Remote auth (server mode)

Server mode turns a FluentAuth site into an authentication server. Other sites, the clients, send visitors to it to sign in and receive them back with a one-time token. One account, one password, one second factor, for a network of sites that are not a multisite.

It is opt-in by constant only, because most sites should not be an auth server.

Turning it on

On the server site, in wp-config.php:

define('FLUENT_AUTH_SERVER_MODE', true);

A Remote Auth item appears under FluentAuth’s settings.

Registering a client site

Under Settings → Remote Auth, add a client: its name, its URL, and the callback URL it will receive tokens on. FluentAuth generates a client ID for it. The client site needs that ID and the server’s URL.

The flow

1. The client sends the visitor to the server’s login page with ?fluent_client_id=….
2. The visitor signs in on the server, with everything the server enforces: attempt limit, second factor, IP rules.
3. The server redirects to the client’s callback URL with a fluent_auth_token.
4. The client posts that token to the server’s child-sites/validate-token endpoint. The server answers with the user’s identity and the token is destroyed, so it cannot be used twice.
5. The client creates or matches its own account for that identity and signs the visitor in.

Tokens are single use and compared with a constant-time check. The fluent_auth/remote_auth_response_data filter controls what the identity response contains.

On the client side

The client needs code that sends visitors to the server and handles the callback. FluentAuth does not ship a client plugin; the endpoint contract above is small enough that a site’s own plugin, or a membership plugin’s SSO hook, can implement it. The GitHub repository has the server side to read against.