Using a SOAP session id to bypass the login page on the web interface

This is the easiest and is also widely documented. We simply achieve a SOAP login and with the obtained session id we call the SOAP "seamless_login" method. Then we just need to pass the session id to the URL of the desired SugarCRM page as parameter, named "MSID". Ok, it's easier to show than to explain, so here is some sample code:

1:<?php    

2:require_once("path_to_nusoap/nusoap.php");    

3:$server_url = "http://your_sugar_server/soap.php?wsdl";    

4:$credentials = array(    

5:    'user_name' => 'username',    

6:    'password' => md5('password')    

7:);    

8:$sugar_client = new soapclient($server_url, TRUE);    

9:$proxy = $sugar_client->getProxy();   

10:if (!$proxy) {   

11:        // do something in case of error   

12:}   

13:$result = $proxy->login($credentials, 'your_application_name');   

14:$session_id = $result['id'];   

15:$result = $proxy->seamless_login($session_id);   

16:header( "Location: http://your_sugar_server/index.php?module=Contacts&action=index&MSID={$session_id}";   

17:?>  

You need to customize to your needs: "path_to_nusoap","username","password","your_application_name","your_sugar_server".
On line 8 we instantiate a soap client, and on line 9 we obtain a proxy from it. We use the proxy on line 13 to do a soap login and, if nothing goes wrong, we'll get back a valid session_id (line 14).
If we now pass the session id to the soap method "seamless_login"(line 15), we are automatically authenticating to the web interface, so at this point we can directly point to a sugar page by just appending an "MSID" parameter (valued with our session id) to a normal sugarcrm url. Just make sure that the page(module/action) we are trying to access is one the user whose credentials we've used to login is allowed to see.
This has been easy, now let's face the opposite situation.

Getting a SOAP session id by logging in to the web interface

I've searched around a bit but have had no luck in finding a clear and immediate recipe for this. If someone has been more lucky, please let us know.
The solution I'm currently using is a bit tricky, but it seems to work. Basically, when sugarCRM authenticates a web interface user, we can at the same time create a SOAP session_id and put it in th $_SESSION array for using it during the session lifetime.
In this case I've just put some code in the "modules/Users/authenticate.php" file.  The point of the file where to put the code depends on the installed SugarCRM version, but it's usually quite easy to spot, as it is at the beginning of an "if" block checking if the login has been successful. In my case there's a line:

          if ($focus->is_authenticated)

in other cases (more recent SugarCRM versions) I've seen something like:

          if(isset($_SESSION['authenticated_user_id']))

Now, the code to add is not very different from the one used before. We need to get a soap session id using the same credentials SugarCRM has just used to authenticate the user to the web interface. In this case though, we'll use the nusoap library included in SugarCRM which has some little differences. Here is the code:

    2:require_once("include/nusoap/nusoap.php");    

3:$server_url = "http://your_sugar_server/soap.php?wsdl";    

4:$credentials = array(    

5:    'user_name' => $_REQUEST['username'],    

6:    'password' => md5($_REQUEST['password'])    

7:);    

8:$sugarClient = new nusoapclient($server_url, TRUE);    

9:$proxy = $sugarClient->getProxy();   

10:if (!$proxy) {   

11:        // do something in case of error   

12:}   

13:$result = $proxy->login($credentials, 'your_application_name');   

14:$_SESSION['soap_sessionid'] = $result['id'];