A plugin for MuWeb Online (Slim Framework 3). It adds a “Login con TuServerMU” button, links a player's existing game account by email, or provisions a new MEMB_INFO account the first time, and logs them in. It reuses MuWeb's own database connection and session, so it respects your config. Tested end-to-end and working on a real MuWeb Online + MSSQL install.
Drop-in route files for your routes/ folder. Install in minutes.
Open Account → OAuth apps and create a Confidential app with redirect URI:
https://your-site.com/ssocallback
Copy the files into your MuWeb routes/ folder:
routes/tsm_sso_config.php routes/tsm_sso_lib.php routes/ssologin.php routes/ssocallback.php routes/ssosetup.php
Then add these lines in routes/load.php, just before $app->run();:
include 'ssologin.php'; include 'ssocallback.php'; include 'ssosetup.php'; $app->run();
Edit routes/tsm_sso_config.php:
'client_id' => 'YOUR_CLIENT_ID', 'client_secret' => 'YOUR_CLIENT_SECRET', 'redirect_uri' => 'https://your-site.com/ssocallback', // must match exactly 'password_mode' => 'plain', // or 'md5' (MuWeb's dbo.MWO_hashmd5)
In your active template (e.g. templates/default/login.html and register.html):
<a href="{{link_dir}}ssologin" class="btn btn-primary">Login con TuServerMU</a>
/ssologin - sends the player to TuServerMU (Authorization Code + PKCE)./ssocallback - validates state, exchanges the code, reads the profile. If the email matches an existing MEMB_INFO account it logs them in; otherwise it goes to setup./ssosetup - the player picks a game username and password (≤10 chars); the account is created with bloc_code = 0 and they're logged in.The TuServerMU master password (bcrypt + 2FA) never touches your database. The game password is a separate, low-value MEMB_INFO secret the player controls.
Questions? [email protected] · Full OIDC docs