คู่มือการไมเกรท SSO-Authen เข้ากับเว็บแอปพลิเคชัน (PHP, Node.js & WordPress)

<?php
/**
* SSO User Handler - Template for PHP 5.6
* - Enhanced with comprehensive error handling
*/

// Enable error logging
error_reporting(E_ALL);
ini_set('display_errors', 0);
ini_set('log_errors', 1);
ini_set('error_log', __DIR__ . '/sso_error.log');

require_once __DIR__ . '/sso_config.php';
header('Content-Type: application/json; charset=utf-8');

try {
    // Verify API secret
    $api_secret = null;
    if (!empty($_SERVER['HTTP_X_API_SECRET'])) {
        $api_secret = $_SERVER['HTTP_X_API_SECRET'];
    } elseif (!empty($_SERVER['HTTP_AUTHORIZATION'])) {
        if (preg_match('/Bearer\s+(\S+)/', $_SERVER['HTTP_AUTHORIZATION'], $m)) {
            $api_secret = $m[1];
        }
    }

    if ($api_secret !== SSO_API_SECRET) {
        error_log('SSO User Handler: Unauthorized access attempt');
        http_response_code(401);
        echo json_encode(array('error' => 'Unauthorized'));
        exit;
    }

    $input = file_get_contents('php://input');
    $data = json_decode($input, true);
    $normalized = isset($data['normalizedUser']) ? $data['normalizedUser'] : null;

    if (!$normalized) {
        error_log('SSO User Handler: Missing normalizedUser in request');
        http_response_code(400);
        echo json_encode(array('error' => 'Missing normalizedUser'));
        exit;
    }

    $sso_id = isset($normalized['id']) ? $normalized['id'] : null;
    $email = isset($normalized['email']) ? $normalized['email'] : null;
    $name = isset($normalized['name']) ? $normalized['name'] : null;

    if (!$sso_id || !$email) {
        error_log('SSO User Handler: Missing id or email');
        http_response_code(400);
        echo json_encode(array('error' => 'Missing id or email'));
        exit;
    }

    // Connect to DB with error handling
    $conn = mysqli_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME);
    if (!$conn) {
        error_log('SSO User Handler: DB Connection Error');
        http_response_code(500);
        echo json_encode(array('error' => 'DB connection failed'));
        exit;
    }
    
    // Set charset to UTF-8
    mysqli_set_charset($conn, 'utf8mb4');

    $table = 'staff'; 

    // Find existing user
    $q = "SELECT id, staff_email, staff_name, sso_id, " . SSO_ROLE_COLUMN . " as user_role
          FROM $table WHERE staff_email = ? OR sso_id = ? LIMIT 1";
    
    $stmt = $conn->prepare($q);
    if (!$stmt) {
        error_log('SSO User Handler: Prepare Error');
        http_response_code(500);
        echo json_encode(array('error' => 'Database query preparation failed'));
        exit;
    }
    
    $stmt->bind_param('ss', $email, $sso_id);
    if (!$stmt->execute()) {
        error_log('SSO User Handler: Execute Error');
        http_response_code(500);
        echo json_encode(array('error' => 'Database query execution failed'));
        exit;
    }
    
    $res = $stmt->get_result();
    $user_role = SSO_DEFAULT_ROLE;

    if ($res && $res->num_rows > 0) {
        $row = $res->fetch_assoc();
        $user_id = $row['id'];
        $user_role = $row['user_role'] ? $row['user_role'] : SSO_DEFAULT_ROLE;

