Integrating WordPress to my website, while keeping my own authentication system

Question

I've recently integrated WordPress to my website and I've been trying to find out the correct way to replace Wordpress' authentication system with the one on my website.

My website already has a user database, and the user is authenticated through PHP sessions.

My goal is simply to remove WordPress' integrated register/login form, and make it so users already logged in to my website have access to Wordpress functionalities simply through session_start() (and privileges check). I wouldn't be using Wordpress' user database.

Most informations I found on this topic are mostly about integrating an external database to Wordpress, like the plugin External Database Authentication Reloaded, but very few on how to actually change the way WordPress checks if user is logged in before granting him access.

I would like to properly understand how to allow users logged in my website to get the same privileges as if they were also logged into my WordPress (by checking if $_SESSION['simple_auth'] == true)

I understand that this question has already been asked; I've done some research, but I'm mostly looking for advice on how to do this (or why I should not do this), and some guidelines that might help me.

Answer 1

Is using Auth0 (http://www.auth0.com) maybe an option for you? They have a very good Wordpress plugin.

I think you could integrate your system and do a Single Sign On (SSO) using the plugin.

I think it's a better option for you to do some stuff on your system to integrate (since you know the system and can probably be more productive), using this https://auth0.com/docs/oauth-web-protocol and let the plugin take care of everything on Wordpress.

Answer 2

WordPress's authentication system is made up of pluggable functions, which means that you can write a plugin that has a function named, say, wp_authenticate(), and your site will use your wp_authenticate() function instead of the native WordPress one.

Your comment about is_user_logged_in() (on your original post) is obviated by the fact that is_user_logged_in() calls the pluggable wp_get_current_user(), meaning that you can write your own wp_get_current_user() and control is_user_logged_in() that way.

So you should be able to write an authentication system for WordPress that will use your pre-existing user database.

References

• is_user_logged_in()
• Pluggable functions
• WordPress code reference

Answer 3

Here is an example authentication plugin. It will pull information from your php session variables. This is how to use it:

1. save it into a file mycustom-auth.php
2. modify the constants near the top of the class
3. put it into wp-content/plugins/mycustom_auth or wp-content/mu-plugins
4. enable it in wp-admin
5. log out of WP and log in again. You should see one extra line in the WP login form to take you to your custom authenticator. Click on it, then return to WP to see if you are logged in

/*
   Plugin Name: mycustom Authenticator
   Description: authenticates against custom authenticator which uses php sessions
   Version: 1.0
 */


new mycustom_auth();
class mycustom_auth{
    const AUTH_URL = 'http://domain.com/mylogin.php'; // custom auth url
    const USERNAME = "username"; // php session variable for username
    const EMAIL = "email"; // php session variable for email addreess
    const FIRSTNAME = "first"; // php session variable for firstname - optional
    const LASTNAME = "last"; // php session variable for lastname - optional

    function mycustom_auth() {
        add_filter('authenticate', array($this,'authenticate'), 20, 3);
        add_action('login_form', array($this,'login_form'));
        add_action('login_head', array($this,'login_head'));

        //remove_filter('authenticate', 'wp_authenticate_username_password', 20, 3);
    }

    function authenticate($user, $username, $password) {
        if ( is_a($user, 'WP_User') ) {
            return $user;
        }
        $uid = $_SESSION[mycustom_auth::USERNAME];
        $email = $_SESSION[mycustom_auth::EMAIL];
        $firstname = $_SESSION[mycustom_auth::FIRSTNAME];
        $lastname = $_SESSION[mycustom_auth::LASTNAME];
        if (!isset($_SESSION[mycustom_auth::USERNAME]) || empty($uid)) {
            return new WP_Error('invalid_username', __('Custom Login Error: php session not set.'));
        }
        $user = get_user_by( 'login', $uid); // could get by email address instead
        if (!$user) {
            $user = $this->create_user($uid,$email,$firstname,$lastname);
            if (!$user) {
                return new WP_Error('invalid_username', __('Custom Login Error: You are not currently registered user for this site.'));
            }
        }
        return new WP_User($user->ID);
    }

    function create_user($username,$email,$firstname,$lastname) {
        if ( empty($username) || empty($email)) return null;
        $user_id = wp_insert_user(array('user_login'=>$username,
                    'user_email'=>$email,'first_name'=>$firstname,'last_name'=>$lastname));
        $user = new WP_User($user_id);
        $user->set_role(mycustom_auth::DEFAULT_ROLE);
        return $user;
    }

    function login_form () {
        echo '' . __('Login with Custom', 'custom_login') . '
';
    }

    function login_head() {
        // put custom styling here
    }
}


?>