Matt Farina suggested this via email.

Because of how Drupal works, it is possible to point the following FQDNs at the same install:

- onesite.com
- twosite.com
- threesite.com

Currently, the domain module assumes the following structure:

- one.site.com
- two.site.com
- three.site.com

Changing the handler to look for FQDN instead of subdomain strings would add flexibility to the module.

Doing so would allow all of the following to function on a single installation:

- one.site.com
- onesite.com
- two.onesite.com
- twosite.com

Anyone have thoughts?

CommentFileSizeAuthor
#22 domain-DRUPAL-5.sso_.patch1.95 KBsun

Comments

canen’s picture

This would be great. The sites we are working would actually be using the onesite.com, twosite.com structure instead of one.site.com, two.site.com. More flexibility is always good.

agentrickard’s picture

I just coded this, and will commit it. But one unintended consequence.

Drupal logs users in based on cookies, which are top-level specific. So if you are logged in to:

example.com

You can be logged in to:

one.example.com

But not to:

oneexample.com

So there would need to be some finesse with cookie handling for your setup to work.

canen’s picture

Wouldn't just changing the $cookie_domain setting in the settings.php file work?

agentrickard’s picture

No. You can only set a single cookie domain.

The cookie for *.example.com is not valid for myexample.com for security reasons. There are ways around this, but I would like to avoid them.

I tried the single sign-on module, but it doesn't quite work.

agentrickard’s picture

Title: Use fully-qulified domain names instead of subdomains? » Use fully-qualified domain names instead of subdomains?
Status: Active » Closed (won't fix)

For the sake of simplicity, I'm going to leave this alone.

I changed the interface (and underlying code) to accept the fully-qualified domain name, but the requirement is still that all domains must be third-level domains of the master domain.

Trying to do otherwise introduces clutter and edge cases that this module was not meant to support.

You could still alias your existing domains (in Apache) to the relevant subdomains.

agentrickard’s picture

Status: Closed (won't fix) » Postponed

Changing to "postponed," This is a nice feature, but I don't want it to slow release of the module.

mrichar1’s picture

Version: » 5.x-1.0beta6

Here is how I set up apache to strike a balance fully qualified domains and subdomains. With this set up end-users will only ever see and use the fully qualified domains however all management editing has to be done via the subdomains.

I have following sites (names changed to protect the innocent) set up in the domain access module.

audi.allcars.com
vw.allcars.com
honda.allcars.com

I edited settings.php so that my cookie domain is allcars.com. This allows me to be logged in across all sites.

My main vhost config looks like this:

<VirtualHost *>
  DocumentRoot /var/www/allcars
  ServerName allcars.com
  ServerAlias audi.allcars.com vw.allcars.com honda.allcars.com
</VirtualHost>

Then I set up a vhost for each of my fully qualified domains so that they proxy their respective subdomains. The ProxyPassReverse directive is needed if you want forms that do redirects (like the search form) to work.

<VirtualHost *>
  ServerName www.audi.com
  ProxyPass / http://audi.allcars.com/
  ProxyPassReverse / http://audi.allcars.com/
</VirtualHost>

<VirtualHost *>
  ServerName www.vw.com
  ProxyPass / http://vw.allcars.com/
  ProxyPassReverse  / http://vw.allcars.com/
</VirtualHost>

<VirtualHost *>
  ServerName www.honda.com
  ProxyPass / http://honda.allcars.com/
  ProxyPassReverse  / http://honda.allcars.com/
</VirtualHost>

P.S. There seems to be some kind of url filter running which messes up the vhost listing.

agentrickard’s picture

Can you elaborate on that P.S. a little?

mrichar1’s picture

If you look at the comment I posted you will notice that the urls have been automatically hyperlinked (I entered them as plain text). Unfortunately it seems that whatever was used to do the linking got a little overzealous and linked some of the vhost tags as well.

