title: PHP OpenSSO Authentication
body: <p>We are currently implementing a new OpenSSO Server. The server is on a different server from the web server and I am having trouble getting authentication to occur on our PHP Web server.</p>
  
  <p>The cookie set with the openSSO Token is called iPlanetDirectoryPro. This is set from authServer.company.com . I need to read this from webserver.company.com and then send an HTTPRequest to the authserver.company.com to retrieve the attributes for that OpenSSO Token.</p>
  
  <p>Currently my code looks like this but it isn't working, I suspect due to not correctly reading the cookie.</p>
  
  <pre><code>$url = 'http://authServer.company.com:8080/opensso/identity/attributes';
  $r = new HttpRequest();
  $r-&gt;setURL($url);
  $r-&gt;setMethod(HTTP_METH_POST);
  $valarray = array(
      'Host' =&gt; 'authServer.company.com',
      'Content-Type' =&gt; 'application/x-www-form-urlencoded',
      'Cookie' =&gt; "iPlanetDirectoryPro=$_COOKIE[iPlanetDirectoryPro]"
      );
  $r-&gt;addHeaders($valarray);
  var_dump($r);
  var_dump($valarray);
  #
  # request
  #
  print "&lt;br/&gt;";
  print "&lt;b&gt;what i'm saying to the server&lt;/b&gt;";
  print "&lt;pre&gt;";
  #print "iPlanetDirectoryPro cookie: $_COOKIE[iPlanetDirectoryPro]";
  print $r-&gt;getRawRequestMessage();
  print "&lt;/pre&gt;";
  
  print "iPlanetDirectoryPro cookie: $_COOKIE[iPlanetDirectoryPro]";
  $r-&gt;send();
  
  #
  # response
  #
  print "&lt;b&gt;what the server is telling me&lt;/b&gt;";
  print "&lt;pre&gt;";
  $response_body = $r-&gt;getResponseBody();
  print $response_body;
  print "&lt;/pre&gt;";
  </code></pre>
  
  <p>Any ideas about this? Am I going about this in the wrong way?</p>
  
  <p><strong>Update</strong> - So the bottom line I found was the server simply couldn't read the cookie as it was coming from another server. As a work aronud I implemented a REST API that allows the user to submit a login page from the webserver. Its send to the AuthServer which gives back a response. The response should typically be a token unless its invalid. If its a token, a new cookie is created with the token in it so that applications can then use that token to communicate with the authserver, but the cookie resides under the webservers domain</p>