WordPress.org

Ready to get started?Download WordPress

Forums

[resolved] external authorization and rememberme (2 posts)

  1. dmeiser
    Member
    Posted 3 years ago #

    Any auth mechanism requiring the user to navigate away from WordPress (eg - OpenID, Facebook Connect, Google Profile, etc) causes POST variables to be lost. Therefore, when wp_signon is called, POST is empty and rememberme is non-existent.

    I've checked both Janrain Engage and the OpenID provider. Neither implement rememberme and, as a result, only remember a login for the length of the session. I've submitted a patch for the OpenID provider that implements this, but it's very cludgy.

    With that said, it seems that it would be better to have one of the following options:

    1. change wp_set_auth_cookie to a filter
    2. have wp_signon check alternate locations
    3. call wp_signon with pre-hashed passwords contained in the credentials array

    Here's further detail:

    Number 1:

    The quickest method, it seems, is to do exactly what I did - tack the value of rememberme onto a return URL (or store it in a SESSION variable). This necessitates overriding wp_set_auth_cookie. The only line from my patch that is different from wp_set_auth_cookie as found in pluggable.php is line 861.

    This is why I say a filter would be better. This way I can still override wp_set_auth_cookie with my function, determine if rememberme is set, and then call wp_set_auth_cookie as found in pluggable.php.

    Number 2:

    This might be a terrible idea for security. I haven't thought it through from a security standpoint. But, it still allows for a simpler solution that overriding wp_set_auth_cookie in order to change a single line.

    Number 3:

    Since OpenID, Facebook Connect, et al, don't require the user to enter a password on our WordPress site, we never have the password in plaintext. This is problematic because wp_signon currently expects a plaintext password.

    What I could have done was to send the user's pre-hashed password and then hook the wp_authenticate filter before wp_check_usernamepassword to see if the password was pre-hashed and return the user if the hashes matched. If the password wasn't hashed, I would call wp_check_usernamepassword and return that value.

    This is fine, but there are 2 problems with this method:

    1. it seems like a lot of overhead to hook wp_authenticate just to get the value of rememberme
    2. bug #15473 blocks this

    Summary

    So, my question is, what would people think of any of these options? Is there a better way to accomplish this?

  2. dmeiser
    Member
    Posted 3 years ago #

    Nevermind this post.

    What I actually want to have happen is to do this with pluggable functions:

    my_override_function( var1, var2 ) {
    if ( some_other_var ) var2 = some_other_var;
    wp_pluggable_function( var1, some_other_var );
    }

Topic Closed

This topic has been closed to new replies.

About this Topic

Tags

No tags yet.