Shawn

<p>This plugin integrates JWT authentication and automates user creation. The plugin is written for AAF Rapid Connect, but can be used for other providers too.</p>
<p>Here is how this plugin works:</p>
<ol>
<li>Generate a secrete key with command: tr -dc ‘[[:alnum:][:punct:]]’ < /dev/urandom | head -c32 ;echo</li>
<li>Register the key and call back URL http://yoursite.com/wp-json/jwt-auth/v1/callback with your authentication provider.</li>
<li>Specify authentication and user creation parameters. Those marked with * are required.</li>
</ol>


JWT Authenticator

This plugin integrates JWT authentication and automates user creation.

sakurainternet

<p><strong>Auto Login for Sakura Rental Server</strong> allows administrators to issue one-time, time-limited auto-login URLs using HMAC signatures.<br />
This is useful for secure temporary access or system integration.</p>
<p>Features:<br />
– Secure auto-login with one-time tokens<br />
– Tokens are HMAC-signed and invalidated after use<br />
– Token issuance and usage history (up to 100 entries per user)<br />
– Records IP address and username of the issuer<br />
– Rate limiting: 1 request per second per IP<br />
– WP-CLI commands for token generation and history inspection</p>
<p>Example use cases:<br />
– Temporarily granting admin access<br />
– Safe automatic login from external systems<br />
– Keeping an audit log of who issued a token and from where</p>
<h3>Usage</h3>
<h3>Generate a token via CLI</h3>
<pre><code>wp auto-login-for-sakura-rental-server generate <user_id> [–expires=] [–remote_addr=] [–username=]
</code></pre>
<p>Example:</p>
<ul>
<li>Default expiration time: 300 seconds  </li>
<li><code>--expires</code> and <code>--username</code> are optional</li>
</ul>
<h3>Check issue history</h3>
<p>Token history is stored in the user meta key <code>sakura_auto_login_history</code>.<br />
You can check it via WP-CLI:</p>
<p>wp user meta get  sakura_auto_login_history</p>
<h3>Auto-login URL format</h3>
<pre><code>https://example.com/?rs_auto_login_token=<64-character HMAC token>
</code></pre>
<p>Visiting the URL will log in as the corresponding user and redirect to the admin dashboard.</p>
<h3>Security Notes</h3>
<ul>
<li>Tokens are invalidated immediately after use (one-time only)</li>
<li>Issue and usage history includes IP address, issuer username, and timestamps</li>
<li>Stored using <code>update_option()</code> for caching compatibility</li>
<li>HTTPS is strongly recommended</li>
</ul>


Auto Login for Sakura Rental Server

Provides one-time auto-login URLs with HMAC signatures and time limits.

JWT Authenticator vs Auto Login for Sakura Rental Server