idgold

Open Access SSO is a SAML 2.0 Service Provider for WordPress. It lets users sign in to your site through any standard SAML identity provider (Microsoft Entra ID, Okta, OneLogin, Keycloak, ADFS, Shibboleth, NetIQ Access Manager, etc.) instead of (or alongside) the built-in WordPress login form.
Built from scratch as a clean-room implementation. Fully open-source under GPLv2+. No paid tier, no telemetry. Its only third-party libraries are xmlseclibs (MIT) for XML signature handling and phpseclib (MIT) for RSA-OAEP key unwrapping — both bundled, and neither makes any network call.
<h4>What it does</h4>
<ul>
<li>SAML 2.0 SP with HTTP-Redirect and HTTP-POST bindings, signed AuthnRequests, signed/encrypted assertion handling, SP-initiated and IdP-initiated Single Logout.</li>
<li>Multi-IdP — configure multiple identity providers, let users choose via a button or URL parameter (<code>?idp=slug</code>).</li>
<li>Attribute mapping — map SAML attributes to WordPress user fields (first name, last name, email, display name, plus arbitrary user_meta).</li>
<li>Role mapping — assign WordPress roles based on SAML attribute values, with exact / contains / regex match types, per-IdP rule sets, deny-unmapped option, default-role fallback.</li>
<li>Page access control — restrict pages, posts, and custom post types to specific roles or to “logged in via SSO” users; per-page meta box; <code>[oasso_restrict]</code> shortcode.</li>
<li>WooCommerce integration (optional) — map SAML attributes to WooCommerce customer fields; auto-link SSO users to existing customers.</li>
<li>Audit log with configurable retention.</li>
<li>Force-SSO mode with emergency bypass via <code>OASSO_BYPASS</code> constant in <code>wp-config.php</code>.</li>
</ul>
<h4>Privacy</h4>
This plugin’s only outbound HTTP requests go to the IdP metadata URL you enter: once when an administrator clicks “Fetch IdP Metadata from URL”, and — only if you turn on the optional certificate-rotation check for an IdP — on a recurring WP-Cron schedule that re-fetches that same URL. Certificate-rotation checks are disabled by default. No telemetry, no analytics, no calls to any third-party service. All configuration is stored in <code>wp_options</code> on your own site.
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0+</li>
<li>PHP 8.1+</li>
<li>A SAML 2.0 identity provider you control or have access to.</li>
</ul>
<h3>External Services</h3>
This plugin is a SAML 2.0 Service Provider (SP). It sends no telemetry or analytics and never connects to any service operated by the plugin author. Its only external interactions are with the SAML Identity Provider (IdP) that you, the site administrator, configure — for example Microsoft Entra ID, Okta, OneLogin, Keycloak, ADFS, Shibboleth, or NetIQ Access Manager. There is no built-in or default IdP; the IdP is chosen and operated by you or your organisation.
<h4>Identity Provider metadata fetch</h4>
When an administrator clicks “Fetch IdP Metadata from URL” in the plugin’s admin screens, the plugin makes a single server-side HTTP GET request to the metadata URL the administrator entered. No site or user data is sent beyond a standard HTTP request; the response (SAML metadata XML) is parsed and stored in your site’s database. This never happens on the front end.
Optionally, you can enable a certificate-rotation check for an IdP (off by default). When enabled, WP-Cron re-fetches that same administrator-entered metadata URL on a schedule (for example daily) so the plugin can warn you before the IdP’s signing certificate expires or changes. This is the only automatic outbound request the plugin makes, it is opt-in per IdP, and it contacts only the metadata URL you configured.
<h4>SAML single sign-on flow</h4>
When a visitor signs in through SSO, their browser is redirected to your configured IdP (carrying a standard SAML AuthnRequest). After the visitor authenticates, the IdP returns a signed SAML assertion to your site, which the plugin validates and uses to create or update the corresponding WordPress user. The data exchanged is the SAML authentication request and response — which includes the user identifier and whatever attributes your IdP is configured to release. This exchange happens only when a visitor initiates an SSO login.
Because the IdP is a service you select and operate (or that your organisation operates), its terms of service and privacy policy are defined by that provider. Consult your chosen identity provider’s own documentation for those terms (for example, the privacy and terms pages of Microsoft Entra ID, Okta, OneLogin, etc.).

