We have a WordPress application which is going to be linked with a parent system. We want to use JWT for authenticating with the parent. The idea is, if the user is not logged in on the parent, he should not be allowed to access the WordPress site (only the front end, always, dashboard is strictly for the admin). If the user tries to access the WordPress application via a bookmark or history, we will need to send him to the parent site for logging in. There will be no API calls made to the parent site, except for authentication, since the WP app has its own data. This brings me to the questions.
- Is JWT suitable for our situation?
- How would I integrate it with WordPress?
- Will I need to modify WP's native authentication system to make it work with JWT?
My current approach is this: A user logs in to the parent system, and follows the link to the WordPress site. The JWT token will be sent as a post request to the WP site. I will parse the request, using probably the
init action, and get the WP specific username and password from it. I will then set the token with an expiry time (is it really required?) and I will log the user in. If the user tries to access the application via a bookmark or history, I will redirect him to the parent site.
Is this the correct way? Is there a better way? I am happy to provide more information if required.