Automatically logging into WordPress when logged into external app

It’s possible to have WP query an external resource to check for authentication. If valid, WP can go ahead and log you in. This can be done via the “authenticate” filter. If your filter callback returns a valid WP_User object, that user will become logged in. If it returns a WP_Error object, login will be denied. If it returns null, the normal WP process will attempt authentication. Thus this external resource must provide some sort of webhook or API for your filter callback to communicate with.

Similarly, your app would need a WP webhook or API route through which it could request authentication of a user. Beware, this sort of alternative authentication can be a security vulnerability if the scheme is not carefully implemented. Working with an existing protocol such as JWT or oAuth is the safest approach.

A SSO plugin should work, but I’ve no experience with them. They would implement essentially the same procedure I’m suggesting. A user wouldn’t be automatically logged in per se, though it might appear that way. On any WP request, WP checks for an auth cookie where required. If one does not exist, WP normally redirects to the login screen. You’d interrupt this process to have WP check elsewhere for authentication. If it exists, WP would log in the user without further interaction.

There’s no way to set an auth cookie from outside of WP. WP must do it, but we can alter how that gets done.