Open Access SSO

Open-source SAML 2.0 SSO and access control. Map identity-provider attributes to WordPress roles. Multi-IdP, GPL-licensed.

miniorange

The <a href="https://www.miniorange.com/customer-identity" rel="nofollow ugc">Customer Identity and Access Management (CIAM)</a> solution by miniOrange provides secure customer registration and login experiences through WordPress and multiple login devices and with strong authentication methods. miniOrange offers CIAM (Customer Identity and Access Management) solutions for both Cloud and On-premise environments. It allows you to securely manage customer identity and profile data as well as control user access to applications and services on WordPress easily. CIAM also offers customized and branded experiences for consumers, businesses, and enterprise customers.
<a href="https://blog.miniorange.com/what-is-ciam-customer-identity-and-access-management/" rel="nofollow ugc">miniOrange CIAM solution</a> for WordPress ensures a secure, seamless customer experience at extreme scale & performance whether it is web (or) mobile. Companies that use a Customer Identity solution can quickly onboard prospective customers by simplifying registration and providing <a href="https://www.miniorange.com/products/single-sign-on-sso" rel="nofollow ugc">Single Sign-On (SSO)</a>. In addition to acquiring customers faster, this solution helps organizations deliver frictionless user experiences and protect customer data throughout the customer lifecycle.
While IAM focuses on an inside solution (for employees), CIAM is a solution that focuses on the outside world (for external customers). Also, in a CIAM, users manage their own accounts and profiles. The CIAM Stores user data in a centralized cloud directory for maintaining customer profiles and data associated with it.
<h4>Multiple Login and Authentication methods:</h4>
<ul>
<li>
Social Login: 
Social Login through CIAM for WordPress allows social login, social share & commenting using widely used apps like Facebook, Google, LinkedIn, Twitter, Apple, Discord, Twitch, Line, Wechat, and 40 other apps available. Instead of requiring your visitors to waste time filling out the typical registration form, it allows them to register/login to your website using their social media profiles.
</li>
<li>
<a href="https://www.miniorange.com/products/single-sign-on-sso" rel="nofollow ugc">Single Sign-On</a>: 
Single Sign-On simplifies the user’s onboarding process allowing users to register by signing up or using social registration. It allows users to log in to multiple applications by using just one set of credentials.
</li>
<li>
<a href="https://www.miniorange.com/products/multi-factor-authentication-mfa" rel="nofollow ugc">Multi-Factor Authentication:</a> 
You can configure multiple WordPress 2FA/MFA methods like google authenticator, OTP over Email, OTP over SMS, etc., and choose any one method from a list of configured methods to use as 2FA/MFA for your WordPress website. Multi-factor authentication is helpful for cases such as when you do not have your phone and cannot access your TOTP app for login. You can then use other MFA methods like OTP over Email to login.
</li>
<li>
<a href="https://www.miniorange.com/products/identity-broker-service" rel="nofollow ugc">Identity Brokering</a>: 
Enables organizations to connect WordPress with other multiple service providers (SP) with different identity providers (IdP). This creates a trusting relationship with external identity providers & simplifies how online service providers can use existing trusted digital identities.
</li>
<li>
<a href="https://blog.miniorange.com/passwordless-authentication/" rel="nofollow ugc">Passwordless Login</a><a>:</a> 
Passwordless Login is a modern way of logging into your WordPress site without the use of a password. The plugin allows you to easily set up Passwordless Login for your site. Users would now be able to log in using their Username and OTP. If you wish to allow our users to fall back to Username and Password then the plugin also allows that.
</li>
<li>
<a href="https://www.miniorange.com/products/adaptive-multi-factor-authentication-mfa" rel="nofollow ugc">IP/Device/Time/Location Based Restriction:</a> 
CIAM for WordPress includes Adaptive Authentication which is an advanced form of <a href="https://blog.miniorange.com/what-is-multi-factor-authentication-mfa/" rel="nofollow ugc">Multi-factor authentication (MFA)</a> is a process of selecting the right authentication factors depending on a user’s risk profile like user’s behavior, device IP, time, geo-location, etc. to adapt the type of authorization factors.
</li>
<li>
Automated User Management: 
<a href="https://blog.miniorange.com/automated-user-provisioning/" rel="nofollow ugc">Automated User Management</a> (Automated User Provisioning & Deprovisioning) provides automated user synchronization from the identity provider to WordPress. It allows you to automate user creation, update and delete user information from the <a>IDP (identity provider)</a> in real-time to your WordPress site and automate user sync for WordPress from different IDPs. Streamline creation of app accounts, their access requests, and termination like a pro with an easy-to-implement <a>Provisioning solution.</a>
</li>
<li>
Password Policy Manager: 
It includes user’s password management features like auto password expiration, one-click password reset, Enforce strong password, role-based password policy, Enforce strong password for inactive users, password history management, and many more. Weak passwords are the primary perpetrator of WordPress hack assaults. To fix this issue, a password policy Manager was developed, password policy will help administrators ensure that their users use strong passwords
</li>
<li>
Universal Directory Authentication: 
One Directory to manage all identities, groups, and devices on-premises or in the cloud. We can help integrate multiple user directories, IDPs, and databases into one <a href=”https://www.miniorange.com/products/directory-services” target=”_blank”>Universal Directory which allows easy and seamless SSO and MFA access to WordPress. This Unified Directory stores all user attributes such as email addresses, usernames, passwords, user preferences, information about devices and networks, and much more.
</li>
</ul>
<h4>Key Features of miniOrange CIAM solution for WordPress:</h4>

