Thread

Hi! Great job. It’s very easy to use. I can’t help waiting on authorization:) Keep moving

Hi guys,

First off I want to thank Peng Kong for making this awesome module. I just migrated my website (wow-wishlist.com) from using FreakAUTH to A3M and I am loving it. It is very professionally coded and is easy to implement.

The only criticism I can offer is the table structure, why are account_id’s BIGINT’s with a length of 40? There aren’t enough humans inhabiting earth to ever reach this kind of number. Hell I’d be surprised if there were that many ants, or insects in general :p

Anyway, the two main features I was missing was “Change Password” and “Forgot Password”, so I developed them myself.

I made sure I didn’t have to touch any of the existing A3M code so that it should be compatible with future updates and can easily be stripped out when Peng offers his own “Change Password” and “forgot Password” features.

To install:

- Download file (duh)
- Extract contents to your “./system/application/modules/account/” folder (you shouldn’t have to overwrite anything, just merge folders)
- Run account_reset.sql on your database
- Modify config/forgot_password.php to match your preferences
- Modify views
- done

Note that the views are really oriented at my own layout so you -will- have to change these.

Also note that I have not thoroughly tested my modifications yet, they seem to work properly on my end but bugs may still be present.

Looking forward to future updates for this module 😊

thanks for the comment haatan.

you have a point there with the big int 40. will change to just bigint in next ver.

“change password” and “forget password” is implemented in the previous ver. but i have yet to port it to the latest ver. because the lastest ver. is a total rewrite.

Shouldn’t take long to port so should definitely be done this week. (after oauth which i’m working on now)
I’ll also study your code and integrate everything i find.

I’m actually designing it in such a way that people who sign in with google yahoo etc don’t need to see a “change password” option… cause one point of openid is to not have your passwords strewn all over the net.

so the auth library will give you some kind of method to check “is_openid()” before presenting the change password option.

some goes for verification email. there will be a has_verified_email() function in the auth lib to allow us to check if user has at least ONE verified email. i’m designing it such that user’s don’t need to have a verified email unless you enforce it with has_verified_email().

Hi Peng,

Interested to hear about your total rewrite, will it essentially be a completely new module in no way resembling it’s previous version or will it be easy to upgrade from the current version to the new version?

I did make the change password feature with a check to see if the current user is using a password.. so it would only be usable by those who used the a3m registration mechanism.

Any idea when we may have a look at the new version? 😊 I will probably hold off updating my website until this version arrives.

And for the record, a regular INT will do, unless you think your website will be getting more than 2.147.483.647 users :p

erm the ver. you’re using is most likely the total rewrite already (ver.0.4 see my 1st post for change log)

to be honest I’m not caring to much about backwards compatibility atm. i really should have a disclaimer somewhere stating this is a alpha kind of thing and not really meant for production usage (because many features are still not yet done).

anyway with proper separation of concerns, loose coupling and clean coding style you should be able to easily understand and fix (or add) anything yourself 😊 that really is the selling point of a3m =)

Upgrading shouldn’t be too hard down the road because i don’t see myself changing the existing features (because the point is usability, keep it simple!) e.g. Not to throw a huge form at users during registration. Sign in with google, yahoo, etc is already as simple as it can get so that shouldn’t change much either. Yep so upgrade will be adding new features rather then changing existing features.

I can’t really promise when the next release will be but I’m working on it full time so there should be some major releases every week.

keep the feedback coming and suggestions cause i’ll try to factor as many use cases as possible, if possible. 😊 thanks

Thanks for the quick response Peng.

Yeah I’m using 0.4 so I guess upgrading to the next version shouldn’t be too difficult 😊

I understand that it’s still in heavy development and as such isn’t recommended for production use.. but seeing as we’re all programmer here the tag “alpha” or “beta” isn’t as “risky” as it would be for other products, long as you’re willing to invest some extra time (which I am). From all the authentication systems I’ve seen for CI I find this one the most promising (not to mention the only one actually being maintained at the moment).

Anyway, looking forward to the next version 😊 I can wait a week, plenty of other stuff to work on 😉

great!

