从现有WordPress实例登录其他实例的可行性及实现方法咨询

Absolutely, this is totally achievable—this is exactly what Single Sign-On (SSO) is designed for, even across separate WordPress instances. Here are the most practical ways to pull this off, depending on your technical comfort level:

1. 用现成的SSO插件（最快最省心） #

This is the go-to approach for most folks, since it avoids custom code and leverages battle-tested tools. Here's how to set it up:

• Step 1: Configure your front-end WordPress as the Identity Provider (IdP)
  Install a reputable SSO plugin like WP Single Sign On (SSO) on your front-end site. In the plugin settings:
  • Enable "IdP Mode"
  • Generate a secure secret key (keep this safe—you'll need it for all other sites)
  • Add the URLs of all your regional WordPress instances to the "Allowed Service Providers" list
• Step 2: Set up each regional site as a Service Provider (SP)
  Install the same SSO plugin on every regional WordPress site. Configure each one:
  • Enable "SP Mode"
  • Enter the full URL of your front-end IdP site
  • Paste the same secret key you generated on the front-end
  • Toggle on "Auto-Login" so users are signed in automatically when they visit the regional site after logging into the front-end
• Step 3: Test the flow
  Log into your front-end site, then navigate directly to any regional site—you should be logged in instantly without re-entering credentials.

2. 自定义开发（适合需要完全控制的场景） #

If you want to avoid third-party plugins or need custom logic (like syncing specific user roles or metadata), you can build a custom SSO flow using WordPress's native hooks and REST API:

• Step 1: Create a validation endpoint on the front-end IdP
  Add a custom REST endpoint to your front-end site that checks if a user is logged in, then returns encrypted user data with an expiration timestamp. Use wp_hash() to encrypt the data to prevent tampering.
  Example snippet (add to your front-end theme's functions.php):

  add_action('rest_api_init', function () {
      register_rest_route('sso/v1', '/validate', [
          'methods' => 'GET',
          'callback' => 'sso_validate_user',
          'permission_callback' => function () {
              return is_user_logged_in();
          }
      ]);
  });
  
  function sso_validate_user() {
      $user = wp_get_current_user();
      $payload = [
          'id' => $user->ID,
          'username' => $user->user_login,
          'email' => $user->user_email,
          'expires' => time() + 3600 // 1 hour expiration
      ];
      // Encrypt payload using a secret key
      $encrypted = wp_hash(json_encode($payload) . 'YOUR_SECURE_SECRET_KEY');
      return rest_ensure_response([
          'payload' => base64_encode(json_encode($payload)),
          'signature' => $encrypted
      ]);
  }
  

• Step 2: Add login sync logic to regional sites
  On each regional site, hook into the init action to check if the user has a valid session from the front-end. If so, create or sync the user and set the auth cookie:

  add_action('init', 'sso_sync_login');
  
  function sso_sync_login() {
      if (is_user_logged_in()) return;
  
      // Get payload and signature from query params or cookie
      $payload = isset($_GET['sso_payload']) ? base64_decode($_GET['sso_payload']) : '';
      $signature = isset($_GET['sso_signature']) ? $_GET['sso_signature'] : '';
  
      if (!$payload || !$signature) return;
  
      // Validate signature
      $valid_signature = wp_hash($payload . 'YOUR_SECURE_SECRET_KEY');
      if ($signature !== $valid_signature) return;
  
      $user_data = json_decode($payload, true);
      // Check if expiration has passed
      if ($user_data['expires'] < time()) return;
  
      // Find or create user in regional site
      $user = get_user_by('email', $user_data['email']);
      if (!$user) {
          $user_id = wp_insert_user([
              'user_login' => $user_data['username'],
              'user_email' => $user_data['email'],
              'user_pass' => wp_generate_password(16, false) // Random password, since SSO handles login
          ]);
          $user = get_user_by('id', $user_id);
      }
  
      // Set auth cookie to log the user in
      wp_set_auth_cookie($user->ID, true);
  }
  

• Step 3: Add cross-site links with SSO params
  On your front-end site, modify links to regional sites to include the SSO payload and signature as query params. Alternatively, set a cookie with the payload that regional sites can read (note: cross-domain cookies require proper CORS and SameSite settings).

关键注意事项（必看） #

• Domain considerations: If your sites are on different domains, you'll need to handle cross-origin requests (CORS) and adjust cookie settings (set SameSite=None and Secure flags). For subdomains, you can set the cookie domain to .yourdomain.com to share cookies across all subdomains.
• Security first: Always encrypt user data and validate signatures to prevent spoofing. Never pass sensitive data like passwords in plain text.
• User sync: If you need to sync user roles, metadata, or other custom fields, add logic to the custom code or use a user sync plugin alongside the SSO tool.
• Logout flow: Don't forget to handle logout—when a user logs out of the front-end site, you should invalidate sessions on all regional sites (either via plugin settings or a custom REST endpoint that clears auth cookies).

内容的提问来源于stack exchange，提问作者Baron von Flanders