Wordpress and OAuth - php

Question

I am quite new to wordpress and OAuth. I have two sites. One hosted on the web,and the second one hosted on my local machine. I want to use OAuth in order to login to my local machine site if i am logged in to the other site.
What i managed to do:
I had installed WP OAuth Server on web hosted site and created new client;
On my local machine i wrote the following code using https://github.com/adoy/PHP-OAuth2;
require('vendor/autoload.php');
const CLIENT_ID = 'my client id';
const CLIENT_SECRET = 'my client secret';
const REDIRECT_URI = '';
const AUTHORIZATION_ENDPOINT = '';
const TOKEN_ENDPOINT = '';
$client = new OAuth2\Client(CLIENT_ID, CLIENT_SECRET);
if (!isset($_GET['code']))
{
$auth_url = $client->getAuthenticationUrl(AUTHORIZATION_ENDPOINT, REDIRECT_URI);
header('Location: ' . $auth_url);
die('Redirect');
}
else
{
$params = array('code' => $_GET['code'], 'redirect_uri' => REDIRECT_URI);
$response = $client->getAccessToken(TOKEN_ENDPOINT, 'authorization_code', $params);
$response = (object) $response;
$result = (object) $response->result;
//echo json_encode($result->access_token);
echo "<pre>";
print_r($response);
}
When i run this script i got the following response:
stdClass Object
(
[result] => Array
(
[access_token] => rhfnpz6ifgnjufoq0rby0utphtzpxhrmsytnjh5z
[expires_in] => 86400
[token_type] => Bearer
[scope] => basic
[refresh_token] => lgrklt5kwiv29ch3nmdhhieedjbudg8liv48l6c7
)
[code] => 200
[content_type] => application/json
)
How can i use this access token in order to login to my local hosted site? What i am missing? Thank you!

Answer 1

After you have a response with the access_token you can log the user in without having to accept and process the normal WP email+password flow. Do this by
session the access_token and refresh_token (for future calls to the API Resource endpoint, if any)
call wp_set_auth_cookie() to create a WP session for the user.
You'll want to include in your code a hook for the WP logout where you'll clear the tokens from the session.

Answer 2

OAuth2 Server
Your web-hosted WordPress website needs an OAuth2 server plugin. This is our premium product: https://lana.codes/product/lana-passport/
The OAuth2 server plugin provides the authentication server that is connected to the WordPress user system. It also provides the /authorize, /token and /resource endpoints, to which the client can connect and generate a token, and then use the token to access user data.
Basically, the Authorization Code grant type should be used for this purpose, because it also provides the WordPress login interface if you are not logged in and need to identify yourself. This is the most user-friendly and most popular grant type.
OAuth2 Client
And your local machine-hosted WordPress website needs an OAuth2 client. This is our free product: https://wordpress.org/plugins/lana-sso/
This creates a Single Sign On button for the WordPress login interface, which is connected to the configured OAuth2 server.
How does it work:
If the client went through the authentication process and received the access_token, it requests the user data from the OAuth server at the /resource endpoint.
If the user can be found on the client website based on the user data, the user is logged in using the wp_set_current_user() and wp_set_auth_cookie() functions. If the user is not found and registration is enabled, a new user is created using the wp_insert_user() function on the client website and logged in.
If you want to know more about the OAuth2 process, we have a case study that specifically discusses the single sign on solution for two WordPress websites: https://lana.codes/case-study/oauth2-server-and-client-wordpress-plugin/