vBulletin login from subdomain

0
votes

I have rather special need in login to vBulletin not from forum directly. I looked through topics by searching "vbulletin login", but found nothing.

So here's the structure.

  • domain.com - main site, access is restricted by ip range
  • domain.com/forum/ - vB with cookie's host set to .domain.com, of course it's also restricted by ip
  • extra.domain.com - secondary site which is available to almost anyone ('almost' includes users of vB created manually via ACP)

As for now users already authenticated at domain.com/forum/ are recognized both at domain.com and at extra.domain.com.

So the problem is to login from extra.domain.com to domain.com/forum/

However i can't just post entered usernames and passwords to forum because of ip restriction. As I get it, there should be some wrapper, which will do all the login procedure via cURL or somehow, get all the cookies and then return them to user.

First of all, please tell me if I'm on a right way in my thoughts? Also are there any other ways to complete task without having to spend hours with HTTP sniffer? I mean are there any SOAP plugins for vB auth from trusted domains? Forum version is 4.0.8

1
vbulletin

1 Answers

0
votes

Does the code on the secondary site have access to the vBulletin code & database? If so, you can handle vBulletin logins in PHP like so:

chdir('/directory/where/vbulletin/is');
require_once('global.php');
require_once(DIR . '/includes/functions_login.php');

// Check for too many login attempts
$strikes = verify_strike_status($username, TRUE);
if ($strikes === FALSE || $strikes >= 5) {
    // TODO: Your error handling here
}

// Attempt authentication
if (!verify_authentication($username, $password, '', '', TRUE, TRUE)) {
    exec_strike_user($username);
    // TODO: Handle bad username & password here
}

// Clear records of previous bad logins
exec_unstrike_user($username);

// Create a new session
process_new_login('', TRUE, '');

The code above should work with vBulletin 3.8.x, but from what I remember of 4.x it shouldn't take much tweaking to make it work with 4.0.8.

Set the 5th parameter to verify_authentication to false if you wish to make the login non-persistent (like not checking "Remember Me" on login).