0

This issue is related to an 'alternative' setup using 2 wordpress sites but 1 users table. The initial setup is summarised below:

  1. 2 separate WP instances on same domain aaa.localtest.me + bbb.localtest.me
  2. Create views on DB bbb to DB aaa users table and users_meta table
  3. Add cookie domains to wp_config.php and match AUTH_KEY, SECURE_KEY etc values
  4. define CUSTOM_USER_TABLE to point to the view created in DB bbb

enter image description here

The reasons for this are beyond the scope of the question. (please no references to Multisite)

Success. I can login on site A and the function is_user_logged_in() picks up a valid cookie. So effectively a single authentication point on site aaa is used to authenticate on site bbb. Small check on 'init' action on site bbb can redirect to aaa login if not logged in.

So far so good. ISSUE when trying to access admin: function user_can_access_admin_page() returns true and then false somewhere between 'init' and 'wp'...

function checkOCAdmin(){
    //$userLoggedIn = is_user_logged_in();
    //echo 'INIT Action: Not admin yet: '.var_export($userLoggedIn, true);

    if ( is_admin() ) {
       $canAccess = user_can_access_admin_page();
       var_dump($canAccess);
     }
}
add_action('init','checkOCAdmin');
add_action('wp','checkOCAdmin');

The result is in 'init' is TRUE but wp is never reached and error:

Sorry, you are not allowed to access this page.

I've isolated this to a file /wp-admin/includes/menu.php that has this code triggered.

if ( ! user_can_access_admin_page() ) {

    /**
     * Fires when access to an admin page is denied.
     *
     * @since 2.5.0
     */
    do_action( 'admin_page_access_denied' );

    wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 );
}

So, Why is the value of the function TRUE on init and at some point during the event lifecycle this changes to false? Related: Are there any other tables that require attention when setting capabilities (e.g. wp_options) that may be causing a conflict with auth? e.g. if userID on site aaa = 1 but the original userId of bbb = 2, is there an issue when alias/remapping the users table and meta?

2
  • NOTE: by 'no references to multisite' I mean that using multisite as a solution is not an option for these sites.
    – JI-Web
    Dec 1, 2023 at 2:39
  • After a VERY long time I've deduced that the issue is with the user_meta table of DB aaa and the TABLE_PREFIX values in that table. Copying the aaa.capabilities meta_key record and adjusting the 'wp_capablilities' granted access to admin. TBC as there are many other hacks.
    – JI-Web
    Dec 6, 2023 at 3:18

1 Answer 1

0

So, Why is the value of the function TRUE on init and at some point during the event lifecycle this changes to false?

The answer to this (and effectively the question) is to do with WP Capabilities.

  1. Firstly: Certain WP functions are available at different times in the action cycle ( https://codex.wordpress.org/Plugin_API/Action_Reference )
  2. Secondly: The cookie works and does pickup the correct user/ID and role (administrator) so is_user_logged_in() and is_admin() are available.
  3. Thirdly: The capabilities are not defined because of the difference in WP Table Prefix.

The solution to this problem is to make sure capabilities are set correctly. This means that the TABLE_PREFIX needs to be mapped for each user referencing the second database.

This action is performed on DB aaa (the primary/first) acting as the authenticator.

Table aaa.PREFIXA_user_meta => meta_key='PREFIXA_capabilities'
Copy this Row and re-label the meta_key to PREFIXB_capabilities'

This effectively allows admin access to those users linked on aaa.

Notable links that helped get to the answer:

https://stackoverflow.com/questions/30112158/wordpress-wp-admin-you-do-not-have-sufficient-permissions-to-access-this-page

https://stackoverflow.com/questions/70792336/wordpress-dashboard-sorry-you-are-not-allowed-to-access-this-page-after-movi

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.