In case anyones interested in getting A3M working with Vanilla forums 2.0 (ie. use A3M as the authentication / registration mechanism), create a controller with the following contents:

<?php

class userAuth extends Controller {

    private $userID;

    /**
     * Constructor
     * @author Nathan Rijksen
     */
    function userAuth() {
        parent::Controller();

        $this->load->library(array('account/authentication', 'account/account', 'account/facebook_platform','form_validation','wowish'));

        $this->userID = $this->session->userdata('account_id');
    }

    function index() {
        if (!$this->authentication->is_signed_in()) exit;
        $account = $this->account->get_by_id($this->userID);

        $account_email     = $this->db->get_where('a3m_account_email', array('account_id'=>$this->userID))->row();
        $email             = $this->db->get_where('a3m_email', array('id'=>$account_email->email_id))->row();

        $userFields = array(
            'UniqueID'        => $account->id,
            'Name'            => $account->username,
            'Email'            => $email->email,
        );

        foreach ($userFields AS $field=>$value)
            echo $field.'='.$value."\n";
    }

    function signout() {
        $this->session->unset_userdata('account_id');
        setcookie('Vanilla',' ',time()-3600,'/');
        unset($_COOKIE['Vanilla']);
        redirect(base_url());
    }

}

?>

Replace the contents of the redirect with whatever you want it to redirect to upon logging out.

Also, go into modules/account/libraries/Authentication.php and add the following to the sign_out function:

setcookie('Vanilla',' ',time()-3600,'/');
        unset($_COOKIE['Vanilla']);

Make sure that the following CI settings are set to false:

sess_match_ip
sess_match_useragent

Finally, install the Single Sign On addon for Vanilla Forums 2.0 and change the settings to:

# Authenticate Url
# <a href="http://domain.com/userAuth">http://domain.com/userAuth</a>

# Registration Url
# <a href="http://domain.com/account/sign_up">http://domain.com/account/sign_up</a>

# Sign-in Url
# <a href="http://domain.com/account/sign_in">http://domain.com/account/sign_in</a>

# Sign-out Url 
# <a href="http://domain.com/userAuth/signout">http://domain.com/userAuth/signout</a>

That’s it.. sign in with A3M and navigate to your forums.. if all went well you should be automatically logged in.

(Note - make sure the admin user you create in vanilla does not conflict with an a3m user)

Also be sure to read the “Final Touches” over at > http://vanillaforums.org/page/singlesignon

ooo that looks like a cool forum software. will check it out sometime.

i’ve completed account settings management and change password today.
will do profile settings (username, profile picture), email management (each account can have 1-* verified/non-verified emails), email verfication and forgot password before releasing it as v0.5.

*for those looking out for oauth, i will include the working files. however the complete thing will have to wait for v0.6

Yeah Vanilla forums is really nice for a website that just needs to have some simple forums to support its community. Messing with the css is hell though.. they could really have made that easier.

Just out of curiosity, what will oauth add to a3m that it doesn’t already have?

And thanks for keeping us up to date 😊 Looking forward to 0.5

with v0.5 only authentication (via traditional username/password, OpenID and Facebook Connect) plus account management (managing username, password, emails, etc) is done.

oauth is basically the authorization part. It’s authorization delegation to third parties.
meaning third party website can request your users to share their data residing on your website.
most people won’t be too concerned with this, unless you’re offering a API like twitter, flickr, vimeo, etc

the other part which more people will be interested in will be role based access control. meaning having users who are admins, moderators etc. i.e. only ‘admins’ can access website settings page. only ‘moderator’ can do something else, etc. You will get to define the roles and what each role can do on your website.

0.4 seems to already be supporting the major third party authentication services though. Which ones will oauth add?

Definitely looking forward to role management 😊 that would really complete the module feature-wise.

Hey Peng,

Wanted to let you know that the module seems to have some issues with SuPHP, seeing as SuPHP can’t use the PATH_INFO variable properly I had to set it to use REQUEST_URI ($config[‘uri_protocol’]  = “REQUEST_URI”; in your config). However I can no longer connect with Google. When I attempt this I get a really long url which results in a CI 404 page.

Been trying to find a solution for about an hour now but it’s getting too late.. will look further tomorrow.. just thought I’d let you know. Perhaps you have a solution ..

You can see it for yourself here > http://www.wow-wishlist.com/account/sign_in

ok afew things.

1) Apparently your server allows http://www.wow-wishlist.com/account/sign_in_openid/verify/?janrain_nonce=whateverstuff but NOT http://www.wow-wishlist.com/account/sign_in_openid/verify?janrain_nonce=whateverstuff. The difference is the / before “/verify”. if you do a small hack and add that slash in yourself. i think it should work.

2) Google *MUST* use HTTPS else it’s guaranteed to fail.

3) Your twitter callback url is set wrongly (http://www.twitter.com/oauth). It should be http://www.wow-wishlist.com/account/sign_in_twitter/verify?oauth_token=whateverstuff NOT http://www.wow-wishlist.com/?oauth_token=whateverstuff