I have just started to read on OAuth as I need to integrate it within a WordPress web app. As per my understanding of OAuth, signed requests are sent between the client and the server. These signed requests are what authenticates a user/client with the server.
WordPress being a stateless application handles authentication via cookies that are sent with every request. Upon receiving the cookies with the request, WordPress automatically sets up the current user. Thus we can use conditionals like
current_user_can() or user object like
$current_user within the code for various user capability checks and other user actions.
A client (like an iPhone app) when authenticated via OAuth would not store or send cookies and would expect authorised access via OAuth. Since, there is no transfer of WordPress authentication cookies, WordPress would not set the user up during such requests. I'm aware that I could use
wp_set_current_user() to do the same. But I'm not sure whether I need to do that OR should I do that OR my entire understanding of using OAuth with WordPress is flawed? Please help me understand how OAuth could be seamlessly integrated into vanilla WordPress environment? Also, I'm not looking for any existing plugins to do the job.