So, as a followup to parts 1 and 2, per WordPress Trac ticket #7001, WordPress 2.6 has split up the login cookies into three parts:
- what was the one and only login cookie in 2.5 is now limited to /wp-admin
- there’s a copy of that one that’s just limited to /wp-content/plugins, for backward compatibility with plugins
- there’s a new cookie that is at COOKIEPATH (which can be defined in your config file), that is checked by calling
is_user_logged_in()
(but perhaps this isn’t intended for secure authorization?)
So, it appears the way to go may be to change
auth_redirect()
to
-
if (!is_user_logged_in()) auth_redirect();
Maybe more to follow on this when I’ve more thoroughly explored it.
Comments 7
you seem to know alot about wordpress cookies and hoping you can help me and the rest of wordpress community that wants to do this tweak!.
currently have two wordpress running on a single database with different prefix and shared user tables.
1st blog is on http://www.example.com and second is on http://www.example.com/directory/
is there anyway i can make it so if i logon to example.com it logs me on to directory automatically? thus = single signon?
Posted 01 Oct 2008 at 12:48 am ¶@jc min:
I’m assuming, given that you commented on this post, that you’re using WP2.6.x in both blogs. The best I can think of off the top of my head (given that it’s 1am) is more or less along the lines of my solution to the issue of integrating bbPress 0.9.0.2 with WP2.6.x–that is, use a carefully-crafted plugin in both installs that sets and clears the appropriate cookies for the other install.
The setting-cookies end is easier, since there’s an action hook, whereas the clearing-cookies bit requires overriding a pluggable function.
If this makes some sense to you and you’re interested in trying it, follow up with another comment and I’ll dig out the details.
Hi, this is just what I was looking for!!! Thanks
Now, Im working on the other site to have authentication based on my blog, what would I need to be able to use WPs comment system on this other site? Just copy my themes comments file?
I know that since the other sites articles or posts arent inside wp that could be a problem, what whould you suggest?
Posted 01 Oct 2008 at 6:00 pm ¶@maski:
I don’t really know much about the inner workings of the comment system. I haven’t tried to use it outside of WP at all. At a guess (without looking at the code at all), I’d suspect that comments are tied to entries by some sort of entry id number and trying to integrate that with non-WP pages could be problematic.
I don’t know the details of your implementation, but it might be easier to use WordPress as the core of the whole site, use pages for whatever you had outside WP that you wanted comments on, and then add in whatever else you want.
Well.. i was afraid about that. My second guess is to build a custom comments syst only using wp authentication.
Thanks
Posted 02 Oct 2008 at 10:50 am ¶Once a WP user is authenticated, is there a session variable that the scripts can use to identify the user? (i.e., to grab user specific data from the db)
Posted 12 Mar 2009 at 7:02 pm ¶@roberto
What I’ve done where I tied into WP authentication is:
require_once('/path/to/wp-config.php'); if (!is_user_logged_in()) auth_redirect(TRUE); $wp_user_record = wp_get_current_user(); $username = $wp_user_record->user_login;That is to say, I’ve done it by including WordPress’s functions and calling wp_get_current_user() to get the user record and go from there.
Given the username, there are certainly ways to go about extracting info from the database directly (which avoids the memory usage of loading up all of WP) and I think you can get the username from the cookies themselves (you’d have to have your scripts know about the WP cookie name stuff), but once you start tying into the system at that kind of lower level, the risk of major headaches on WP upgrades increases substantially.
Trackbacks & Pingbacks 1
[...] to someone’s website, but WordPress 2.6 is starting to give me a headache. I’ve already posted thrice about issues with integrating an external site into WP2.6’s user authentication. Honestly, [...]