We have a WordPress site which we are going to gradually rebuild using the cakePHP framework. We will replace different parts of the WordPress site incrementally, so we need to implement some sort of single sign on to allow authorization across both frameworks during the time while both frameworks are running side by side.
We have a pretty good strategy for how to do this. In short, we will duplicate all user rows in two different tables: one table for WordPress (wp_users) and a different table for Cake (users). [More details outlined here (in case you’re interested).]
This means when we create a user in WordPress or Cake, we create the same user in the other table as well. This is “mostly harmless”…
We are struggling with the different password hashing strategies between WordPress and Cake. In order to save the same user password in both tables, we need to figure out how to hash it so that each respective framework can check it.
WordPress uses a pretty advanced hashing algorithm: PHPass. Cake (by default) seems to offer a choice of more traditional algorithms: SHA1, md5, blowfish… with optional salting.We’re stuck on the fact that WordPress generates/emails a default password to new users and then immediately saves a hashed version in the DB. This hashed version of the password is pretty useless to cake, unless we can figure out how to replicate all of the WordPress authorization protocols (which seems somewhat daunting for new Cake users).
Is there an elegant solution to this problem?
I would suggest to keep user management centralised in either WordPress or CakePHP until the migration to CakePHP is completed.
As of CakePHP 2.3, bcrypt/blowfish is officially supported for hashing passwords;
http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#using-bcrypt-for-passwords
However, if you already have your Single-Sign on working, why not leave the password syncing for the time being? Once migration to CakePHP is complete, consider the following options;