在PHP中实现单点登录

Question

Can anyone point out what the obvious flaws with this approach would be, as I am sure there will be some...

1. User tries to access restricted area on 'original box'
2. User is not logged in, so is redirected to 'secure box'
3. User logs in via LDAP using SSL & ldaps
4. Session is created on 'secure box'
5. User is redirected back to 'original box'
6. 'original box' does a file_get_contents to session.php on 'secure box'
7. 'secure box' checks for valid session, and if present returns username and some extra info as xml (obviously no password info)
8. 'original box' uses xml to create local session
9. User is allowed to progress through protected area with each page view checking 'secure box' for valid session

Answer 1

I don't get why you use file_get_content(); instead of include/require.

Why do you need to get the content of "session.php" at all? Couldn't you simply use $_SESSION['myVar']; to get the session infos you need?