        $uq = "UPDATE $table SET sso_id = ?, staff_name = ? WHERE id = ?";
        $ust = $conn->prepare($uq);
        if ($ust) {
            $ust->bind_param('ssi', $sso_id, $name, $user_id);
            $ust->execute();
        }
    } else {
        $iq = "INSERT INTO $table (sso_id, staff_email, staff_name, " . SSO_ROLE_COLUMN . ") VALUES (?, ?, ?, ?)";
        $ist = $conn->prepare($iq);
        if ($ist) {
            $ist->bind_param('ssss', $sso_id, $email, $name, SSO_DEFAULT_ROLE);
            if ($ist->execute()) {
                $user_id = $conn->insert_id;
                error_log('SSO User Handler: New user created - ID: ' . $user_id);
            } else {
                error_log('SSO User Handler: Insert Error');
                http_response_code(500);
                echo json_encode(array('error' => 'Failed to create new user'));
                exit;
            }
        }
    }

    $stmt->close();
    $conn->close();

    // Return user object with role information (PHP 5.6 doesn't support JSON_UNESCAPED_UNICODE constant)
    $response = json_encode(array(
        'id' => (string)$user_id,
        'email' => $email,
        'name' => $name,
        'role' => $user_role
    ));
    
    // Manually handle UTF-8 for Thai characters in PHP 5.6
    echo $response;

} catch (Exception $e) {
    error_log('SSO User Handler Exception: ' . $e->getMessage());
    http_response_code(500);
    echo json_encode(array('error' => 'Internal server error', 'message' => $e->getMessage()));
}
?>

<?php
/**
* SSO Callback - PHP 5.6 (firebase/php-jwt v5)
* - Enhanced with comprehensive error handling
*/

// Enable error logging
error_reporting(E_ALL);
ini_set('display_errors', 0);
ini_set('log_errors', 1);
ini_set('error_log', __DIR__ . '/sso_error.log');

try {
    require_once __DIR__ . '/sso_config.php';
    session_start();

    $jwt = isset($_GET['token']) ? $_GET['token'] : null;
    if (!$jwt) {
        error_log('SSO Callback: No token provided');
        die('No token provided');
    }

    $payload = null;
    if (file_exists(__DIR__ . '/vendor/autoload.php')) {
        require_once __DIR__ . '/vendor/autoload.php';
        try {
            // V5 Syntax
            $decoded = \Firebase\JWT\JWT::decode($jwt, SSO_JWT_SECRET, array('HS256'));
            $payload = $decoded;
        } catch (Exception $e) {
            error_log('SSO Callback JWT Error: ' . $e->getMessage());
            die('Invalid token: ' . $e->getMessage());
        }
    } else {
        $parts = explode('.', $jwt);
        if (count($parts) !== 3) {
            error_log('SSO Callback: Invalid JWT format');
            die('Invalid JWT format');
        }
        $payload = json_decode(base64_decode(str_replace(array('-', '_'), array('+', '/'), $parts[1])), true);
        if (!$payload) {
            error_log('SSO Callback: Invalid JWT payload');
            die('Invalid JWT payload');
        }
    }

    // Normalize payload
    if (is_object($payload)) {
        $payloadArr = (array)$payload;
    } else {
        $payloadArr = $payload;
    }

    // Extract user data
    $data = isset($payloadArr['data']) ? $payloadArr['data'] : null;
    
    // CRITICAL: Convert object to array to prevent "Cannot use object as array" error
    if (is_object($data)) {
        $data = (array)$data;
    }
    
    if (!$data || !is_array($data)) {
        error_log('SSO Callback: Invalid data object');
        die('Invalid JWT payload (missing or invalid data object)');
    }

    $user_id = isset($data['id']) ? $data['id'] : null;
    $username = isset($data['email']) ? $data['email'] : null;
    $display = isset($data['name']) ? $data['name'] : null;
    $user_role = isset($data['role']) ? $data['role'] : 'user';  // Fallback to 'user' if role not provided

    if ($user_id === null || $username === null || $user_id === '' || $username === '') {
        error_log('SSO Callback: Missing user data - ' . print_r($data, true));
        die('Invalid JWT payload (missing user id or email in data)');
    }

