我想要一个登录系统，它可以验证来自web服务的用户。步骤如下：

我们有一些会员网站（WordPress server之外）。每个成员网站都有其相应的博客，这些博客托管在不同的服务器上。

我们有从会员网站获取正确身份验证的web服务。

我希望该功能能够使未登录会员网站的人尝试访问相应的博客时，他应该被重定向到自定义登录页面。

已经登录会员网站的人可以访问该博客。

在wp-admin 将按原样工作。所以有人去http://www.example.com/wp-admin 然后他可以使用WordPress数据库凭据登录。

我正在尝试创建一个插件。到目前为止我尝试的代码：

add_action(\'wp_head\', \'load_login_page\');

function load_login_page(){

    if(!isset($_COOKIE[\'login_token\'])) {
        echo $_COOKIE[\'login_token\'];
        wp_redirect(home_url(\'login\'));
       //exit;
    }
}

// this action is executed just before the invocation of the WordPress authentication process
add_action(\'wp_authenticate\',\'checkTheUserAuthentication\');

function checkTheUserAuthentication() {

    if ( ! is_admin() ) {
        $username=$_POST[\'log\']; 
        $password=$_POST[\'pwd\'];
        echo $_COOKIE[\'login_token\'];

        // try to log into the external service or database with username and password
        //$ext_auth = try2AuthenticateExternalService($username,$password);
        //echo "<pre>"; print_r($ext_auth); echo \'</pre>\'; 
        // if external authentication was successful
        $ext_auth[0] = \'success\';
        if($ext_auth[0]==\'success\') {

            // find a way to get the user id
            $uname = explode(\'@\',$username);
            $user_id = username_exists($uname[0]); 
            // userdata will contain all information about the user
            //$userdata = get_userdata($user_id);
            //$user = wp_set_current_user($user_id,$username);

            // this will actually make the user authenticated as soon as the cookie is in the browser
            //wp_set_auth_cookie($user_id);
            $path = parse_url(get_option(\'siteurl\'), PHP_URL_PATH);
            $host = parse_url(get_option(\'siteurl\'), PHP_URL_HOST);
            //$expiry = strtotime(\'+1 month\');
            $expiry = time() + (60 * 1);
            setcookie(\'login_token\', $ext_auth[0], $expiry, $path, $host);
            // the wp_login action is used by a lot of plugins, just decide if you need it
            do_action(\'wp_login\',$userdata->ID);
            //determine WordPress user account to impersonate

            // you can redirect the authenticated user to the "logged-in-page", define(\'MY_PROFILE_PAGE\',1); f.e. first
            header("Location:http://executiveboard/audit-blog");
            return \'success\';
        }
    }
    else {
        echo \'I am at admin\';
        header("Location:http://executiveboard/audit-blog/login");
        return \'fail\';
    }
}

function try2AuthenticateExternalService($username, $password){
     require_once realpath (__DIR__ . \'/sbws.php\');
     $lSbws = new SBWS\\Sbws (__DIR__ . \'/use/config.ini\');
     $svcLogin = $lSbws->getwebservice (\'login\');
     try
     {
        $post_data = array (\'user_name\' => \'[email protected]\', \'password\' => \'gudda@123\', \'remember_login\' => false);
        $result  = $svcLogin->setdata ($post_data)->loginUsingUsrPwd ();
     }
     catch (SBWS\\Sbws_Login_Exception $e)
     {
         echo "received " . $e->getMessage () . PHP_EOL;
         $result = false;
     }
    
     //echo __FILE__ . \' \' . __LINE__ . \'<pre style="text-align: left;">\';       print_r( $result); print \'</pre>\'; // DEBUG-HANS
     return $result; 
}