We are looking to build a new website which would make use of 2 web applications: Drupal and Magento. Drupal will be used for corporate website while Magento will serve as a web shop. One of the challenges that I'm facing is the single-sign-on (SSO) part. I have done quite a lot of reading about this subject and haven't come across the "best way" to do this.

Do we keep a separate user database on both Magento and Drupal? (Taking into consideration that not every Drupal user will have access to the web shop.)

Should we use a central authentication server (CAS) instead?

Currently I'm testing the following method:

  1. Installed the Drupal rules module

  2. Configured that the user is redirected to a file sso.php after he/she logs in on Drupal

  3. The sso.php file reads the information of the currently logged in user and optionally creates the Magento session for this user (if an account with a matching username/e-mail) exists

Does anyone have any previous experience in getting the SSO feature between Magento-Drupal? Any input would be appreciated!

Some more info:

  • The website and web shop will run on the same domain. The web shop is located in a subfolder
  • Preferably the SSO has to be done programatically without using the slow Magento API
  • Why not just build the whole thing in Drupal? drupalcommerce.org. Either way, there's a full list of SSO modules here, perhaps one of those will do the trick – Clive Aug 27 '13 at 18:29
  • Based on the business requirements the Magento platform has been chosen + we have 3 full-time Magento developers with several years of knowledge. – Kenny Aug 27 '13 at 18:34
  • 2
    SSO is unfortunately a really complicated topic, and I don't think the question is a good fit for the site, as there are to many potential solutions, and generally the solutions require heavy tailoring to their target sites. – Letharion Oct 9 '14 at 7:29

Check out phpSimpleSAML. There's also a similar post here: https://stackoverflow.com/questions/7763999/magento-and-moodle-integration

Drupal can also support LDAP based logins but your sessions between both apps won't carry over so you will need a single sign on solution as mentioned above.

  • SAML is a bit heavyweight for SSO on (presumably) a shared base domain, isn't it? Given that cookies can be shared, I mean. Can it be configured to use such cookies to provide authentication and not involve certificates and encryption and all the other delights? – Alfred Armstrong Oct 9 '14 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.