I have a WordPress site that authenticates against our school’s web-based database system. All users have one set of login credentials set by the system. If you wanted to get in to both systems, while the user/pass is the same, you have to log in to each system individually.
What I’d like is for all of the users log in to our database first. Within the page I want to post a link to subscriber-only portions of WP. Since our database knows the user’s credentials I was thinking that we could format a link to can automatically log them in.
Is this possible to do and if so, how?
Also, is this a secure way of saving the user from having to log in again (assuming that the authenticating link is behind a secure portal)?
You’re describing a single-sign-on solution. There are several good options out there, but they all use the same basic techniques.
Since you already have a PHP environment with your wordpress installation, the easiest would probably be SAML using simplesamlPHP.
You would set it up as an Identity Provider and point it to your database of users (might require some tweaking depending on how passwords are encrypted, but if you were able to get WordPress to use it somehow, then it should be possible)
Both your WordPress site and your “database” (another web app I’m assuming?) would then basically trust the Identity Provider to authenticate users. The process might look a bit different to users, as they would authenticate using a new login form. You could use this plugin for WP, and I’m sure there are others.
The tricky one might be the other app. Unless it’s based on some popular framework, you might have to do some coding to get it to work. SimpleSAMLphp can help you with that again – read up on Service Providers.