I have a wordpress site (lets call it site1) and another site with oauth2 (site2).

When a new user is created, a record is created in both site1 and site2 databases with the same email as username, the typed password hashed in site2 database and a dummy (e.g. "pass") password for site1 database. Then login action authenticates with site2 database using a RESTfull API. If authentication is successful, I want to programmatically log the user in to site1 (wordpress), if not, an error object should be injected to site1.

My question is which wordpress filter is more suitable for this, wp_authenticate_user or wp_authenticate and where should wp_signon fit in?

2 Answers 2


I'm currently working on a plugin to do this on a large scale, since I have multiple sites that I want to sync; but I don't mind sharing the info with you.

I understood [from what you said] that the user's credentials have already been verified on site2 - so there's no need to use any of those functions to verify them again. All you need to do now is create the session on your WordPress site.

This means then that the function you are looking for is wp_set_auth_cookie. It would create the user session without requiring credentials. The function takes the user ID as the first argument, which is most important, and you would fire this before WordPress initiates (like at the top of your functions.php file).

If you want to do this via a web service, I would advise that you use a 2-stage process, for security reasons. First, you could push the user ID to a table storing "authenticated sessions", identifying the user with a unique session ID (some form of hash, of IP, user-agent, etc). In the 2nd stage, you could fire that function as soon as that same person visits the WP website.

The other option is to create a session code on site2, then send the user to site 1 with that code in their hand (query_string, or form post). When they get to site1, a call back to site2 would be used to verify it, and then use the function above to simply create the session.

  • This is good information but unfortunately, it doesn't address the question which "which filter is more suitable" Commented Sep 12, 2021 at 14:19

I think you meant OAuth2 authentication, you also wrote this in the description, you just left out some parts of the process, or you want it differently. But yeah, OAuth2 is a standard protocol for this purpose.

How it is structured and how it works:

On the authentication server website (site2):

There are several types of grant types for this process, the most popular is the Authorization Code grant type, but it is a multi-step process.

If the user is not logged in, the user must go through the WordPress core authentication process. These would be:

wp_authenticate_username_password() function for the authenticate filter, and identified by cookies, which is the wp_validate_auth_cookie() function for the determine_current_user filter. If you want a very unique authentication process, you should use these filters (this is also used by the WordPress application password).

But I think you don't need to change them. You don't need to do anything with these. The functioning of the WordPress core provides everything for authentication.

You must log in the user on the server website. If the user is logged in, you can get the user's data using the following function:

$current_user = get_user_by( 'id', apply_filters( 'determine_current_user', null ) );

You must provide the user's data to the client website.

This process of how to authenticate and then transfer user data between the server and the client is specified in detail in the OAuth2 standard.

On the client website (site1):

If you have already authenticated yourself on the server website (site2 in your example), you do not need to authenticate yourself again on the client website (site1 in your case).

Because in this case, the client website receives authenticated user data back from the server. Based on this user data, you only have to log the user in to the client website:

/** get user id by username */
$user_id = username_exists( $userdata_from_server['username'] );

wp_set_current_user( $user_id );
wp_set_auth_cookie( $user_id );

You need to use these two functions: wp_set_current_user() and wp_set_auth_cookie().

I created an OAuth2 client WordPress plugin that provides a Single Sign On solution: https://wordpress.org/plugins/lana-sso/

Check its source code to see if you can use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.