Magento API: Customer Authentication

CATEGORIES: Magento, PHP, Programming

After managing a Magento store for a few months I quickly realized that while it does have a CMS module – it is no CMS solution. The existing CMS module in Magento only allows for basic page creation, has no menu management, it’s difficult to integrate a wysiwyg editor and it just makes managing content a royal pain. While that may be sufficient for a store with only a few content pages, if you need to build out your content or want to implement any social functionality it becomes clear that Magento is only a store and shouldn’t handle your content. Even Varien has made it clear that they are focusing on the store and they're are not going to try and make Magento fit every need out there. However, Verian is focusing on the API and they already have a broad range of API methods to suit many needs.

One thing I love about Magento is that it is built for expandability. If some functionality is missing out of the box, you can build a custom module to twist the system to your whim. What’s missing in the API? Customer authentication. I’ve just begun looking at integrating Drupal with an existing Megento install where I want to use the existing store’s user base. The first step to a single-sign-on solution is to have a user login via Drupal using the Magento customer’s username and password, then upon successful login to also be logged into the store as well.

After a little experimentation with creating a custom module with the API functions that I want, I came up with the following model which allows a customer to login from an external source. This can authenticate against the store's user base and set the session authentication for the store so when the customer lands on a store page, they are already logged in.

The key to make it work is to pass a frontend session id to the api. 
http://www.host.com/store/api/xmlrpc?SID=xdfs48a79x548b1531ab6c96632
class Namespace_Module_Model_Customer_Api extends Mage_Api_Model_Resource_Abstract
{
    /**
     * Customer Session
     *
     * @var Mage_Customer_Model_Session
     */
    private $_session;
 
    public function __construct() 
    {
        // Change to the default store so we 
        // can grab the frontend user session
        Mage::app()->setCurrentStore('default');
 
        // Get the customer session
        $this->_session = Mage::getSingleton('customer/session');  
    }
 
    /**
     * Login Customer
     *
     * @param string $email 
     * @param string $password
     * @return boolean
     */
    public function login($email, $password)
    {
        return $this->_session->login($email, $password);
    }
 
    /**
     * Logout Customer
     *
     * @return void
     */
    public function logout()
    {
        $this->_session->logout();
        return;
    }
 
    /**
     * Check if customer is logged in
     *
     * @return boolean
     */
    public function isLoggedIn()
    {
        return $this->_session->isLoggedIn();
    }
 
    public function __destruct()
    {
        // Change back to the admin store in case 
        // there is any clean up done on postDispatch
        Mage::app()->setCurrentStore('admin');  
    }
 
}

In reality it is a basic model, but it can handle my basic authentication needs. The catches are that you need to pass the frontend session id to the API via the SID variable on the URL. You can grab this from the cookie variable and if one doesn't exist, create one. Also, in the model you must switch to the default store since the API controller runs on the admin store. I do this in the constructor and I'm sure it could be setup to handle multiple stores but my needs are simple right now.

I've omitted the module configuration files, but if you need help getting setup you can check out the api documentation. The next step is to implement a module in Drupal to utilize the API functions (done, can post details if needed). And lastly to set a session for Drupal when a user logs in via Magento.