Drupal 6: Allow external site to authenticate via Drupal

Question

How would I allow a simple PHP site, which already has a user db, to let Drupal handle the logging in of users? I guess I could use services (but I would need help on this) or alternatively is there some way that users are passed to the Drupal login form to log in, but the simple external PHP site knows, through some kind of cookie arrangement, that the user is logged in?

The main priorities are that the user should only have to log in once for both sites, and the existing users on the external site can be maintained and transitioned smoothly. I want Drupal as the main user db because it's more secure and I think it's easier to have the external authenticate off Drupal rather than the other way around.

Any thoughts?

Answer 1

If you have access to the same cookies as the Drupal site, you can pull the session ID out of the SESS* cookie. Then check the sessions drupal table for the uid.

The session cookie name is a little more challenging to predict as it is "SESS"+ an md5 hash of the session name from the host domain URL or cookie_domain setting in settings.php file. Given your full control over the site, it shouldn't be hard to work with that though.