I've been searching and searching. (not just here) The closest I've found is this: SSO / authentication integration with external 'directory service'
But it assumes both sites are on the same domain, so they can share a cookies, and the post is 7 years old. Otherwise I think it's close.
Thinking out loud here
A user in the authoritative system clicks on a button.
That button saves some sort of one time key locally, (kept only a few seconds) along with the user ID and timestamp, and also passes the key and ID to the WP site on an endpoint URL.
The endpoint on the WP server recontacts the main site's authentication API, to confirm accuracy, and if valid, receives a password hash and user_id that it has stored for the user on the wp site.
Test if user exists by using wp_authenticate()
- If so, login via wp_set_current_user(), wp_set_auth_cookie() and do_action('wp_login', id)
I'm thinking out loud at this point because I've not done this before, and my client hasn't given me all the authentication I need to get started yet.
I've found very little info on this, so I figured I'd document my plans, and what changes I need to make to carry them out.