creating single sign-in with scheduling feature

[afmastro]

OK, I really don't mean to abuse this board or break the rules, I have posted this before, but I discovered I posted it in the wronge forum. It was an accident

Disclaimer: I'm new to PHP, mySQL, and Apache. I've been using the OSCommerce shopping cart for a few months. I try to do my homework before posting, and I'm posting because I want to learn the right things and not go down the wronge path and waste valuable time.

Here's the situation: I have an existing OSCommerce shopping cart on my site and would like to add an appointment booking feature on my site. I decided to outsource the appointment booking feature to another company, who will be creating an online scheduling feature on another server. Once this is complete it will be linked to my site.

The challenge is that I do not want visitors to have to register separately for the store and the online appointment booking features.

I asked my appointment booking company if there is any way to integrate my exisiting shopping cart registration with the appointment booking registration. They suggested creating a https request with the POST method. I would put a sting somewhere in one of the OSCommerce documents with a URL and request parameters, which I already know.

The result would be that the visitor would launch the scheduling interface in a new window (on top of my web site). Once a visitor finishes scheduling an appointment, the scheduling interface window would close.

My questions are:

In which document would I put the https request, would it be create_account.php or configure.php? I've discovered that OSCommerce had identically named files in the /catalog/ folder and the /languages/ folder and that /languages/ is for modifying text. I'm guessing that the files I want to modify would not be in the /languages/ folder.

Where would I put this request in the document and what would it look like?

Here's what I do know: I did a search on google with "PHP + post + https" and I got many documents that mentioned this extention called cURL that is to be used with PHP. I found out my hosting service, who provided the OSCommerce shopping cart, does not support cURL yet, but they get many requests for it and might support it in the future. However this doesn't help me now, and I'm hoping there's a work-around for this. You'd think if the host provides OSCommerce, they would support cURL, but what can I do?

I've done a search through these forums with the terms, https and post, and have not found an answer.

I realize posting on this forum is only a starting point. I realize I may be in over my head. Please, please help me

[afmastro]

I went to my php setting page (or whatever it's called) at http://www.thefragrantpath.com/checkcurl.php and this is what they had at the "configure" setting:

./configure' '--prefix=/usr/local/nf' '--enable-exif' '--enable-dbase' '--with-mysql=/usr/local/nf' '--enable-discard-path' '--includedir=/usr/local/nf/include' '--libdir=/usr/local/nf/lib' '--with-zlib-dir=/usr/local/nf' '--with-png-dir=/usr/local/nf' '--with-jpeg-dir=/usr/local/nf' '--with-imagick=/usr/local/nf' '--with-gd' '--with-curl=/usr/local/nf' '--without-xpm' '--without-freetype'

I hadn't seen that bolded information the last time I checked. I contacted my host's tech support and they told me they didn't support curl. I must admit, I don't really understand what a lot of this information means, but I saw the word, "curl" and I got excited.

Ok, either I really stumped everybody or the forum determined, based on my extreme lack of knowledge, that I am beyond help. But I'm not giving up hope that some kind soul out there can help me.

[makemethis]

The problem is above my level of expertise. However, I did enjoy your Notice of Disclaimer and was wondering if it was copy righted or if the rest of us newbies could use it...lol

Good Luck and maybe one of the oscMax Top Dogs will be able to help

[michael_s]

Hi,

cURL can either be compiled into PHP or you can install/compile the command line version of cURL.

From you PHP info page, if you scroll down the page to the curl box, you will see this:

CURL support enabled
CURL Information libcurl/7.11.1 ipv6 zlib/1.1.3

This shows that cURL is compiled into php, but without SSL support, so you are pretty much forced to compile/install the command line version of cURL.

If you don't have SSH/telnet access to your server, you are done. There is no way to get it installed without SSH/Telnet access.

There may be other methods that you can explore with your programmers, but the easiest thing would be to install the command line curl with SSL support.

[afmastro]

makemethis: No, my disclamer isn't copywrited. Sure, be my guest, go ahead and use it.

msasek: Thanks for the information, which is getting me one step closer to my goals. I assume I would check with my hosting company to see if I had SSH/telnet access to the server?

If I do have SSH/telnet access to my server, how would I compile/install the command line version of cURL? Is this something I would do myself or does my hosting company have to do this? Would searching the PHP web site be a good place to start? Thanks again.

