I've been searching and searching. (not just here) The closest I've found is this: SSO / authentication integration with external 'directory service'

But it assumes both sites are on the same domain, so they can share a cookies, and the post is 7 years old. Otherwise I think it's close.

Thinking out loud here

  • A user in the authoritative system clicks on a button.

  • That button saves some sort of one time key locally, (kept only a few seconds) along with the user ID and timestamp, and also passes the key and ID to the WP site on an endpoint URL.

  • The endpoint on the WP server recontacts the main site's authentication API, to confirm accuracy, and if valid, receives a password hash and user_id that it has stored for the user on the wp site.

  • Test if user exists by using wp_authenticate()

  • If so, login via wp_set_current_user(), wp_set_auth_cookie() and do_action('wp_login', id)

I'm thinking out loud at this point because I've not done this before, and my client hasn't given me all the authentication I need to get started yet.

I've found very little info on this, so I figured I'd document my plans, and what changes I need to make to carry them out.

Thank you!

  • Depending on what type of sign-on is used on the non-WP site, there are a variety of plugins to allow authentication outside of WP. Specific plugin recommendations aren't on topic here, but if you can first identify what type of SSO - i.e. CAS, LDAP, Open Auth, etc., you can then search the plugin repo and most likely find something already coded that will continue to be supported after the site is built. :) – WebElaine Aug 24 '18 at 13:53
  • I recommend you ask this question on Server Fault, it's too broad to be WP specific. But what you are describing sounds like OAuth. If you google that you'll find a ton of info on it. – Dan Gayle Aug 28 '18 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.