Ask MetaFilter questions tagged with xoops

How do I pass a PHP session authenticated in IIS across to Jetty or Tomcat?

tra — Thu, 04 Sep 2008 13:37:34 -0800

I have users logging into XOOPS running on IIS, and have an instance of the Jetty JSP webserver configured to serve up Eclipse's Infocenter system. How can I set up security so that no users can view the Jetty-served content without being authenticated first in a XOOPS session off of IIS? I'm trying to tie certain web-based applications together here and I'm wondering if there's an easy way to achieve something.

At my company, we run IIS, PHP and MySQL which all serves up a XOOPS-driven website. One of our teams has provided the Eclipse Help system ("Infocenter") containing a stack of product documentation, all packaged up with the Jetty webserver. The way we received it from another team in our company, you run a batch file which installs Jetty as a Windows service, and when you run that service Jetty fires up and starts listening on a port that you can pre-choose in a properties file prior to creating the service. Going to your URL/port in a browser will connect to Jetty, which in turn serves up the Eclipse Infocenter content.

That's all well and good if you're happy to just send your browser to the Jetty/Infocenter URL but there's another dimension to this. I need to be able to secure access to the Jetty port so that only users who have pre-authenticated to XOOPS, hosted in IIS, will be allowed into the Infocenter/Jetty instance. And therein lies the rub: once authenticated to XOOPS the user has a golden key in the form of an authenticated session, but as soon as the browser is passed to Jetty, how can we set it up so that the user is forbidden from accessing any Jetty-served pages without the XOOPS golden key?

It's a convoluted situation here but let's just say that another non-IT team came up with this Infocenter idea - someone who "did this at his previous job" has suggested the idea, plenty of non-IT but senior-management people bought into it, he wrapped up everything in Jetty and gave it to us, and now he's on his way out of the company (probably so he can eventually leave a poo in the middle of some other company's carpet the size of the Pyramid of Giza for someone else to clean up) and doesn't have the time to work with us to fulfil the mess of other requirements we now have in taking this technology to the next level.

We have Tomcat serving other JSP content as well, which is doubly annoying in the scheme of things since, of course, it should be able to replace Jetty as the JSP serving system. Right now we're taking on a problem another team has created, and investigating how to make a WAR-file version of the Infocenter to be hosted under Tomcat, but our deadline for getting all of this resolved and implemented is the end of this month (9/2008). So, either in Jetty or in Tomcat, is there a way of securing these technologies so that only a user that has a valid PHP session generated within XOOPS and IIS is able to be passed thru to either a Tomcat or Jetty server containing the Eclipse Infocenter system? Our other Tomcat-hosted solution is our own code, provided to us by someone who's no longer with our company, so we can get our fingers dirty with that to an extent (and that's not something I'm asking to be solved here), but we think the solution to this Infocenter dilemma lies in some sort of custom thing we need to write which allows Jetty or Tomcat to act as a doorman, checking some sort of passed credential and disallowing browser access to content if that credential is not somehow "present" as the browser comes across. Like the concept of a referrer, but not as easily spoofable/hackable. Make sense? (frustratedly sips coffee)

None of those in my team are majorly experienced web programmers so we're running madly around the Internet trying to find solutions. Figured the hive mind could help. (crosses fingers and sips more coffee)

Oh, and to answer what might be everyone's next question - we aren't using Apache to serve XOOPS because IIS was on the machine we originally put it on and we felt there was no reason to since XOOPS runs perfectly fine under IIS.

Best CMS for a closed but transparent bid for services website?

Dreama — Wed, 03 Jan 2007 03:33:06 -0800

Best CMS for a closed but transparent bid for services website? Some of you may recall the website for which I'm inquiring, which provided technical and design services to bloggers on a barter, rather than cash basis. We are looking to reopen our site and we're hoping to find a better way of managing things than the combination of blogging software (for news and static info pages) and phpBB setup that we were using prior to shuttering the site (allegedly temporarily) in 2005.

The process, thus far, has been like this:

Clients post a new thread, outlining the work that they're looking for, as an RFP.
Staff respond to the request with bids for the work.
- Staff may choose to take on entire project or only a portion, based upon their availability and skillset.
Client accepts bid(s)
Process then moves mainly to private communication (e-mail, private message via website, IM, phone) between client and staffer(s) working on the project as project is completed.
Staffer(s) post updates on the progress of the project on the public site as a means of maintaining accountability.
At project completion, staffers(s) and client post regarding their satisfaction with work.
Staffer(s) report to administrators when payment for the work is received.
Administrators publicly deem project closed and complete at this time.

The phpBB system worked, but it wasn't as clear as it may have been. Some clients chose to use an "Agent" to negotiate their projects for them because the process (and their needs) were too complex for them to manage on their own. This ended up being a problem because the agent was rarely appropriately compensated for their work on the client's behalf.

The perfect CMS for this probably doesn't exist, but there may be better ideas than what we've got, and that's what I'm asking about. Anybody have any suggestions for applications that may work for us? We've talked about Xoops with some combination of modules, but there are concerns about the need to take a client case from module to module to module (post your request here, talk about it here, etc.). Is anybody aware of anything that might help us to get back to business without the process serving as a stumbling block, especially for net newbies who are turning to us specifically because they need simplicity?

CMS For Newbies

divabat — Fri, 16 Dec 2005 09:31:59 -0800

I'm looking for CMS options for an alumni community site I'm building - one that has the features we want and yet still user-friendly to relative beginners. I've got a few options (Xoops, PhpNuke, Drupal, CivicSpace) but I don't know what to choose. I'm building a crew website for our UWP crew to get together and share information. Part of the website should also be public, with resources for potential and future UWP students.

I've been looking at Xoops, PHPNuke, Drupal, and Civicspace and I'm not entirely sure which one would be the best. I've experimented a little with Xoops and PHPNuke but have heard a lot about Drupal and Civicspace.

My main concern is that it should be user-friendly - the majority of our crew aren't exactly techy, and I don't want to give them too much of a headache just to post an article or a poll question.

These are the features we're considering:

* Some way to designate certain content as "public" (for all visitors) and "private" (for the group only). Right now other alumni sites tend to have a generic password/login thing but that seems a bit archaic (and also blocks the entire site).

* A way to post articles, with categories (and maybe tags)

* A membership system (people can join, have profiles, read group-only content, make content, etc) - perhaps with approval

* Blogs per user (if the member wants them, they can create one)

* Photo/Multimedia gallery

* File repository

* Some form of an updatable contact list

* Calendar of events/birthdates

* Random quote boxes

* The ability to make databases for whatever purpose

* A world map (we come from all over)

* Forums

* Polls

* Donations collection system

* Some way to put adverts (e.g. Adsense)

Which CMS is best for our needs? Which one has easy-to-install modules that provide us with what we want? And, most of all, which is easy for complete newbies?

Thank you!