[jpf]

Looking at your orginal POST - I have a suggestion..... As long as your outsource company uses MySQL - have them use the same database and table for your USERS name and setup.... Use OSC to setup your users then have your appointment system use this as your login name/password etc.... Alot less for them to code the whole user signup stuff etc......

Even better would be to use OSC's database and ADD a table or two (as long as they are not the same name as an existing table) of there own for there system but then have there own interface if they wish.

The best would to use the OSC as a base for there whole system.....would then have a total intergation into OSC. However then it would be subject to GPL if you or they deside to distrbute any other copies...

[afmastro]

jpf: That idea would make the most sense. Unfortunatly, my outsourced company does not use MySQL

[jpf]

Without that - how would you connect user name/password from system to system..... very hard other wise. That said then - your only choise would to be exporting the user database and importing them into your outsourced project... and visa versa if data is able to be changed on both sides

[afmastro]

I know my outsourced company useses some sort of SQL, but not mySQL.

Honestly, at this point my appointment application is almost complete, and I think it would be costly to get my outsourced company to re-write code.

The conclution I seem to be comming to is that without cURL with SSL support, I'm screwed.

The good news is I learn from my mistakes, and before I even bid on my next project, I'm consulting a programmer right away. I really should have had a programmer on this project from day one.

However this doesn't help me now.

I don't understand why my host would offer cURL without SSL support. I don't even understand why I would need an extension such as cURL to create what I feel should be a simple request.

Right now I'm trying to figure out how to convince my hosting company to add SSL support to cURL. I was going to use them for future projects, but now I'm not so sure. I feel transferring this site to a different host would be expensive at this point since this host required I pay upfront for the year.

This project was going so well, and after I do this, except for some maintenence, it will be completed. My client and I had a good relationshiip, now I'm already past my deadline, and I feel so foolish for attempting this without a programmer.

I never did a project of this magnatude. I thought it would be a managed risk to take this project and learn as I go. I felt I knew enought to still turn out a good web site. I guess I was wronge.

Now I feel so lost and frustrated. On top of everything else, my car broke down. This may seem irrelevant. The point is: I'm having a bad day

I've tried confiding in my family and the response I got was: I should give up this self-employed web design business, and get a "real job" working for someone else. Then I wouldn't have to deal with messes like these. Even if I do that, I still need to follow through on this project. Maybe I am crazy.

I guess at this point, I'm just looking for some positive support and someone to say: "You are not screwed" "There is solution and you will find it" "You can keep your client happy" etc.

I have a huge headach. OK, enough for now...l

[afmastro]

Figuring I had nothing to lose, I did some experimenting. I don't know exactly what I'm doing, but I'm encouraged just to be getting error messages because maybe that will give me some indication of what to do with some help.

In catalog/login.php:

In place of this:
<!-- body_text //-->
<td width="100%" valign="top"><?php echo tep_draw_form('login', tep_href_link(FILENAME_LOGIN, 'action=process', 'SSL')); ?>

I put this:
<!-- body_text //-->
<td width="100%" valign="top">
<?php
// make an https request using POST w_curl
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,"https://app.timetrade.com/tc/autologin.do?");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "url=thefragrantpath&id=00000000CLIENTLOGIN&am p;usr=receptionist&firstname=Jane&lastname =Doe&username=test&password=000000");
curl_exec ($ch);
curl_close ($ch);

echo tep_draw_form('login', tep_href_link($ch, 'action=process', 'SSL'));

I changed some of the CURLOPT_POSTFIELDS for security. I also eliminated some fields here for space. Basically these are request paramaters that use the registration fields. The information in the fields are high level administrative user login information. I'm tryin to access the scheduling application through the osCommerce registration.

When I tested the new script I got this:
404 Not Found
The requested URL /giftcertificate/nfoscomm/catalog/Resource id was not found on this server.

I think this means one of two things:
1. The https request is not communicating with the third-party scheduling server like it should. It is still communicating the the osCommerce server.
2. The id in CURLOPT_POSTFIELDS is incorrect. In that case, all I would need to do is get the correct ID from my vendor. I suspect it isn't that easy but I can hope.

Does anyone have any ideas?

I'm feeling better about this today. My client is still entering in existing appointments so I have more time. Besides, even if visitors must register and sign-in separately to use each feature, it's not the end of the world, and my client would still have many more sophisticated features than they have ever had on their web site. I still think a single registration is better and would still like to do it if at all possible. Thanks again.