0

I want to connect two sites which are not on the same domain and allow uses to be logged in to both, by logging in to only one site.

I found a huge number of topics and plugins but most of them deal with the subdomains of one parent domain (site1.domain.com and site2.domain.com) which is not what I want.

Both sites will be on the same server, so accessing the database from either of them won't be a problem.

I am thinking of the custom plugin which will do the following:

When a user is logged to one site, generate a hash, store in DB, redirect to the other domain/sso with an ID and if the IDs match, login there as well and redirect back to the first site. This way I will avoid all browser troubles with cross domain cookies and iframes/other hacks. From security point of view, all hashes will expire in 1 minute so automatic (brute force) check of IDs will be impossible. I can even mix it with an IP address and cookie/session to make it more secure.

My questions are:

  1. What is the best approach for this? Is there an existing solution for what I am trying to do?
  2. Is there a plugin I should use?

Thanks!

Improve this question
6
  • Why don't you simply set up a multisite and then point one domain to subsite A and the other one to subsite B?
    – kaiser
    Commented Oct 13, 2012 at 13:07
  • Thanks for your response. I didn't understand completely - if I setup the sites as subsites in a multi install, would that automatically enable the single login for both sites?
    – Aram Boyajyan
    Commented Oct 13, 2012 at 18:03
  • Afaik only if your users are users on both blogs. But there's some possibility to import them from one blog to the other. Maybe there'are answers about "Multisite MU network user import".
    – kaiser
    Commented Oct 13, 2012 at 18:06
  • Users will be automatically synchronized between the sites through a custom plugin; that part isn't a problem. The sites already exist so merging into a multisite install will be done only if that will bring something in regards to SSO. My biggest question at this point is how to allow them to login to both sites at the same time automatically. I guess I will elaborate more my initial idea and post here the summary and what I did (if no other answers show up in the meantime). Thanks for your responses!
    – Aram Boyajyan
    Commented Oct 15, 2012 at 15:34
  • Take a [look at this answer and tell if it fulfills your needs. If yes, please report back, so we can close this question.
    – kaiser
    Commented Oct 15, 2012 at 15:44

1 Answer 1

Reset to default
1

Solution: two (same) custom plugins on both sites.

Workflow to be triggered on successful login:

  • generate hash and save in DB; expires after 30/60 seconds
  • save initial destination
  • redirect to the other site with ID; make necessary checks there - hash, IP etc.
  • if everything is OK, login the user programmatically
  • redirect back to the initial destination

This way all the cross domain issues will be avoided as the user will be literally sent to the other site; + there will be no hacks with iframes.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.