andrewheberle

<p>This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header that is added by a reverse proxy<br />
that sits in front of your WordPress deployment.</p>
<p>Authentication and optionally role assignment is handled by claims contained in the JWT.</p>
<p>Verification of the JWT is handled by either:</p>
<ul>
<li>a shared secret key</li>
<li>retrieving a JSON Web Key Set (JWKS) from a configured URL</li>
</ul>
<p>During the login process if the user does not exist an account will be created with a matching role from the JWT.</p>
<p>If the JWT did not contain a role claim then user is created with the role set in the plugin settings (by default this is the subscriber role).</p>


AH JWT Auth

This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header.

jeremyjsimmons

<p>TWL SSO is a secure single sign-on plugin for WordPress that enables seamless authentication using RS256 JWT tokens from an external SSO application.<br />
This plugin provides login security features and is designed for allowing Twelve Legs Marketing centralized authentication management.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Single Sign In</strong>: Agency employees can log into websites they manage from a central dashboard.</li>
<li><strong>Just-in-Time User Provisioning</strong>: Automatic user creation and role assignment</li>
<li><strong>JWT Validation</strong>: Full RS256 signature verification with JWKS endpoint integration</li>
<li><strong>Key Rotation</strong>: Support key rotation through JWKS endpoint</li>
<li><strong>Role Management</strong>: Flexible role assignment from JWT claims</li>
<li><strong>Referrer Validation</strong>: Enhanced security through referrer validation</li>
<li><strong>Audience Validation</strong>: Ensures tokens are valid for the specific WordPress site</li>
<li><strong>Token Expiration</strong>: Built-in token expiration and clock skew tolerance</li>
<li><strong>Email Validation</strong>: Comprehensive email validation with optional allowlist</li>
<li><strong>Caching</strong>: JWKS caching for improved performance</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Referrer validation to prevent unauthorized access</li>
<li>JWT signature verification using public key cryptography</li>
<li>Issuer validation to ensure tokens come from trusted sources</li>
<li>Audience validation to prevent token reuse across sites</li>
<li>Token expiration validation with configurable leeway</li>
<li>Email format validation and filtering via hook</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>WordPress installations managed centrally by agency</li>
<li>Organization using Google for external identity provider</li>
</ul>
<h3>Usage</h3>
<h4>Authentication Flow</h4>
<ol>
<li>User clicks login link from SSO application sso.twelvelegsmarketing.com</li>
<li>SSO application redirects to WordPress with JWT token: <code>/wp-login.php?action=twl_sso&token=JWT_TOKEN</code></li>
<li>Plugin validates the JWT token signature and claims</li>
<li>Plugin extracts user information from JWT claims</li>
<li>Plugin creates or retrieves WordPress user</li>
<li>Plugin assigns appropriate role based on JWT claims</li>
<li>User is logged into WordPress</li>
</ol>
<h4>JWT Claims</h4>
<p>The plugin expects the following JWT claims:</p>
<ul>
<li><code>email</code> or <code>sub</code>: User’s email address</li>
<li><code>iss</code>: Issuer (must match allowed issuers)</li>
<li><code>aud</code>: Audience (must match WordPress site URL)</li>
<li><code>exp</code>: Expiration time</li>
<li><code>nbf</code>: Not before time (optional)</li>
<li><code>wp_role</code>: WordPress role to assign (optional)</li>
<li><code>name</code>: User’s display name (optional)</li>
<li><code>given_name</code>: User’s first name (optional)</li>
<li><code>family_name</code>: User’s last name (optional)</li>
</ul>
<h4>Configuration</h4>
<p>The plugin automatically configures itself based on the WordPress environment:</p>
<ul>
<li><strong>Production</strong>: Only allows <code>https://sso.twelvelegsmarketing.com</code> as issuer</li>
<li><strong>Development/Staging</strong>: Also allows <code>https://localhost:8443</code> as issuer</li>
</ul>
<h4>Customization</h4>
<p>You can customize the plugin behavior using WordPress filters:</p>
<ul>
<li><code>twl_sso_allow_email</code>: Filter to control which email addresses are allowed</li>
<li><code>twl_sso_allowed_roles</code>: Filter to control which roles can be assigned</li>
<li><code>twl_sso_allowed_issuers</code>: Filter to control which issuers are allowed</li>
</ul>
<h3>Support</h3>
<p>For support, please contact Twelve Legs Marketing at https://twelvelegsmarketing.com</p>
<h3>Privacy Policy</h3>
<p>This plugin does not collect, store, or transmit any personal data. All authentication is handled through secure JWT tokens from your configured SSO provider.</p>


Twelve Legs Marketing SSO

Single sign-on plugin for WordPress that accepts RS256 JWTs from the TWL SSO application for secure authentication.

AH JWT Auth vs Twelve Legs Marketing SSO