.
1. Login process:
Starting from opening the browser, the first subsite logged in must call the UClientSSO::loginSSO() method. This method returns a random ID that is unique to the entire site and is used to identify the user. This random ID has been saved through the cookie of this website in UClientSSO::loginSSO(), that is, the sub-site retains the stub of the user's login ID on this website.
a) The UClientSSO::loginSSO() method is as follows:
<?php /** * 用户验证中心 登陆用户处理 * * @param string $username - 用户名 * @param string $password - 用户原始密码 * @param boolean $remember - 是否永久记住登陆账号 * @param boolean $alreadyEnc - 传入的密码是否已经经过simpleEncPass加密过 * * @return array - integer $return['status'] 大于 0:返回用户 ID,表示用户登录成功 * -1:用户不存在,或者被删除 * -2:密码错 * -11:验证码错误 * string $return['username'] : 用户名 * string $return['password'] : 密码 * string $return['email'] : Email */ static public function loginSSO($username, $password, $remember=false, $alreadyEnc=false) { self::_init(); self::_removeLocalSid(); $ret = array(); // //1. 处理传入webservice接口的参数 // $_params = array( 'username' => $username, 'password' => $alreadyEnc ? trim($password) : self::simpleEncPass(trim($password)), 'ip' => self::onlineip(), 'siteFlag' => self::$site, 'remember' => $remember ); $_params['checksum'] = self::_getCheckSum($_params['username'] . $_params['password'] . $_params['ip'] . $_params['siteFlag'] . $_params['remember']); // // 2.调用webservice接口,进行登陆处理 // $aRet = self::_callSoap('loginUCenter', $_params); if (intval($aRet['resultFlag']) > 0 && $aRet['sessID']) { //成功登陆 //设置本地session id self::_setLocalSid($aRet['sessID']); //设置用户中心的统一session id脚本路径 self::$_synloginScript = urldecode($aRet['script']); $ret = $aRet['userinfo']; } else { $ret['status'] = $aRet['resultFlag']; } return $ret; }//end of function //b) 用户验证中心的webservice服务程序,接收到登陆验证请求后,调用UCenter::loginUCenter()方法来处理登陆请求。 /** * 用户验证中心 登陆用户处理 * * @param string $username * @param string $password * @param string $ip * @param string $checksum * @return array */ static public function loginUCenter($username, $password, $ip, $siteFlag, $remember=false) { self::_init(); session_start(); $ret = array(); $arr_login_res = login_user($username, $password, $ip); $res_login = $arr_login_res['status']; // $ret['resultFlag'] = $res_login; if ($res_login < 1) { //登陆失败 } else { //登陆成功 $_SESSION[self::$_ucSessKey] = $arr_login_res; $_SESSION[self::$_ucSessKey]['salt'] = self::_getUserPassSalt($_SESSION[self::$_ucSessKey]['username'], $_SESSION[self::$_ucSessKey]['password']); $ret['userinfo'] = $_SESSION[self::$_ucSessKey]; $ret['sessID'] = session_id(); //生成全站的唯一session id,作为ticket全站通行 // //合作中心站回调登陆接口(设置用户中心的统一session id) // self::_createCoSitesInfo(); $uinfo = array(); $_timestamp = time(); $_rawCode = array( 'action' => 'setSid', 'sid' => $ret['sessID'], 'time' => $_timestamp, ); if ($remember) { $uinfo = array( 'remember' => 1, 'username' => $username, 'password' => $password ); } $ret['script'] = ''; $_rawStr = http_build_query(array_merge($_rawCode, $uinfo)); // // 合作站点的全域cookie设置脚本地址 // foreach ((array)self::$_coSitesInfo as $_siteInfo) { $_code = self::authcode($_rawStr, 'ENCODE', $_siteInfo['key']); $_src = $_siteInfo['url'] . '?code=' . $_code . '&time=' . $_timestamp; $ret['script'] .= urlencode(''); } // // 记住已登陆战 // self::registerLoggedSite($siteFlag, $ret['sessID']); unset($ret['userinfo']['salt']); } return $ret; } ?>
2. 本站登陆成功后,进行本地化的用户登陆处理,其后验证用户是否登陆只在本地验证。(本地存取登陆用户状态的信息,请设置为关闭浏览器就退出)
3. 当检测用户登陆状态时,请先调用本地的验证处理,若本地验证不通过,再调用UClientSSO::checkUserLogin()方法到用户中心检测用户的登陆状态。
a) UClientSSO::checkUserLogin()方法如下:
<?php /** * 用户单点登陆验证函数 * * @return array - integer $return['status'] 大于 0:返回用户 ID,表示用户登录成功 * 0:用户没有在全站登陆 * -1:用户不存在,或者被删除 * -2:密码错 * -3:未进行过单点登陆处理 * -11:验证码错误 * string $return['username'] : 用户名 * string $return['password'] : 密码 * string $return['email'] : Email */ public static function checkUserLogin(){ self::_init(); $ret = array(); $_sessId = self::_getLocalSid(); if (empty($_sessId)) { //永久记住账号处理 if(isset($_COOKIE[_UC_USER_COOKIE_NAME]) && !empty($_COOKIE[_UC_USER_COOKIE_NAME])) { // // 根据cookie里的用户名和密码判断用户是否已经登陆。 // $_userinfo = explode('|g|', self::authcode($_COOKIE[_UC_USER_COOKIE_NAME], 'DECODE', self::$_authcodeKey)); $username = $_userinfo[0]; $password = isset($_userinfo[1]) ? $_userinfo[1] : ''; if (empty($password)) { $ret['status'] = -3; } else { return self::loginSSO($username, $password, true, true); } } else { $ret['status'] = -3; } } else { // //本站原先已经登陆过,通过保留的sesson id存根去用户中心验证 // $_params = array( 'sessId' => $_sessId, 'siteFlag' => self::$site, 'checksum' => md5($_sessId . self::$site . self::$_mcComunicationKey) ); $aRet = self::_callSoap('getOnlineUser', $_params); if (intval($aRet['resultFlag']) > 0) { //成功登陆 $ret = $aRet['userinfo']; } else { $ret['status'] = $aRet['resultFlag']; } } return $ret; } b) 用户验证中心的webservice服务程序,接收到检验登陆的请求后,调用UCenter::getOnlineUser()方法来处理登陆请求: [php]/** * 根据sid,获取当前登陆的用户信息 * * @param string $sessId - 全站唯一session id,用做ticket * @return array */ /** * 根据sid,获取当前登陆的用户信息 * * @param string $sessId - 全站唯一session id,用做ticket * @return array */ static public function getOnlineUser($sessId, $siteFlag) { self::_init(); session_id(trim($sessId)); session_start(); $ret = array(); $_userinfo = $_SESSION[self::$_ucSessKey]; if (isset($_userinfo['username']) && isset($_userinfo['password']) && self::_getUserPassSalt($_userinfo['username'], $_userinfo['password'])) { $ret['resultFlag'] = "1"; $ret['userinfo'] = $_userinfo; self::registerLoggedSite($siteFlag, $sessId); //记住已登陆战 unset($ret['userinfo']['salt']); } else { $ret['resultFlag'] = "0"; } return ($ret); } ?>
4. 单点登出时,调用UClientSSO::logoutSSO()方法。调用成功后,如需其他已登陆站立即登出,请调用 UClientSSO::getSynloginScript()方法获取W3C标准的script,在页面输出。
a) UClientSSO::logoutSSO()方法如下:
<?php /** * 全站单点登出 * - 通过webservice请求注销掉用户的全站唯一标识 * * @return integer 1: 成功 * -11:验证码错误 */ public static function logoutSSO(){ self::_init(); $_sessId = self::_getLocalSid(); // //本站没有登陆的话,不让同步登出其他站 // if (empty($_sessId)) { self::_initSess(true); return false; } $_params = array( 'sessId' => $_sessId, 'siteFlag' => self::$site, 'checksum' => md5($_sessId . self::$site . self::$_mcComunicationKey) ); $aRet = self::_callSoap('logoutUCenter', $_params); if (intval($aRet['resultFlag']) > 0) { //成功登出 self::_removeLocalSid(); //移除本站记录的sid存根 self::$_synlogoutScript = urldecode($aRet['script']); $ret = 1; } else { $ret = $aRet['resultFlag']; } return intval($ret); } [/php] b) 用户验证中心的webservice服务程序,接收到全站登出请求后,调用UCenter::loginUCenter()方法来处理登陆请求: /** * 登出全站处理 * * @param string - 全站唯一session id,用做ticket * @return boolean */ static public function logoutUCenter($sessId) { self::_init(); session_id(trim($sessId)); session_start(); $_SESSION = array(); return empty($_SESSION) ? true : false; } ?>
四. 代码部署:
1. 用户验证中心设置
a) 用户验证中心向分站提供的webservice服务接口文件,即UserSvc.php部署在hostname/webapps/port/ UserSvc.php中。查看wsdl内容,请访问https://hostname/port/ UserSvc.php?wsdl
b) 用户中心用户单点服务类文件为UCenterSSO.class.php,文件路径为在hostname/webapps/include /UCenterSSO.class.php。该文件为用户单点登陆处理 的服务端类,被hostname/webapps/port/ UserSvc.php调用。用于获取用户的登陆信息,是否单点登陆的状态信息,单点登出处理等。
c) 用户验证中心通过W3C标准,利用cookie方式记录,删除全站统一的用户唯一随机id 的脚本文件为hostname/webapps/port/cookie_mgr.php.
2. 子站点设置
a) 各子站点请将,UClientSSO.class.php部署在用户中心服务客户端目录下。部署好后,请修改最后一行的UClientSSO::setSite('1'); 参数值为用户验证中心统一分配给各站的标识id.
b) 在部署的用户中心服务客户端包下的api目录下下,请将logout_sso.php脚本转移到此处,并编写进行本站登出的处理脚本。
c) 在子站点验证用户登陆状态的代码部分,额外增加到用户中心的单点登陆验证的处理。
即在首先通过本站验证用户的登陆状态,如果未通过验证,则去用户中心验证。验证操作要调用UClientSSO::checkUserLogin();接口,接口含义请查看代码注释。
d) 在分站的登出处理脚本中,通过UClientSSO::getSynlogoutScript();获取script串输出即可。
五. 扩展功能:
1. 记录跟踪所有在线用户
因为所有用户的登录都要经过用户验证中心,所有用户的ticket都在验证中心生成,可以将用户和该ticket(session id)在内存表中建立一个映射表。得到所有在线用户的记录表。
后期如有必要跟踪用户状态来实现其他功能,只要跟踪这个映射表就可以了。其他功能可以为: 获取在线用户列表,判断用户在线状态,获取在线用户人数等。
2. 特殊统计处理
因为整个系统登录登出要经过用户验证中心,所以可以针对用户的特殊统计进行处理。如用户每天的登录次数,登陆时间,登陆状态失效时间,各时段的在线用户人数走势等。
六. 其他事项:
1. 本站登陆状态有效时间问题:
全站要求用户登陆状态在关闭浏览器时就失效。要求各分站对session或cookie的处理方式按照如下进行:
a) Session方式记录用户登陆状态的站点
请在站点公用脚本开始处,添加一下代码
<?php session_write_close(); ini_set('session.auto_start', 0); //关闭session自动启动 ini_set('session.cookie_lifetime', 0); //设置session在浏览器关闭时失效 ini_set('session.gc_maxlifetime', 3600); //session在浏览器未关闭时的持续存活时间 ?>
b) cookie方式记录用户登陆状态的站点
请在设置用户登陆状态的cookie时,设置cookie有效时间为null.
原文链接:http://www.cnblogs.com/linzhenjie/archive/2012/08/24/2653585.html
以上就是本文的全部内容,希望对大家的学习有所帮助。
相关推荐:
PHP multi-dimensional array sorting array detailed explanation
The above is the detailed content of PHP version single sign-in implementation plan. For more information, please follow other related articles on the PHP Chinese website!

