Signing in once logs a member in across every site on the network. The main site holds the session; subsites borrow it rather than creating sessions of their own.
How it works
- Logged-out visit to a subsite. A script sends the browser to the main site with
lh_membership-sso_return. If the browser has a main-site session, the main site issues a short-lived signed token carrying the user ID, that session’s token and the return URL, and redirects back. - Callback on the subsite. The subsite checks the token’s HMAC signature and expiry, confirms the session token is still valid with
WP_Session_Tokens::verify(), and sets its own auth cookies on that same session. It then fireswp_loginonce, so login actions such as role upgrades and audit logging run. - Login on a subsite. A normal login on a subsite is synced the other way: the login redirect is routed through the main site with a token, so the main site gets the session too.
All three endpoints run on template_redirect, so cookies are set in a normal request. The token lifetime defaults to 60 seconds, filterable with lh_membership_sso_token_ttl.
Two Factor
When the Two Factor plugin is active, its wp_login handler is removed while the SSO callback fires wp_login, then restored. The session being transferred was created on the main site and has already passed any second factor there, so the subsite does not challenge again. Every real login, on any site, is still challenged as usual. (Since 2.91.6.)
