First of all, this is a very promissing tool and it will help a lot while maintaining multiple sites.

What happens here is that the ce-report fails at the first site where there is no active sessions for a logged in user at the server site. And when it can't fetch information from a site it doesn't conitnue with the next site in the server group.

Comments

Garrett Albright’s picture

Garrett Albright commented
Assigned: Unassigned » Garrett Albright
Priority: Critical » Normal

You're right. That's because CE uses Drupal's by-the-book access restriction methods to figure out who can and can't access server data. If your browser doesn't have a cookie identifying its user as a logged-in and privileged user at the server site, the client won't be able to access the data it can send. And you're also right about CE not handling this problem very well - this is partially because it's still young and partially because of the tricks involved with getting this sort of (legitimate) cross-site scripting to work.

I've given some thought to ways around the access restriction issue so you don't have to stay logged in at the server site, like maybe an IP address whitelist on the server end or something like that, but haven't settled on anything so far. What's in place now was the simplest to implement, so there you go.

I've taken a break from it recently, but I hope to get back on working on CE later this week or weekend. Let's see if I can work something out then.

jurgenhaas’s picture

jurgenhaas
he/him
Primary language German
Location Gottmadingen
commented

Thanks for your frank and detailed feedback. May I suggest another method which may probably work? You could go for a convention that on each server there has to be a user with appropriate rights and the exact same username and password as the calling client. You could then probably do a kind of an automatic login when the client is trying to get access to each of the servers.

Garrett Albright’s picture

Garrett Albright commented

That might work if we can assure that the servers will always be behind secure connections. Otherwise, we're sending passwords (or password hashes) in cleartext. Not gonna happen.

bclinton’s picture

bclinton commented

Why don't you have the client sites send the information to the server so you don't have to worry about logins?