I want a login system which authenticates users from web services.The steps should be as follows:

  1. We have some member web sites (Outside of WordPress server). Each member website has its corresponding blog which are hosted on different servers.

  2. We have the web service to fetch the correct authentication from member web sites.

  3. I want the functionality so that when someone who is not logged in a member web site and tries to access a corresponding blog then he should be redirected to a custom login page.

  4. Someone already logged in a member web site can access the blog.

  5. The wp-admin will work as it is. So someone goes to http://www.example.com/wp-admin then he can login with their WordPress database credentials.

I am trying to create a plugin. The code I tried so far:

add_action('wp_head', 'load_login_page');

function load_login_page(){

    if(!isset($_COOKIE['login_token'])) {
        echo $_COOKIE['login_token'];

// this action is executed just before the invocation of the WordPress authentication process

function checkTheUserAuthentication() {

    if ( ! is_admin() ) {
        echo $_COOKIE['login_token'];

        // try to log into the external service or database with username and password
        //$ext_auth = try2AuthenticateExternalService($username,$password);
        //echo "<pre>"; print_r($ext_auth); echo '</pre>'; 
        // if external authentication was successful
        $ext_auth[0] = 'success';
        if($ext_auth[0]=='success') {

            // find a way to get the user id
            $uname = explode('@',$username);
            $user_id = username_exists($uname[0]); 
            // userdata will contain all information about the user
            //$userdata = get_userdata($user_id);
            //$user = wp_set_current_user($user_id,$username);

            // this will actually make the user authenticated as soon as the cookie is in the browser
            $path = parse_url(get_option('siteurl'), PHP_URL_PATH);
            $host = parse_url(get_option('siteurl'), PHP_URL_HOST);
            //$expiry = strtotime('+1 month');
            $expiry = time() + (60 * 1);
            setcookie('login_token', $ext_auth[0], $expiry, $path, $host);
            // the wp_login action is used by a lot of plugins, just decide if you need it
            //determine WordPress user account to impersonate

            // you can redirect the authenticated user to the "logged-in-page", define('MY_PROFILE_PAGE',1); f.e. first
            return 'success';
    else {
        echo 'I am at admin';
        return 'fail';

function try2AuthenticateExternalService($username, $password){
     require_once realpath (__DIR__ . '/sbws.php');
     $lSbws = new SBWS\Sbws (__DIR__ . '/use/config.ini');
     $svcLogin = $lSbws->getwebservice ('login');
        $post_data = array ('user_name' => '[email protected]', 'password' => 'gudda@123', 'remember_login' => false);
        $result  = $svcLogin->setdata ($post_data)->loginUsingUsrPwd ();
     catch (SBWS\Sbws_Login_Exception $e)
         echo "received " . $e->getMessage () . PHP_EOL;
         $result = false;
     //echo __FILE__ . ' ' . __LINE__ . '<pre style="text-align: left;">';       print_r( $result); print '</pre>'; // DEBUG-HANS
     return $result; 
  • Any body have an idea?
    – Xing Lee
    Apr 21, 2014 at 5:18
  • You have not asked a question. Please try breaking large pieces of functionality like this down into smaller chunks, and provide details of the errors or problems you encounter.
    – Andrew
    Jan 12, 2018 at 16:00
  • 2
    Ouch. 4 years for one sharp comment. Sep 2, 2019 at 0:11

1 Answer 1


If I were you, I would look at solutions with Federated Identities. For example OpenID solutions. This link has a lot of examples of implementation on PHP. Advantages: open source, secure protocols, clear documentation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.