How is user session managed if using the facebook login?

Sure. It actually works using the Joomla authentication and login protocols, so there shouldn't be an issue there, but of course, it is pulling data from elsewhere, which may cause some (easily overcomeable) issues. We haven't tested widely with synchronization plugins, so will need your help (and feedback) through this.

First, ensure that the plugins fire in the correct order.
* For Authentication, if your sync plugin fires, make sure it's after both the Joomla and JFBConnect authentication plugins
* For User, make sure that the ordering is Joomla then JFBConnect, then your sync plugin. Other plugins in between each of these is fine, as long as the chain is maintained.

The user plugin is what provides the Username, Full name, and other information back to the Joomla store in the session. We don't override or manipulate session data directly.

Finally, not sure if you're using "Create New Users" set to yes or no. If yes, the FB user should be treated exactly like a Joomla user. If no, things like password don't exist, since you're authenticating to only an external source (FB). Not sure if your synchronization relies on a password being present, but this could be part of the problem.

Let us know if this explanation helps and/or leads to more questions. Would love to get you going so we can say "Successfully tested with synchronization plugin XXX"

Thanks!

Alright, I gotcha. The authentication plugin for JFBConnect actually works by passing your FB API key as the username and FB Secret key as the password. This is done because Facebook doesn't give us a username or password to work with. Once authentication starts, we look up the currently logged in FB User's ID, see if they're in the usermap table, if so, get the Joomla ID for that user, and log them in.

So, I'm assuming you have an authentication plugin that's looking for these username/password values... Hmmm. Even if you can get the correct Joomla ID from the user map, there's no way to get the user's password from the database to use in the 'other' sites to log in. The database has a hash of the password, not the passwords themselves.

Going to have to think about what can be done to help you. A user plugin would be able to fire and grab the username during 'onLoginUser', and from that, you could trigger some events on the other sites to log the user in. The big thing to watch out for is security and ensuring that there's no way someone could circumvent the system to log in as someone else.

Hope this little rambling helps you come up with ideas as well, but unfortunately, no direct solutions here.