php - Automatically login user to PHPMyAdmin -

i'm writing webhosting control panel our organization, , able automatically login user phpmyadmin.

1. user logs in out control panel
2. user clicks "manage databases"
3. user gets redirected phpmyadmin , automatically logged in

what best way this?

of course don't want save our users' control panel account passwords in our database in plain text.

i don't think there way without knowing set of username , password. in end phpmyadmin middleware connect session database.

as far know, phpmyadmin not have own user table. tries login database credentials provided. if successful, stores credentials in cookies, although encrypted. that's why phpmyadmin asks blowfish secret in config file, store credentials more securely.

what closest can want built-in phpmyadmin, see http://wiki.phpmyadmin.net/pma/auth_types on single sign-on.

auth_type signon feature allow phpmyadmin integrate single sign-on (sso) systems. administrators can configure phpmyadmin installations mysql username , password existing sso session, allowing user sign in once control panel, example, , switching between applications such phpmyadmin without need log in again.

to me create new user each of user account e.g. user called foo might have sso-only account called foo_mysql. store foo_mysql , password (encrypted) database. when user tries access phpmyadmin admin portal, sign them on "signon" auth type setup described in http://wiki.phpmyadmin.net/pma/auth_types#signon.

a more secure way (but still have own doubt) create temporary sso-only account when needed. example, generate new random foo_4f65ca1d each time user requests access phpmyadmin admin portal. send new credentials on phpmyadmin.

once have passed phpmyadmin, phpmyadmin manages credentials usual phpmyadmin way. when user logs out portal, delete temporary user. or set scheduled task delete them after set period (probably period in sync phpmyadmin session length).

this way account behaves pretty user session. don't have store credentials, plaintext or encrypted in database.

i'm no security expert here hope fire off discussion or other more secure solutions.