We are looking to build a new website which would make use of 2 web applications: Drupal and Magento. Drupal will be used for corporate website while Magento will serve as a web shop. One of the challenges that I'm facing is the single-sign-on (SSO) part. I have done quite a lot of reading about this subject and haven't come across the "best way" to do this.
Do we keep a separate user database on both Magento and Drupal? (Taking into consideration that not every Drupal user will have access to the web shop.)
Should we use a central authentication server (CAS) instead?
Currently I'm testing the following method:
Installed the Drupal rules module
Configured that the user is redirected to a file sso.php after he/she logs in on Drupal
The sso.php file reads the information of the currently logged in user and optionally creates the Magento session for this user (if an account with a matching username/e-mail) exists
Does anyone have any previous experience in getting the SSO feature between Magento-Drupal? Any input would be appreciated!
Some more info:
- The website and web shop will run on the same domain. The web shop is located in a subfolder
- Preferably the SSO has to be done programatically without using the slow Magento API