Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

My site needs to integrate with a 3rd party software, which will live on its own sub-domain, hosted by the software company. I need to provide the 3rd party developers with an endpoint that they can use to make API calls (to my wordpress site) in order to allow my site's users to access the sub-domain.

The other site needs to authenticate users from my site through some sort of API.

I'm not sure where to start, but my sense is that this has been figured out by people smarter than me. Thanks in advance!

share|improve this question
    
What sort of API calls will be needed? What are you trying to do? Have you looked at WP's XML-RPC support (codex.wordpress.org/XML-RPC_Support) ? –  anu Jul 19 '12 at 0:17
    
The other site needs to verify/authenticate users from my WP site. –  SDP Jul 19 '12 at 13:31
add comment

1 Answer

up vote 5 down vote accepted

Cross-site Scripting Issues

You cannot transfer WP auth cookies between domains. You also don't want to store plaintext passwords for logging into another WP installation programmatically. So, you'll have to have users log into WordPress, and then access their login status via an API endpoint from the third-party site. This lets WordPress handle all the authentication. It is pretty secure as a user will have to physically login to the WP side in order for the API endpoint to serve up the data to the third-party.

Create an API Endpoint

Check out this article I just wrote here: http://coderrr.com/create-an-api-endpoint-in-wordpress/

Also, you can see the code demonstration here: https://gist.github.com/2982319

You'll have to figure out the logic for your own app needs, but this will allow you to create an endpoint where you can serve up anything you want from the WordPress side.

Since you're using WordPress as the authentication site, you can use a check like is_user_logged_in(). If they are logged in, return a user object to the third party with whatever information they need.

Logging in From The Third-Party

From the third-party, they can link to your login page for a seamless experience using the redirect_to query var. Once logged in, it will pass them back to the third-party site.

http://sub.yourdomain.com/wp-login.php?redirect_to=http%3A%2F%2Fwww.third-party-domain.com

Remote Logins

If you need to login users to WordPress from a third-party site, you can use some simple WP functions listed on this site: http://kuttler.eu/code/log-in-a-wordpress-user-programmatically/

You'll definitely need to use a shared secret and create time based hashes off that secret to keep things secure. Basically, here's what it would look like:

Third party sends request with a timestamp and a token generated by a shared secret:

$shared_secret = 'foobar'; //do not send this to the API endpoint
$timestamp = time();
$token = md5($shared_secret.$time_stamp);

WordPress Installation receives the request:

$shared_secret = 'foobar';
$timestamp = esc_attr($_GET['timestamp']);

if((time() - $timestamp) > 30) # Threshold is 30 seconds
    //do something here - TOKEN expired!

$token = md5($share_secret.$timestamp);
$token_to_check = esc_attr($_GET);

if($token == $token_to_check)
    //authenticated!
share|improve this answer
    
Fairly certain that the 3rd party piece of software isn't anything to do with WP, so essentially it's single sign on, but with WP acting as the authentication provider. –  anu Jul 19 '12 at 14:03
    
@anu: That's correct. –  SDP Jul 20 '12 at 14:52
    
@Brian: I'm interested in the idea of switching to a multi-site installation, but I don't fully understand the point you made about the cookies. All that needs to happen is the 3rd party software needs to verify that its user is actually one of my users. The software is otherwise self-sufficient, and can provide its own cookies or whatever. –  SDP Jul 20 '12 at 14:56
    
@Emerson I see now. Sorry for the confusion. You could use the endpoint idea I created and use shared token in user meta for authentication. Return a JSON response to the 3rd-party if the user exists. –  Brian Fegter Jul 20 '12 at 17:18
    
Thanks Brian, I took a closer look and I think I'm starting to understand your solution. Could you show me a little bit of code to exemplify how your plugin would work for my application? I looked at the source code and I'm not 100% getting it. –  SDP Jul 21 '12 at 14:26
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.