A client has an EE2 site and wants us to setup a 3rd party app but keep it private to EE members only. How would you extend EE's member sessions to provide single sign on with a 3rd party PHP app?
The app is made up of multiple PHP files and has it's own interface. So, it won't be easy to extract into a custom plugin or module.
We thought about using an iFrame to load the app into an EE page that is for members-only, but it wouldn't be hard to get the iFrame's source URL and hit it directly, bypassing the security.
Now we're considering building a custom module that provides an EE authentication API via action ID. So, we'd create a simple is_logged_in() function that is used in the custom PHP app that sends the value of the EE session cookie to our API and the custom module would determine if it's a valid session or not. If it's not a valid session, the custom app would redirect to our EE login page.
Are there any other ideas we should consider?
Assume for this exercise that the app runs on the same server as the EE site.