wordpress remote user authentication

Question

I am having multiple wordpress sites with multiple users working on those.

Therefore I would like to centeralize the user management, by having one authentication server, storing the username, password and website this user can access. This way i can easily e.g. reset passwords in one place instead of having to go through all websites one by one

**Each website will get a wordpress plugin which works the following way: a user logs in -> plugin intercepts the login and sends a curl request via tls to the authentication server -> this server checks the authentication and authorization and returns true or false.

The authentication server will have a common WAF and only the known servers whitelisted in iptables. Additionally, when installing the plugins, there is a pair of keys generated which have to be inserted on the wordpress end. Using the key the communication between wordpress and authentication server is additionally encrypted (in case there is a man in the middle despite the tls)**

With a setup like this, are there any obvious vulnerabilites that i have overseen ?

Thanks for any input

Answer 1

Create a LDAP server for setting up the users and then use one of the multiple wordpress ldap plugins to handle the authentication.

Answer 2

Rather than roll your own complex and possibly flawed setup. It sounds like you are looking for a secrets manager.

Secrets management tools allow organisations or groups to centrally manage secrets (keys, passwords, certificates) as well as offer access control and many other security features.

The benefit of using a secrets management tool in your case, is that the developers never see or know the plain text passwords for access, they log into the secrets management tool and launch the WordPress site they are working on from there.

From your perspective you can control which users have access to which WordPress sites. Depending on the Secrets Management tool selected, it could automatically reset the WordPress passwords after use, have concurrent usage locks (so a site can only be worked on by X concurrent developers) etc.

There are plenty of both paid and open source tools, these tools also often come with Privileged Access Management features, Role Based Access Control, account life cycle management (Automatically change passwords based on rule), monitoring and auditing, MFA (to otherwise non-MFA configured products), session recording, SecDevOps, Conditional Access rules.

You will need to do some research and testing to see which one meets your specific needs.

Note: I am not affiliated with any Secrets Management companies. They are just something I personally use in my own teams.