php把负数转为正整数的方法:1、使用abs()函数将负数转为正数,使用intval()函数对正数取整,转为正整数,语法“intval(abs($number))”;2、利用“~”位运算符将负数取反加一,语法“~$number + 1”。

实现方法:1、使用“sleep(延迟秒数)”语句,可延迟执行函数若干秒;2、使用“time_nanosleep(延迟秒数,延迟纳秒数)”语句,可延迟执行函数若干秒和纳秒;3、使用“time_sleep_until(time()+7)”语句。

php除以100保留两位小数的方法:1、利用“/”运算符进行除法运算,语法“数值 / 100”;2、使用“number_format(除法结果, 2)”或“sprintf("%.2f",除法结果)”语句进行四舍五入的处理值,并保留两位小数。

判断方法:1、使用“strtotime("年-月-日")”语句将给定的年月日转换为时间戳格式;2、用“date("z",时间戳)+1”语句计算指定时间戳是一年的第几天。date()返回的天数是从0开始计算的,因此真实天数需要在此基础上加1。

方法:1、用“str_replace(" ","其他字符",$str)”语句,可将nbsp符替换为其他字符;2、用“preg_replace("/(\s|\ \;||\xc2\xa0)/","其他字符",$str)”语句。

php判断有没有小数点的方法:1、使用“strpos(数字字符串,'.')”语法,如果返回小数点在字符串中第一次出现的位置,则有小数点;2、使用“strrpos(数字字符串,'.')”语句,如果返回小数点在字符串中最后一次出现的位置,则有。

在PHP中,可以利用implode()函数的第一个参数来设置没有分隔符,该函数的第一个参数用于规定数组元素之间放置的内容,默认是空字符串,也可将第一个参数设置为空,语法为“implode(数组)”或者“implode("",数组)”。

php字符串有下标。在PHP中,下标不仅可以应用于数组和对象,还可应用于字符串,利用字符串的下标和中括号“[]”可以访问指定索引位置的字符,并对该字符进行读写,语法“字符串名[下标值]”;字符串的下标值(索引值)只能是整数类型,起始值为0。


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Dreamweaver Mac version
Visual web development tools

Safe Exam Browser
Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

Zend Studio 13.0.1
Powerful PHP integrated development environment

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

SublimeText3 English version
Recommended: Win version, supports code prompts!
