How to log into joomla through an external script?

Question

We have a standalone script on our site that sits adjacent to a Joomla 1.5 installation. We are using Joomla authentication to restrict access to our script. At this point we are redirecting any unauthorized users to the Joomla site to log in. We want to add a login capability within our script, though. Does anyone know how to log into joomla from an external script using a username/password? Thanks!

Enroot

Answer 1

<?php
//http://domain.com/script/script.php?username=username&passwd=password

define( '_JEXEC', 1 );
define('JPATH_BASE', '../' );
define( 'DS', DIRECTORY_SEPARATOR );
require_once('../configuration.php');
require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );
require_once ( JPATH_BASE .DS.'libraries'.DS.'joomla'.DS.'factory.php' );

/* Create the Application */
$mainframe =& JFactory::getApplication('site');
jimport('joomla.plugin.helper');

$credentials = array();
$credentials['username'] = JRequest::getVar('username', '', 'method', 'username');
$credentials['password'] = JRequest::getVar('passwd', '', 'method', 'passwd');

//perform the login action
$error = $mainframe->login($credentials);
$user = JFactory::getUser();
//now you are logged in

$mainframe->logout();
//now you are logged out

Jonell

Perfect! That's exactly what I was looking for. – Enroot

$error = $mainframe->login($credentials); is wrong; should look like $result = $mainframe->login($credentials); – Goebel

Answer 2

For Joomla 3.x below is more clean and helpful. Below codes will does verify hard-coded username and password. If user is existing, it will be redirected to the index.php page.

<?php
/**
 * Joomla! External authentication script
 *
 * @author vdespa
 * Version 1.0
 *
 * Code adapted from /index.php
 *
 * @package    Joomla.Site
 *
 * @copyright  Copyright (C) 2005 - 2014 Open Source Matters, Inc. All rights reserved.
 * @license    GNU General Public License version 2 or later; see LICENSE.txt
 */

if (version_compare(PHP_VERSION, '5.3.1', '<'))
{
    die('Your host needs to use PHP 5.3.1 or higher to run this version of Joomla!');
}

/**
 * Constant that is checked in included files to prevent direct access.
 * define() is used in the installation folder rather than "const" to not error for PHP 5.2 and lower
 */
define('_JEXEC', 1);

if (file_exists(__DIR__ . '/defines.php'))
{
    include_once __DIR__ . '/defines.php';
}

if (!defined('_JDEFINES'))
{
    define('JPATH_BASE', __DIR__);
    require_once JPATH_BASE . '/includes/defines.php';
}

require_once JPATH_BASE . '/includes/framework.php';

// Instantiate the application.
$app = JFactory::getApplication('site');
jimport('joomla.plugin.helper');

// JFactory
require_once (JPATH_BASE .'/libraries/joomla/factory.php');


// Hardcoded for now
$credentials['username'] = 'admin';
$credentials['password'] = 'admin';


// Get a database object
$db    = JFactory::getDbo();
$query = $db->getQuery(true)
    ->select('id, password')
    ->from('#__users')
    ->where('username=' . $db->quote($credentials['username']));

$db->setQuery($query);
$result = $db->loadObject();

if ($result)
{
    $match = JUserHelper::verifyPassword($credentials['password'], $result->password, $result->id);

    if ($match === true)
    {
        // Bring this in line with the rest of the system
        $user = JUser::getInstance($result->id);

        echo 'Joomla! Authentication was successful!' . '<br>';
        echo 'Joomla! Token is:' . JHTML::_( 'form.token' );

    //perform the login action
    $error = $app->login($credentials);
    $logged_user = JFactory::getUser();
    var_dump($logged_user );
    //redirect logged in user
    $app->redirect('index.php');
    }
    else
    {
        // Invalid password
        // Prmitive error handling
        echo 'Joomla! Token is:' . JHTML::_( 'form.token' ) . '<br>';
        die('Invalid password');
    }
} else {
    // Invalid user
    // Prmitive error handling
    die('Cound not find user in the database');
}

Deus

Worked at Joomla 3.4.1 – Honegger

What if the user is already authenticated in this application with another method, then $credentials are not available. Is it still possible to start the joomla session? – Pizzeria

require_once (JPATH_BASE .'/libraries/joomla/factory.php'); this will give you error in joomla 3.9.18. you can delete this line and it will work. – Mesothorium

Answer 3

In Joomla 3.9 recommend using this code.

1- Upload this script to your root folder. Ie public_html or htdocs.

2- Change username and password with yours.

3- Run script in your browser. You will be logged in automatically in site not administrator section(you can change this).

4- Open protected pages.

<?php

define('_JEXEC', 1);

if (file_exists(__DIR__ . '/defines.php'))
{
    include_once __DIR__ . '/defines.php';
}

if (!defined('_JDEFINES'))
{
    define('JPATH_BASE', __DIR__);
    require_once JPATH_BASE . '/includes/defines.php';
}

require_once JPATH_BASE . '/includes/framework.php';

// Instantiate the application.
$app = JFactory::getApplication('site');
jimport('joomla.plugin.helper');

// JFactory
require_once (JPATH_BASE .'/libraries/joomla/database/factory.php');


$result_login = JFactory::getApplication()->login(
                    [
                        'username' => 'demo',
                        'password' => 'demo'
                    ],
                    [
                        'remember' => true,
                        'silent'   => true
                    ]
                );
                
if ($result_login==1) echo 'Login Successful'; else echo 'Invalid Login';
                

Postrider

Answer 4

I would suggest one of the following solutions:

• Write a login plugin specific to your script.
• Using CURL in your script to do a POST-Request on the normal login form (CURL can cope cookies, too.)
• (Simplest): Do not authenticate by Joomla!, but by .htaccess.

Costplus

Answer 5

I have done this and its working just fine. Assuming your custom login script is login.php

-Go to Joomla installation directory
-Copy PasswordHash.php from this directory /root/libraries/phpass/ to your external script's folder 
-Include the PasswordHash.php in login.php 
-Create an instance of PasswordHash like this:

Here is the php code snippet

$phpass = new PasswordHash(10, true);
$password= "unhashed user password";
$db_password = 'Your hashed password in the database'; 
$ok= $phpass->CheckPassword( $password, $db_password );

?>

And there you are --- check password will return true if the two passwords match. NB: You need to write a query to automatically check from the database.

Requiescat