0

I am trying to implement a single sign-on solution between a Wordpress and a non-WP site, under different domains. I am aiming to setup a ghost WP install on the non_WP site domain, to be able to load WP in the background, and facilitate cross-domain cookie sharing and authentication

Basically I have setup a fresh install of WP, using the database of my original WP site, and I would like to share the users.

Improve this question

2 Answers 2

Reset to default
1

You're not going to get cross domain cookie sharing working. Browsers will not allow domaina.com to access cookies set for domainb.com and vice versa. Subdomains can share cookies set for the parent domain. So domaina.mydomain.com and domainb.mydomain.com can access cookies set for .mydomain.com

Improve this answer
2
  • Thanks Dave. I am currently investigating some techniques to make the cross domain cookie sharing a reality. I'll keep you posted if it works!
    – jasonmcclurg
    Commented May 25, 2011 at 3:17
  • take a look on how google does it. All of there authentication is loaded with accounts.google.com . it is the same for all there services. Somewhere accounts.google.com is loaded
    – xLRDxREVENGEx
    Commented May 25, 2011 at 16:28
1

Let's say you can get the site on the same domain or work out a way to hand off some kind of authentication token. You don't necessarily need a ghost WordPress installation on the second site.

I'm working on a WordPress site now that complements an existing, non-WordPress site. One of the requirements of the project was that authentication be handled through the non-WordPress site. I created a plugin that bypasses typical WordPress authentication for the WP side.

The plugin has a function attached to the WP init action that when the visitor is not logged in to the WP site and the external auth cookie is present, grab the token and call a service on my non-WP site to validate the token. If the token validates, I force a login for the username the validating service returns to me. From that point on the user is logged in to the WordPress site and no further validation is performed against the external site. If the user does not yet exist for the given username in WP the plugin creates it.

There's some other code in there to redirect to the external site login page instead of the standard WP login.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.