7

I want a login system which authenticates users from web services.The steps should be as follows:

  1. We have some member web sites (Outside of WordPress server). Each member website has its corresponding blog which are hosted on different servers.

  2. We have the web service to fetch the correct authentication from member web sites.

  3. I want the functionality so that when someone who is not logged in a member web site and tries to access a corresponding blog then he should be redirected to a custom login page.

  4. Someone already logged in a member web site can access the blog.

  5. The wp-admin will work as it is. So someone goes to http://www.example.com/wp-admin then he can login with their WordPress database credentials.

I am trying to create a plugin. The code I tried so far:

add_action('wp_head', 'load_login_page');

function load_login_page(){

    if(!isset($_COOKIE['login_token'])) {
        echo $_COOKIE['login_token'];
        wp_redirect(home_url('login'));
       //exit;
    }
}

// this action is executed just before the invocation of the WordPress authentication process
add_action('wp_authenticate','checkTheUserAuthentication');

function checkTheUserAuthentication() {

    if ( ! is_admin() ) {
        $username=$_POST['log']; 
        $password=$_POST['pwd'];
        echo $_COOKIE['login_token'];

        // try to log into the external service or database with username and password
        //$ext_auth = try2AuthenticateExternalService($username,$password);
        //echo "<pre>"; print_r($ext_auth); echo '</pre>'; 
        // if external authentication was successful
        $ext_auth[0] = 'success';
        if($ext_auth[0]=='success') {

            // find a way to get the user id
            $uname = explode('@',$username);
            $user_id = username_exists($uname[0]); 
            // userdata will contain all information about the user
            //$userdata = get_userdata($user_id);
            //$user = wp_set_current_user($user_id,$username);

            // this will actually make the user authenticated as soon as the cookie is in the browser
            //wp_set_auth_cookie($user_id);
            $path = parse_url(get_option('siteurl'), PHP_URL_PATH);
            $host = parse_url(get_option('siteurl'), PHP_URL_HOST);
            //$expiry = strtotime('+1 month');
            $expiry = time() + (60 * 1);
            setcookie('login_token', $ext_auth[0], $expiry, $path, $host);
            // the wp_login action is used by a lot of plugins, just decide if you need it
            do_action('wp_login',$userdata->ID);
            //determine WordPress user account to impersonate

            // you can redirect the authenticated user to the "logged-in-page", define('MY_PROFILE_PAGE',1); f.e. first
            header("Location:http://executiveboard/audit-blog");
            return 'success';
        }
    }
    else {
        echo 'I am at admin';
        header("Location:http://executiveboard/audit-blog/login");
        return 'fail';
    }
}

function try2AuthenticateExternalService($username, $password){
     require_once realpath (__DIR__ . '/sbws.php');
     $lSbws = new SBWS\Sbws (__DIR__ . '/use/config.ini');
     $svcLogin = $lSbws->getwebservice ('login');
     try
     {
        $post_data = array ('user_name' => 'sumsood@executiveboard.com', 'password' => 'gudda@123', 'remember_login' => false);
        $result  = $svcLogin->setdata ($post_data)->loginUsingUsrPwd ();
     }
     catch (SBWS\Sbws_Login_Exception $e)
     {
         echo "received " . $e->getMessage () . PHP_EOL;
         $result = false;
     }
    
     //echo __FILE__ . ' ' . __LINE__ . '<pre style="text-align: left;">';       print_r( $result); print '</pre>'; // DEBUG-HANS
     return $result; 
}
  • Any body have an idea? – Xing Lee Apr 21 '14 at 5:18
  • You have not asked a question. Please try breaking large pieces of functionality like this down into smaller chunks, and provide details of the errors or problems you encounter. – Andrew Jan 12 '18 at 16:00
  • 2
    Ouch. 4 years for one sharp comment. – Matthew Brown aka Lord Matt Sep 2 '19 at 0:11
1

If I were you, I would look at solutions with Federated Identities. For example OpenID solutions. This link has a lot of examples of implementation on PHP. Advantages: open source, secure protocols, clear documentation

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.