Allow logged in WordPress user to access 3rd party Laravel API via OAuth

Question

I have a unique situation that I'd love some help with if possible:

My company manages a lot of WordPress sites. Each site has its own unique set of users (same users throughout all sites, but some only access X, others access Y, others both X&Y, etc). We use a custom SSO plugin to manage all that, with permissions and the like, which all works perfectly.

I've built an app in Laravel, that has both public and private routes. I use Laravel Passport/OAuth to access the private routes. Everything on that front works perfect, also.

However, I am now posed with the situation where I need to have the WordPress users access some protected routes of my API, without asking them to login to the API separately.

I know a lot of the interest in WP/OAuth is basically the opposite to my situation, where people want to login to WordPress with an OAuth service provider (Twitter/Google/LinkedIn/etc), not the other way around.

Both the API and WordPress sites are hosted on completely different architecture, and no means to access one or the other's database.

What I'm looking for is a straightforward way for my WordPress users to "Authorize" themselves on my API, without needing to maintain two sets of the same users. Ideally, the WordPress user would not necessarily be created in the API, but I use audit logs to track who does what in the API, so being able to determine who did what would be great.

Any help, or experience from people in a similar boat would be great!

Answer 1

I approached this slightly different for those interested.

I wanted to keep my API as light as possible, and not bloat it with versions/revisions and users, so ended up creating a 2nd Laravel instance.

On this 2nd Laravel instance (consumer) we used Laravel Socialite as we already use Google as SSO provider. The user logs in, this is where the user interacts with my API. All actions being logged on the consumer, keeping it out of my API DB.

For consumer -> API communication, I installed Laravel Passport on my API and use the password_client and store a password token on the consumer and use Guzzle behind the scenes in my consumer to talk to my API.

I created a WordPress plugin to add a link to the consumer app in the WordPress admin menu. I tried to place Google's SSO/OAuth login page in an iFrame, due to domain mismatching, it's not possible.

It works pretty good right now! I would love to do make convert most of it into WordPress plugin, but I don't want to store my bearer/auth tokens in the plugin as they can be edited/viewed by the user.