Marc

agentrickard’s picture

OK. I thought you were talking about Drupal code, not the comment post itself.

agentrickard’s picture

Status: Postponed » Closed (fixed)

Implemented. The cross-domain cookie issue still remains.

Pedro Lozano’s picture

I've just installed Single Sigon with Domain Access and it seems to work cross-domain without any modification. (Note: leave $cookie_domain unset).

agentrickard’s picture

Status: Closed (fixed) » Active

Not setting the $cookie_domain may be the key here. Will test.

agentrickard’s picture

Status: Active » Postponed (maintainer needs more info)

I keep getting Page Not Found errors when trying to login with Single Sign On turned on. I made it work for a little while, but when I logout and try to log back in (or login as a different test user), I get Page Not Found on URL strings like:

q=singlesignon/login&slave_session=98oeodb3hmqveptmujbgbvtsa3&singlesignon_dest=http%3A%2F%2Fken.test%2Fdrupal-5.6%2F

Can you give a point-by-point account of what you did to get SSO working? For example:

-- Untar SSO module.
-- Go to main site.
-- Go to admin > build > modules and enable SSO.
-- Go to admin > users > access control

And so on.

Pedro Lozano’s picture

I was surprised it actually was pretty simple.

1. Domain Access was already configured and working. (Basic setup. Default domain + 3 additional subdomains (like tv.domain.com, tv-a.domain.com, tv-b.domain.com,...) and 1 different domain tv.domain2.com. No prefix for any table. Clean-urls actived on drupal).
2. Untar SSO.
3. Go to admin > build > modules > modules and enable SSO
4. Go to admin > settings > singlesignon and enter the url of the default domain.
5. Comment $cookie_domain line on settgins.php

I've found only 1 issue so far. SSO only works if I make login in any non-default (ID != 0) domain. Login in the default (ID==0) domain does't propagate the session to the rest of the domains.

agentrickard’s picture

Version: 5.x-1.0beta6 » 5.x-1.0rc3

OK, so this seems to be the issue:

SSO only works if I make login in any non-default (ID != 0) domain.

How to debug and fix....

wayland76’s picture

Hmm. It seems logical to me, then, that the bug is in the singlesignon module (so maybe it should be reassigned there).

But unfortunately the maintainer for that appears to have only made 7 comments in the last year. There are also 5 things claiming to be patches sitting in its queue. I also have an additional (one-line) patch that makes Single sign-on work more happily with Google and other bots.

agentrickard’s picture

Well, if you can determine why this fails, we can determine where the solution needs to be.

Looking at the code, it seems fairly obvious that the issue is in singlesignon_init() , which issues a redirect.

agentrickard’s picture

Here's a crazy idea that I never tried.

What happens if you set one "master domain" for SSO, but another for DA?

That is, for SSO, the "master domain" is 'www.example.com', but in DA, the "primary domain" is 'example.com' or 'my.example.com'.

Perhaps that might be enough to coerce the two modules into working together.

wayland76’s picture

Does this seem relevant?

http://drupal.org/node/132015

agentrickard’s picture

Version: 5.x-1.0rc3 » 5.x-1.0
Status: Postponed (maintainer needs more info) » Active

It does. Testers?

sun’s picture

Version: 5.x-1.0 » 5.x-1.4
Status: Active » Needs review
StatusFileSize
new1.95 KB

#132015: I often get "page not found" contains a fix for this bug. It would be really nice if Domain Access would have these paths already added upon installation.

wayland76’s picture

Thanks, sun. I was just coming here to ask about this :).

agentrickard’s picture

I'd prefer to see this implemented as a hook inside SSO. The reasoning here is that I am trying to keep the core module, well, responsive to Drupal core.

I can add something to the documentation, though. This is a great fix.

sun’s picture

Status: Needs review » Closed (fixed)

Yes, a hook in SSO would be great.

Since the original topic of this issue has already been fixed, let's continue this discussion over at #256007: Single Sign-on and SEO - already including another patch for Domain Access.

Setting back original status.