I have a lot of legacy sites written mainly in CodeIgniter. I was to be able to issue something to those sites that says they have access to a new Laravel site.
I want to setup a global site account on the Laravel site, so if you can login to one of the legacy sites, you can click a link to automatically be logged into the Laravel site with the legacy sites global account.
What would be the best way of handling this? I was thinking about creating an encrypted string made in the Laravel site and store it in the configuration of the legacy sites. The legacy site would then just pass that back to the Laravel site and it gets decrypted. Would this be secure? Should there be some kind of encryption/decryption on both ends?
Yes, I think you will need to create an encrypted token that legacy knows how to create and Laravel app knows how to decode.
Then pass this token to the user's browser as part of a link to the Laravel site. The token should be lifetime limited to keep the user's account safer.
The user then clicks on the link and it passes the token into Laravel.
If the Laravel application can decrypt the token and it references a user then log that user in manually.
OR
Implement Laravel passport using a so that the legacy app holds a passport authentication
The user would still need a user account on Laravel and authenticate to it the first time, but then passport would pass a token back to the legacy application for that user to use in the future.
I was hoping to not have to generate on the legacy side, but that was kind of my thinking as well.
Basically, the Laravel site functions as an addon to the older sites. If enabled, I create an account on the Laravel site that links to the old site. Anyone that can login to the old site can passthrough to the Laravel site with that single account.
