Multisite: Confusion for average users when a blog is a mapped domain and requires re-authentication

[henry.wright]

If domain mapping is active for a blog in a network install, users of that blog must re-authenticate when visiting that blog because the domain is likely to be different from the host install domain.

Mapped domains appear in the My Sites list. When a user visits their blogs in the list it is confusing for them to be asked to re-authenticate for blog A (mapped domain) and not be asked to re-authenticate for blog B (not a mapped domain).

An average user isn't familiar with the cookie authentication mechanism and would find it frustrating to authenticate multiple times which is, to the average user, seemingly unnecessary.

How do we make this process clear or easier?

[realloc]

The re-authentication here isn't really a bug but a browser constraint: authentication cookies are bound to COOKIE_DOMAIN. Cookies can be shared across subdomains of a single TLD, but not across separate mapped domains. A browser cannot set a cookie for domain B from domain A, so being asked to log in again on a mapped domain is expected behaviour rather than something WordPress can silently skip.

Core currently ships no cross-domain SSO for this. The old "WordPress MU Domain Mapping" plugin offered a remote-login feature, and solutions like Mercator set auth cookies across all mapped domains, but that behaviour was not part of the domain-mapping capability that landed in Core in 4.5.

Given that, there seem to be three possible directions:

1. A UX hint in the "My Sites" list, flagging that a mapped-domain site may require a fresh login. Small and achievable, addresses the confusion but not the extra login.
2. A real SSO login flow with a redirect chain that sets a cookie on each domain in turn. Solves the underlying issue but is complex, security-sensitive, and redirect-heavy.
3. Documentation only.

As it stands the ticket is an open question without a concrete scope or patch. Could the reporter confirm which direction they have in mind? Option 1 feels like the most realistic Core-sized enhancement.