Hello all,
I'm working on setting up single sign-on among a number of sites hosted with Aegir using the Bakery module, but haven't gotten it to work yet.

When logging in to the master site everything works as expected. When logging into a slave site, the user is redirected to the master login form. But, on logging in the user is taken to example.com/user, not redirected back to slave.example.com. And the user is not logged in at all on the slave site.

I've successfully used Bakery on sites that are not hosted with Aegir, so I'm familiar with the set-up it requires.

I've followed the instructions in Bakery's README, and have set up a local.settings.php file in the directory for each site that would use Bakery that included the following:

<?php
$cookie_domain = 'example.com';

Aegir also produces code in a site's settings.php file, and it seemed like it might be the source of the conflict:

* We try to set the correct cookie domain. If you are experiencing problems
* try commenting out the code below or specifying the cookie domain by hand.
*/
if (isset($_SERVER['HTTP_HOST'])) {
$domain = '.'. preg_replace('`^www.`', '', $_SERVER['HTTP_HOST']);
// Per RFC 2109, cookie domains must contain at least one dot other than the
// first. For hosts such as 'localhost', we don't set a cookie domain.
if (count(explode('.', $domain)) > 2) {
@ini_set('session.cookie_domain', $domain);
}
}

I tried commenting out that code, but met the same results. Plus any time a site is verified in Aegir the settings.php file is wiped clean again, making the code block uncommented.

I'm not sure if this is related to Redirect back to the slave site's destination, but it might be.

I've cross-posted this on the aegir mailing list.

Comments

coltrane’s picture

coltrane
he/him
commented

It's been awhile since I've worked with the 1.x branch, so I can't recall how redirects were carried across prior to slave-site login and register (#838020: Redirect back to the slave site's destination was for the 2.x branch on 6 -- not all of the 2.x code has been ported to 7).

It shouldn't be a matter of the cookie domain, it's either a misconfiguration or a bug in the 7.x code. Sorry I can't be of more help right now. psynaptic has a port of Bakery 2.x for 7 that he needs to contribute.

niccolox’s picture

niccolox commented

I am in the same boat at seth here. Trying to get a site network single login happening with Bakery and Aegir

in my case I am trying to bind Open Atrium, Drupal Commons etc together with a master Bakery site...

trying to separate the OA, DC specifics from Bakery features/bugs

any updates?

coltrane’s picture

coltrane
he/him
commented

@niccolo, can you document what you're experiencing? Are you getting errors messages, and what versions of Bakery and the distributions are you using?

niccolox’s picture

niccolox commented

I just tested this a bit more on Quickstart 9.0.1 - Ubuntu 10.10, Aegir 1.0, Drupal 7, Bakery 7.x-1.x-dev

I got Bakery to work fine between D7 master-slave combinations outside of Aegir.

Within Aegir I tried the same D7 master-slave got a problem with the slave site being locked out, I think due to the creation of the local.settings.php - which is the recommended Aegir approach

I get Access Denied on the slave site as soon as I create the local.settings.php - my guess is it thinks its on a master domain which it gets from the cookie_domain

next, will try Open Atrium Beta 10 next, and Drupal Commons 1.5 next, they are D6 and maybe behave differently

as a side note, its pretty important for Aegir hosting to be able to provide some kind of single sign-on...

more soon

niccolox’s picture

niccolox commented
Issue tags: +aegir, +bakery, +hostmaster

see this 2009 Feature Request from anarcat http://drupal.org/node/1096660

coltrane’s picture

coltrane
he/him
commented

Closed #1151020: Aegir support for Bakery (or Bakery support for Aegir) as a duplicate of this, though niccolo has some good links in it

danepowell’s picture

danepowell commented

Subscribing- haven't invested any time trying to set up Bakery with Aegir-hosted 7.x sites, based on the problem reports here, but I'd very much like to...

niccolox’s picture

niccolox commented

have turned my attention to a sandbox project OSSO - OpenID Single Signon - only works with D6 and has a bug that seems to be an artifact of OpenID core module ...

based on Alex Barth of Dev Seeds original osso
http://drupal.org/node/1156278
http://drupal.org/sandbox/xamanu/1153576
http://drupal.org/sandbox/xamanu/1153576

lelizondo’s picture

lelizondo commented

I also tried the OSSO solution initially developed by development seed but is incomplete and it doesn't necessary does what it should do.

OSSO will let you login in a site but it won't log you in any other site.

niccolox’s picture

niccolox commented

try the sandbox version above.

the code is more recent, and I think it works better than you describe.

though it does bug-out.

basically, there is no single or simple signon solution for Drupal sites, neither Bakery or OSSO are flexible enough to handle the basic use cases

i.e. cross-domain, D6 and D7 single signon

weird omission in Drupal, considering OpenID is in core

coltrane’s picture

coltrane
he/him
commented

basically, there is no single or simple signon solution for Drupal sites, neither Bakery or OSSO are flexible enough to handle the basic use cases

You're exaggerating the truth here, you mean to say that there is no solution for your use case, which is with Aegir.

lelizondo’s picture

lelizondo commented

I've tried OSSO, in my case, it didn't work as I expected, or at least, it doesn't do what Bakery does, which is log in a user on every site if the users logs in one site. The only problem with Bakery is that it doesn't work with Aegir.

The problem with Bakery is that it needs a line in settings.php to work and Aegir is not very friendly with modules that need to add stuff to settings.php

lelizondo’s picture

lelizondo commented

Does anyone has given this module a try? http://drupal.org/project/site_network

Is the old Drupal module used for distributed authentication.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

@niccolo, creating a tag like "make openid suck less" is not constructive. Please find more constructive ways to interact with the community.

niccolox’s picture

niccolox commented
Issue tags: +OpenID, +osso

gday greggles,

that tag was auto suggested to me, so its gotta prior currency, seemed like fairly tame language to me, try openid tag and see what auto suggest comes up first

what can I say, tagging (standing) on the suggestions (shoulders) of giants

niccolox’s picture

niccolox commented

bakery doesnt do cross-domains (or aegir)
osso (openid) is sandboxed and doesnt do d7 (and bugs out)

am i exaggerating ?
i dont think so, being annoying?
for sure

lelizondo’s picture

lelizondo commented
Category: support » feature

Like @niccolo, I don't think there's a complete solution for this problem, but instead of an endless discussion, I suggest we start working on a possible solution for a single signon module that does cross-domains and works with Aegir.

Let's start with changing the category of this issue.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Closed (won't fix)

If you know you are being annoying, why do it?

If I type ug, as in "ugly thread" I get a suggestion for "cheap ugg boots" - does that make it right to use the tag? no.

possible solution for a single signon module that does cross-domains

Bakery is never meant to do that. Marking won't fix.

niccolox’s picture

niccolox commented

my ugg boots aren't cheap.

I'm over it.

lelizondo’s picture

lelizondo commented

@greggles is there any reason why Bakery will never work with cross domains?

coltrane’s picture

coltrane
he/him
commented

@lelizondo Bakery takes advantage of the browser readability of cookies on the same domain and was explicitly designed for cookies, so unless there's a way to do cross-domain cookie reading (not that I'm aware of) Bakery will only work on the same domain.

You're welcome to copy and use lots of the code in a different SSO solution, but Bakery should stay pretty focused on what it does.

lelizondo’s picture

lelizondo commented

Good to know. Thanks.