<ul>
<li>
Cloud & On-Premise Hosting: 
The hosting of CIAM solutions on the cloud & on-premise allows organizations to leverage it across different environments and devices. Also, both types of hosting can be extended to support any number of applications.
</li>
<li>
Strong Authentication: 
Protocols like MFA, SSO, etc. enable the solution to detect identity theft and prevent dangerous bots from sending fake traffic to a website.
</li>
<li>
Scalability & Integration: 
Customer-facing apps see tens of thousands of users and the number keeps on growing as the business scales, hence the miniOrange CIAM solution is able to adapt to new integrations and fast-growing user volume.
</li>
<li>
Platform-based functionalities: 
The platform combines multiple features and services into a single user experience that is simple to understand and use.
</li>
<li>
Multisite Support: 
Supports configuring WordPress Multisite Network installation as an Identity Provider, allowing users to SSO login into Service Provider applications using WordPress Multisite credentials. (Premium Feature).
</li>
<li>
Interface customization: 
This allows for modifying and delivering a personalized and user-friendly experience to customers.
</li>
<li>
No Setup required: 
Simply register with us and use our pre-configured application. We will handle everything for you.
</li>
<li>
24 / 7 Support: 
If you face any issues or simply require assistance with the WordPress CIAM solution by miniOrange, please contact us. Whatever it may be, we will solve the issue for you and get everything working as soon as possible.
</li>
</ul>
<h4>Personalization to Improve the Customer Experience</h4>

<a href=”https://miniorange.com” target=”_blank”>miniOrange’s Customer Identity and Access Management (CIAM) for WordPress Solution can help companies build customer trust while minimizing operating costs and maximizing revenue and retention. By building trust and loyalty with customers, CIAM can help you acquire more customers, build more customer interactions, and influence cross-sells. 
Customer Identity Management System gathers data about customers as they move through the customer journey. This data is used to build a profile of customer preferences on WordPress, which can then be used to customize product offerings and communications. New information, such as a change of address, is automatically shared with apps that use the customer profile. 
Although CIAM and IAM solutions share the same building blocks, the traditional IAM solutions cannot be extended to replace/act in place of a CIAM solution. The unique requirement of a client-facing application needs a flexible and scalable Identity and Access Management solution that requires a dedicated solution built on top of IAM features. 
By exploiting identification data to gain and retain consumers, CIAM generates revenue growth. CIAM systems are intended to supply, authenticate, authorize, collect, and store consumer information from a variety of sources.
<h4>Benefits of using the CIAM WordPress plugin:</h4>
<ul>
<li>
Effortless Secure Login 
CIAM WordPress ensures that only authorized users get access to sensitive data. Implement password policies like Password length, complexity, restrictions on password reuse, session timeout and self-service password reset policy to strengthen security without holding up your users access.
</li>
<li>
Easy Integration 
Delight customers with secure, easy-to-use scalable plugins and APIs which improve the overall customer experience.
</li>
<li>
Seamless Customer Experience 
CIAM for WordPress provides brands with a holistic view of customers found in customer profiles while providing users with a better experience.
</li>
<li>
Remote Workforce Access 
Get secure access to tools and devices they require in a timely manner from any location – without compromising security.
</li>
<li>
Maximize Conversion Rate 
Provide an easy-to-use environment that would boost productivity for the customer workforce.
</li>
<li>
Migrate to a Digital Environment 
Retire legacy identity and integrate our secure and scalable app development.
</li>
<li>
Secure On-premise and Cloud services 
Choose the cloud or on-premise service provider and deployment option that fits your long-term growth strategy through the CIAM WordPress solution.
</li>
</ul>
<h4>Website –</h4>
For more support or info email us at idpsupport@xecurify.com or <a href="https://idp.miniorange.com/free-trial" rel="nofollow ugc">Contact us</a> for a free trial. You can also submit your query from the plugin’s configuration page.

Customer Identity (CIAM) – miniOrange

SSO into 4500+ cloud applications using SAML.

Open Access SSO vs Customer Identity (CIAM) – miniOrange