0

I have a Java Web App which contains users. On the other side, I have a wordpress installation.

I have a requirement that users from my java app should be also avaible in wordpress (in other words: I need to authorize in Wordpress users with credentials from my Java App).

Since I'm Java developer and have only very basic knowledge of Wordpress I was looking for some appropriate plugin. I did some research and found 2 things:

  1. I have found something called Keyring
  2. I've also spotted this Set up WP Authentication from External API SE Thread regarding authorizing ussers from externall sources

However, in both cases some php deveopment sould be done.

My question is, if there is any other way in Wordpress side to configure external user authentication but without developing anything? Or the way by using Keyring or/and writing own filter is the right one?

What's is important I want to keep this mechanism simple because it will be working only internally.

2

any other way in Wordpress side to configure external user authentication but without developing anything?

No. The only authentication WordPress provides out of the box is cookie based authentication.

There are however plugin based solutions, specifically ones that rely on widely accepted standards that aren't unique to WordPress. These implement standardised authentication protocols such as:

  • Oauth1, you can use this with the REST API to authenticate from Java
  • Oauth2, like Oauth1 you could use this, I'd recommend this over OAuth1, assuming your site uses SSL/TLS/Https
  • SAML, you could authenticate with a SAML provider, and use that instead of WP to handle your accounts, and install a WP plugin to make WordPress use the SAML provider too
  • JWT, avoid if possible for security reasons, not just in WP, it's attractive but fundamentally flawed, I mention it for completeness
  • Basic Auth, the simplest but least secure option
  • Basic Auth with Application Passwords, marginally more secure than basic auth, but not as easy to build a nice UI around
  • Rolling your own, you could implement a REST API endpoint or two to handle user login and registration, but this is a very bad idea. There's a reason people who figured this out wrote standards such as OAuth or SAML, think of it like rolling your own cryptography, unless you have a degree in the subject you'll build something insecure with bugs, not worth the hassle

Note that these protocols are not WordPress protocols, but general standards used across numerous pieces of software.

As an example, I have a CLI application that requires the user to be authenticated, using a WordPress site to store data/users/etc. In order to login the application uses OAuth1 to communicate with WordPress and exchange details.

For your Java application, you could communicate with WordPress via OAuth2 to authenticate your user, perhaps even show an inline dialog showing a login form to approve.

The REST API

You'll want to authenticate and communicate with the REST API, allowing easy JSON based communication with the WordPress site. This should simplify things, and provide data in a machine readable fashion that Java is happy to read and process. It'll also allow you to use common libraries to communicate with WordPress instead of building the API requests from scratch

Or the way by using Keyring or/and writing own filter is the right one?

This isn't a single problem, if you pick a standard then you can break this apart into a pure WP problem, and a pure Java problem. You'll get 100x as many results for implementing OAuth2 client in Java than you would for logging into WP with Java. The same for logging into WP with OAuth2.

However, Java questions are not in this stacks scope ( try stack overflow ), neither are plugin recommendations ( there's a software recommendations stack ).

|improve this answer|||||
  • Ok thanks for the answer - one note, that I have my users in Java App and I want the to login in WP (you answer suggested the opposite way) – PastorPL Jan 24 at 15:00
  • On the contrary, users can login from the app, but the app can use a number of methods to authenticate with the WordPress installation. For example, I have a CLI tool that requires login, and it uses OAuth1 to do so, I know of other tools that use OAuth2 to login. If your goal is to allow users to register and login without ever even knowing WordPress is involved, that's something else, and not what you originally asked ( be careful that what you meant and what you said are the same thing ). If registration is needed, that can be handled as a related problem ( but not the same ) – Tom J Nowell Jan 24 at 16:10
  • Still i think i’m beeing missinderstood. I don’t want WP handle users, on contary. I want WP to ask my Java app for users and if possible - synchronize them, so if in my Java app i delete user then they won’t be able to login in WP. – PastorPL Jan 25 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.