我可以将 phpBB 用作“假”吗？身份识别提供商？
我有很多用户在 phpBB 论坛上拥有帐户。
我希望他们能够在新网站上重复使用他们的用户名和密码。
所以计划是，如果我在我的应用程序中查找用户名/密码，并且它丢失了，我想调用 phpBB 上的一个页面，它会告诉我：
- 如果用户名/密码有效
- 用户的电子邮件地址。
我还希望 phpBB 端的页面能够防止暴力攻击。
理想情况下，我希望我的解决方案能够开箱即用，而无需在 phpbb 论坛上部署其他文件，这样我的解决方案将能够重复使用任何 phpbb 密码。
为了获得额外的好处，我允许我的用户使用电子邮件或密码进行身份验证，理想情况下也应该允许这样做。
有没有办法在不改变 phpBB 的情况下实现这一点？
如果没有，有任何示例实现吗？
I have a lot of users that have accounts on a phpBB forum.
I would like them to be able to re-use their username and password on a new website.
So the plan is that if I look up a username/password in my app, and its missing, I would like to call a page on phpBB that will tell me:
- If the username/password is valid
- The email address of the user.
I would also like the page on the phpBB side to protect against brute-force attacks.
Ideally I would like my solution to work out-of-the-box without having to deploy additional files on the phpbb forum, that way my solution will be able to re-use any phpbb passwords.
For an added bonus I allow my users to authenticate with either email or password, ideally this should be allowed as well.
Is there any way to achieve this without changing phpBB?
If not, any sample implementations?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以直接访问 phpBB 数据库吗？如果是这样，您的独立身份验证脚本可以简单地根据该数据库验证密码，就像根据您自己的内部数据库验证密码一样。
这样，phpBB 代码就完全无关紧要，除非他们在未来的版本中从根本上改变其身份验证方案（这似乎不太可能），并在不同的 phpBB 安装中重用您自己的代码（这听起来像是您想要的）您只需要配置相应的数据库连接信息。
Do you have direct access to the phpBB database? If so, your standalone authentication script could simply validate passwords against that database in the same manner you'd validate them against your own internal database.
That way, the phpBB code is completely irrelevant, unless they radically change their authentication scheme in a future release (which doesn't seem particularly likely), and to reuse your own code with a different phpBB installation (which it sounds like you want) you need only configure the appropriate database connection information.
如果您有权访问特定 phpBB 所依赖的数据库，您可以完全绕过 phpBB 文件并访问 phpBB 的用户表（从安全角度来看很可怕，但如果这是一个可信的东西并且一切都是一致的，那么就可以这样做-有能力的）。
除此之外，您可以尝试制作一个插件或以某种方式扩展身份验证，以使您自己的用户 API 能够从您的站点进行访问。
If you have access to the DB that the specific phpBB rides on, you could bypass the phpBB files altogether and access the user tables of phpBB (scary from a security stand point, but if this is a trusted thing and all is cohere, then do-able).
Other than that, you can try to make a plugin or extend the authentication somehow to make your own user API to access from your site.