Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have just started to read on OAuth as I need to integrate it within a WordPress web app. As per my understanding of OAuth, signed requests are sent between the client and the server. These signed requests are what authenticates a user/client with the server.

WordPress being a stateless application handles authentication via cookies that are sent with every request. Upon receiving the cookies with the request, WordPress automatically sets up the current user. Thus we can use conditionals like current_user_can() or user object like $current_user within the code for various user capability checks and other user actions.

A client (like an iPhone app) when authenticated via OAuth would not store or send cookies and would expect authorised access via OAuth. Since, there is no transfer of WordPress authentication cookies, WordPress would not set the user up during such requests. I'm aware that I could use wp_set_current_user() to do the same. But I'm not sure whether I need to do that OR should I do that OR my entire understanding of using OAuth with WordPress is flawed? Please help me understand how OAuth could be seamlessly integrated into vanilla WordPress environment? Also, I'm not looking for any existing plugins to do the job.

share|improve this question
    
Your question doesn't make a lot of sense. You say "A client ... when authenticated via OAuth", but WordPress does not have any support for OAuth, and cannot do authentication via OAuth. So you'd either need: An existing OAuth provider plugin, or to write a plugin that provides OAuth authentication support. In which case, I don't understand what your question actually is. Are you asking how to do proper authentication with WordPress via a third-party system, or what? –  Otto Jun 26 '13 at 17:14
    
I guess I missed the point that I plan on integrating with one of the many OAuth Providers available. Like the one here github.com/php-loep/oauth2-server. I understand the question appears to be a bit vague and that's essentially because of my not good understanding of OAuth. Once after integration of the library and once a client negotiate a authorisation with the OAuth server, how would authentication happen on WordPress side. –  John Jun 26 '13 at 17:27
    
But if you're using somebody else as the provider, then you're not really authenticating to WordPress. Sorry, but I still don't understand the fundamental question here. "Authentication" means that you've proven to the system that you are some person. WordPress has two methods of authentication: username+password or auth-cookie. If you want to add some other means of authentication, then you need to write extra code to do it, or use a plugin that has the code to do it. You cannot "authenticate" via a means that isn't in the code, somewhere. –  Otto Jun 26 '13 at 17:30
    
What exactly do you mean by "Once after integration of the library"? Integration of a library = writing a plugin for it. If that's what you're planning to do, then I'd highly recommend actually not doing that and using some existing plugin to do it instead. This sort of thing is tricky, and you don't want to roll your own, especially without a deep understanding of OAuth and authentication to begin with. –  Otto Jun 26 '13 at 17:33
    
@Otto I was still writing the comment when I accidentally pressed return. Please see my edit to the comment. The PHP OAuth library would be part of WordPress install and would generate Consumer and Secret keys just how Twitter does it if you want to access Twitter API. Post that the client iPhone app can access the authorisation URL and negotiate access/request tokens. This all would be done by the php OAuth Library. Once this authorisation has succeeded on the library side what additionally needs to be done on WordPress side to recognise the authorization and allow access. –  John Jun 26 '13 at 17:39
show 1 more comment

1 Answer

Okay, after your comments, I think I see what you're asking but I'm not sure, so I'll make it as generic as possible.

WordPress uses the authenticate filter hook to perform authentication. You can add additional authentication methods by connecting your own functions to this filter.

This is an example of an authentication function. This is a dangerous and dumb example, because it just logs you in as user 1 without any checks at all, but it shows what you need the function to return to authenticate a user.

add_filter('authenticate', 'myplugin_auth_example', 30, 3);
function myplugin_auth_example($user, $username, $password) {
    // if user is already known, return it
    if ( is_a($user, 'WP_User') ) { return $user; }

    // do your authentication via whatever method here
    // bottom line is that you need to get a valid WP_User object and return it

    // this example just gets user number 1 from the database and uses that
    // NOTE: this here is extremely dangerous and stupid, because it just logs everybody in instantly
    $user = new WP_User(1); 
    return $user;

    // if there is an error in authentication, you could do this instead    
    return new WP_Error( 'some_bad_auth_reason', 'Your credentials were invalid.' );

}
share|improve this answer
    
This gives me a starting point. Now I must ask whether the authenticate filter hook runs only when user signs in via wp-login.php OR does it run during every subsequent WordPress load when subsequent authentications is handled via WordPress authentication cookies? –  John Jun 26 '13 at 18:00
    
WordPress operates in a stateless manner, it does not have "sessions". So yes, the authenticate filter runs on every connection. There is a function hooked to authenticate to have username/password, and another one to handle auth via the cookie. If you added a third one, it would run every time too. –  Otto Jun 26 '13 at 19:09
    
Thanks for help @otto. I'll keep this question as unanswered until I test things out to confirm whether this is working as intended. –  John Jun 28 '13 at 11:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.