Matt Farina suggested this via email.
Because of how Drupal works, it is possible to point the following FQDNs at the same install:
- onesite.com
- twosite.com
- threesite.com
Currently, the domain module assumes the following structure:
- one.site.com
- two.site.com
- three.site.com
Changing the handler to look for FQDN instead of subdomain strings would add flexibility to the module.
Doing so would allow all of the following to function on a single installation:
- one.site.com
- onesite.com
- two.onesite.com
- twosite.com
Anyone have thoughts?
| Comment | File | Size | Author |
|---|---|---|---|
| #22 | domain-DRUPAL-5.sso_.patch | 1.95 KB | sun |
Comments
Comment #1
canen commentedThis would be great. The sites we are working would actually be using the onesite.com, twosite.com structure instead of one.site.com, two.site.com. More flexibility is always good.
Comment #2
agentrickardI just coded this, and will commit it. But one unintended consequence.
Drupal logs users in based on cookies, which are top-level specific. So if you are logged in to:
example.com
You can be logged in to:
one.example.com
But not to:
oneexample.com
So there would need to be some finesse with cookie handling for your setup to work.
Comment #3
canen commentedWouldn't just changing the
$cookie_domainsetting in the settings.php file work?Comment #4
agentrickardNo. You can only set a single cookie domain.
The cookie for *.example.com is not valid for myexample.com for security reasons. There are ways around this, but I would like to avoid them.
I tried the single sign-on module, but it doesn't quite work.
Comment #5
agentrickardFor the sake of simplicity, I'm going to leave this alone.
I changed the interface (and underlying code) to accept the fully-qualified domain name, but the requirement is still that all domains must be third-level domains of the master domain.
Trying to do otherwise introduces clutter and edge cases that this module was not meant to support.
You could still alias your existing domains (in Apache) to the relevant subdomains.
Comment #6
agentrickardChanging to "postponed," This is a nice feature, but I don't want it to slow release of the module.
Comment #7
mrichar1 commentedHere is how I set up apache to strike a balance fully qualified domains and subdomains. With this set up end-users will only ever see and use the fully qualified domains however all management editing has to be done via the subdomains.
I have following sites (names changed to protect the innocent) set up in the domain access module.
audi.allcars.com
vw.allcars.com
honda.allcars.com
I edited settings.php so that my cookie domain is allcars.com. This allows me to be logged in across all sites.
My main vhost config looks like this:
Then I set up a vhost for each of my fully qualified domains so that they proxy their respective subdomains. The ProxyPassReverse directive is needed if you want forms that do redirects (like the search form) to work.
P.S. There seems to be some kind of url filter running which messes up the vhost listing.
Comment #8
agentrickardCan you elaborate on that P.S. a little?
Comment #9
mrichar1 commentedIf you look at the comment I posted you will notice that the urls have been automatically hyperlinked (I entered them as plain text). Unfortunately it seems that whatever was used to do the linking got a little overzealous and linked some of the vhost tags as well.
Marc
Comment #10
agentrickardOK. I thought you were talking about Drupal code, not the comment post itself.
Comment #11
agentrickardImplemented. The cross-domain cookie issue still remains.
Comment #12
Pedro Lozano commentedI've just installed Single Sigon with Domain Access and it seems to work cross-domain without any modification. (Note: leave $cookie_domain unset).
Comment #13
agentrickardNot setting the $cookie_domain may be the key here. Will test.
Comment #14
agentrickardI keep getting Page Not Found errors when trying to login with Single Sign On turned on. I made it work for a little while, but when I logout and try to log back in (or login as a different test user), I get Page Not Found on URL strings like:
Can you give a point-by-point account of what you did to get SSO working? For example:
-- Untar SSO module.
-- Go to main site.
-- Go to admin > build > modules and enable SSO.
-- Go to admin > users > access control
And so on.
Comment #15
Pedro Lozano commentedI was surprised it actually was pretty simple.
1. Domain Access was already configured and working. (Basic setup. Default domain + 3 additional subdomains (like tv.domain.com, tv-a.domain.com, tv-b.domain.com,...) and 1 different domain tv.domain2.com. No prefix for any table. Clean-urls actived on drupal).
2. Untar SSO.
3. Go to admin > build > modules > modules and enable SSO
4. Go to admin > settings > singlesignon and enter the url of the default domain.
5. Comment $cookie_domain line on settgins.php
I've found only 1 issue so far. SSO only works if I make login in any non-default (ID != 0) domain. Login in the default (ID==0) domain does't propagate the session to the rest of the domains.
Comment #16
agentrickardOK, so this seems to be the issue:
How to debug and fix....
Comment #17
wayland76 commentedHmm. It seems logical to me, then, that the bug is in the singlesignon module (so maybe it should be reassigned there).
But unfortunately the maintainer for that appears to have only made 7 comments in the last year. There are also 5 things claiming to be patches sitting in its queue. I also have an additional (one-line) patch that makes Single sign-on work more happily with Google and other bots.
Comment #18
agentrickardWell, if you can determine why this fails, we can determine where the solution needs to be.
Looking at the code, it seems fairly obvious that the issue is in
singlesignon_init(), which issues a redirect.Comment #19
agentrickardHere's a crazy idea that I never tried.
What happens if you set one "master domain" for SSO, but another for DA?
That is, for SSO, the "master domain" is 'www.example.com', but in DA, the "primary domain" is 'example.com' or 'my.example.com'.
Perhaps that might be enough to coerce the two modules into working together.
Comment #20
wayland76 commentedDoes this seem relevant?
http://drupal.org/node/132015
Comment #21
agentrickardIt does. Testers?
Comment #22
sun#132015: I often get "page not found" contains a fix for this bug. It would be really nice if Domain Access would have these paths already added upon installation.
Comment #23
wayland76 commentedThanks, sun. I was just coming here to ask about this :).
Comment #24
agentrickardI'd prefer to see this implemented as a hook inside SSO. The reasoning here is that I am trying to keep the core module, well, responsive to Drupal core.
I can add something to the documentation, though. This is a great fix.
Comment #25
sunYes, a hook in SSO would be great.
Since the original topic of this issue has already been fixed, let's continue this discussion over at #256007: Single Sign-on and SEO - already including another patch for Domain Access.
Setting back original status.