    // Set session keys compatible with legacy app
    $_SESSION['LOGIN'] = 1;
    $_SESSION['USERNAME'] = $username;
    $_SESSION['USER_ID'] = $user_id;
    $_SESSION['USER_NAME'] = $display;
    $_SESSION['USER_ROLE'] = $user_role;
    $_SESSION['SSO_JWT'] = $jwt;

    // Log successful login for debugging
    error_log('SSO Callback Success: User ' . $user_id . ' logged in');

    $redirect = isset($_SESSION['original_url']) ? $_SESSION['original_url'] : 'manage/index.php?Login=True';
    unset($_SESSION['original_url']);
    header('Location: ' . $redirect);
    exit;
    
} catch (Exception $e) {
    error_log('SSO Callback Exception: ' . $e->getMessage() . ' at ' . $e->getFile() . ':' . $e->getLine());
    die('Error processing SSO login: ' . $e->getMessage());
}
?>

-- สร้างตาราง users ใหม่สำหรับการรองรับ SSO โดยเฉพาะ
CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    sso_id VARCHAR(100) UNIQUE NOT NULL, -- เก็บ ID จาก SSO
    email VARCHAR(100) NOT NULL,         -- เก็บ Email จาก SSO
    name VARCHAR(255),                   -- เก็บชื่อแสดงผล
    user_role VARCHAR(50) DEFAULT 'user',-- เก็บสิทธิ์ (user, admin, manager)
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

สำหรับ API หรือ SPA (ไม่ต้องใช้ express-session)

npm init -y
npm install express jsonwebtoken axios dotenv body-parser mysql2

require("dotenv").config();
const express = require("express");
const jwt = require("jsonwebtoken");
const app = express();

// No Session Middleware needed for Stateless

// 1. User Handler (Same as Stateful)
app.post(process.env.APP_USER_HANDLER_URL, express.json(), async (req, res) => {
// ... Sync User Logic ...
res.json({ id: "1", role: "user" });
});

// 2. Callback (Stateless)
app.get(process.env.APP_CALLBACK_URL, (req, res) => {
const token = req.query.token;
try {
    jwt.verify(token, process.env.SSO_JWT_SECRET);
    
    // แทนที่จะเก็บ Session, เรา Redirect กลับไปที่ Frontend พร้อม Token
    // Frontend จะต้องดึง Token จาก URL ไปเก็บใน localStorage เอง
    res.redirect(`/?token=${token}`);
} catch (err) {
    res.status(400).send("Invalid Token");
}
});

app.get("/", (req, res) => {
// Simple Client-Side Logic to handle Token
// Escaped Script tags
res.send(`
    <script>
    const urlParams = new URLSearchParams(window.location.search);
    const token = urlParams.get('token');
    if(token) {
        localStorage.setItem('jwt', token);
        window.history.replaceState({}, document.title, "/"); // Clean URL
    }
    
    const storedToken = localStorage.getItem('jwt');
    if(storedToken) {
        document.write("Logged in with Token! <button onclick='localStorage.removeItem(\\"jwt\\"); location.reload()'>Logout</button>");
    } else {
        const loginUrl = "${process.env.SSO_LOGIN_URL}?client_id=${process.env.SSO_CLIENT_ID}&redirect_uri=${process.env.APP_BASE_URL}${process.env.APP_CALLBACK_URL}";
        document.write("<a href='" + loginUrl + "'>Login with PSU SSO</a>");
    }
    </script>
`);
});

app.listen(3000, () => console.log("Stateless Server running on port 3000"));

สำหรับการใช้งานจริง แนะนำให้ใช้ PM2 เพื่อจัดการ Process

# ติดตั้ง PM2 (ครั้งแรก)
npm install -g pm2

# รันเซิร์ฟเวอร์ด้วย PM2
pm2 start server.js --name "sso-gateway"

# ตั้งค่าให้รันอัตโนมัติเมื่อรีบูต
pm2 startup
pm2 save

# ดูสถานะ
pm2 status
pm2 logs "sso-gateway"