I am having multiple wordpress sites with multiple users working on those.
Therefore I would like to centeralize the user management, by having one authentication server, storing the username, password and website this user can access. This way i can easily e.g. reset passwords in one place instead of having to go through all websites one by one
**Each website will get a wordpress plugin which works the following way: a user logs in -> plugin intercepts the login and sends a curl request via tls to the authentication server -> this server checks the authentication and authorization and returns true or false.
The authentication server will have a common WAF and only the known servers whitelisted in iptables. Additionally, when installing the plugins, there is a pair of keys generated which have to be inserted on the wordpress end. Using the key the communication between wordpress and authentication server is additionally encrypted (in case there is a man in the middle despite the tls)**
With a setup like this, are there any obvious vulnerabilites that i have overseen ?
Thanks for any input