Datawiza

<p>The Proxy Auth Plugin helps developers/DevOps/admins easily implement authentication and authorization for WordPress by using a <a href="https://en.wikipedia.org/wiki/JSON_Web_Token" rel="nofollow ugc">JWT (JSON Web Token)</a> provided by a reverse proxy.</p>
<p>This could be employed to achieve SSO (OAUTH/OIDC and SAML) to a Cloud Identity Provider (e.g., Azure Active Directory, Okta, Auth0) by using an Identity-Aware Proxy, e.g., <a href="https://www.datawiza.com/" rel="nofollow ugc">Datawiza Access Broker</a> and <a href="https://cloud.google.com/iap" rel="nofollow ugc">Google IAP</a>.</p>
<p>Note that the plugin requires a reverse proxy sitting in front of the WordPress site. The reverse proxy performs authentication, and passes the user name and role in a JWT to the plugin via a HTTP header called <code>DW-TOKEN</code>.</p>
<p>By using <a href="https://www.datawiza.com/" rel="nofollow ugc">Datawiza Access Broker</a>, you get a <a href="https://docs.datawiza.com/step-by-step/step1.html" rel="nofollow ugc">configuration-based</a> <a href="https://docs.datawiza.com/" rel="nofollow ugc">no-code solution</a>, following the detail instruction <a href="https://docs.datawiza.com/step-by-step/step1.html" rel="nofollow ugc">here</a>.</p>
<p>If you decide to use your own reverse proxy, please follow the instructions below.</p>
<p><strong>How it works</strong></p>
<ul>
<li>The plugin retrieves the user id (email) from the JWT and then checks if such a user exists. If not, the plugin creates a new user by using this email and signs him/her in.</li>
<li>The plugin retrieves the user role from the JWT and sets it as the user’s role in WordPress.</li>
<li>
<p>The plugin expects the JWT including user id and role as a HTTP header <code>DW-TOKEN</code>. For example, the payload of JWT may look like:</p>
<p>{<br />
    “role”: “administrator”,<br />
    “email”: “admin@yourwebsite.com”<br />
}</p>
</li>
</ul>
<p><strong>Plugin config in WordPress</strong></p>
<p>In <code>Setting</code> -> <code>Datawiza Proxy Auth</code>, you need to input a private secret which is used as a Cryptography Key. Such secret is shared between the plugin and the reverse proxy which is responsible for passing the JWT to the plugin. The Signing Algorithm for the JWT is <code>HS256</code>.</p>
<p><strong>!!! NOTES !!!</strong></p>
<ul>
<li><strong>If the enabled Proxy Auth Plugin cannot retrieve the expected JWT in the HTTP header, the plugin will not work. The authentication will use the default authentication of wordpress and you will see an error banner on top of the wordpress pages.</strong></li>
<li><strong>MAKE SURE that clients cannot bypass the reverse proxy. This is to prevent people from sending forged malicious requests with arbitrary JWTs directly to WordPress.</strong></li>
<li><strong>It’s recommended that the reverse proxy in front of the WordPress site erases the incoming http request’s <code>DW-TOKEN</code> header. The <code>DW-TOKEN</code> header should be generated by the reverse proxy only.</strong></li>
<li><strong>If admin doesn’t assign role to the user, user’s role will be subscriber for WordPress by default.</strong></li>
<li><strong>If user’s role has been updated in JWT, the plugin will update the role in WordPress accordingly.</strong></li>
</ul>
<p><strong>Generate the JWT required by the plugin</strong></p>
<p>If you are using openresty/lua-nginx-module, here is the code sample to generate the JWT required by the plugin:</p>
<pre><code>jwt = require("resty.jwt")
local jwt_token = jwt:sign(
   "jwt_secret",
    {
    header={typ="JWT", alg="HS256"},
    payload={email="admin@yourwebsite.com", role="administrator"}
    })
ngx.req.set_header('DW-TOKEN', jwt_token)
</code></pre>
<p>The <code>jwt_secret</code> above should be the same private secret input in <code>Setting</code> -> <code>Datawiza Proxy Auth</code>. The <code>role</code> in <code>payload</code> is optional. If it’s not specified, the default role is <code>subscriber</code>. For more details about <code>lua-resty-jwt</code>, you can visit <a href="https://github.com/SkyLothar/lua-resty-jwt" rel="nofollow ugc">here</a>.</p>


Datawiza Proxy Auth Plugin – SSO

The Proxy Auth Plugin helps developers/DevOps/admins easily implement authentication and authorization for WordPress by using a JWT (JSON Web Token) p …

miniOrange

<p>WordPress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any OpenID Connect provider that conforms to the OpenID Connect 1.0 standard.<br />
You can SSO to your WordPress site with any OAuth 2.0 or OpenID Connect 1.0 provider using this plugin.</p>
<h4>Description</h4>
<p>OpenID Connect Client plugin works with any OAuth/OpenIDConnect provider that conforms to the OAuth 2.0 or OpenID Connect 1.0 standard. OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. Each time you need to log in to a website using OIDC, you are redirected to your OpenID provider where you login, and then taken back to the website.</p>
<h4>Use-Cases</h4>
<ul>
<li>Login with Office365 (Office365 Login)</li>
<li>Login with Cognito (Cognito Login)</li>
<li>Login with Yahoo (Yahoo Login)</li>
<li>Login with WordPress (WordPress Login)</li>
<li>Login with Google (Google Login)</li>
<li>Login with Facebook (Facebook Login)<br />
and SSO with many more social login and mobile applications.</li>
</ul>
<p>WP OIDC / OpenID Connect client plugin enables user registration and authentication against any standard OpenID Connect (OIDC) Provider.</p>
<p>Login<br />
OIDC Client plugin enables a WordPress site to send users to an external OpenID Provider for login.</p>
<p>Registration<br />
If the user has an existing account in the OpenID Connect Provider, but not in WordPress, this plugin will enable dynamic registration of the user in WordPress.</p>
<h4>List of popular OpenID Connect Providers we support</h4>
<ul>
<li>Office 365</li>
<li>AWS Cognito</li>
<li>Amazon</li>
<li>SalesForce</li>
<li>PayPal</li>
<li>Microsoft</li>
<li>Yahoo</li>
<li>Google</li>
<li>Onelogin</li>
<li>Okta</li>
<li>ADFS</li>
<li>Gigya</li>
<li>DID.app</li>
<li>PhantAuth</li>
<li>Openidentityplatform</li>
<li>Yelp</li>
</ul>
<h4>List of popular OAuth Providers we support</h4>
<ul>
<li>WSO2</li>
<li>Eve Online</li>
<li>Slack</li>
<li>Discord</li>
<li>HR Answerlink / Support center</li>
<li>Wechat</li>
<li>Weibo</li>
<li>AWS cognito</li>
<li>Azure AD</li>
<li>Gitlab</li>
<li>Shibboleth</li>
<li>Blizzard (Formerly Battle.net)</li>
<li>servicem8</li>
<li>Meetup</li>
<li>DigitalID</li>
<li>Aerobase</li>
<li>Yandex</li>
<li>ORY Hydra</li>
<li>Odex</li>
</ul>
<h4>Other OpenID Connect/OAuth Providers we support</h4>
<ul>
<li>Keycloak, Foursquare, Harvest, Mailchimp, Bitrix24, Spotify, Vkontakte, Huddle, Reddit, Strava, Ustream, Yammer, RunKeeper, Instagram, SoundCloud, Pocket, PayPal, Pinterest, Vimeo, Nest, Heroku, DropBox, Buffer, Box, Hubic, Deezer, DeviantArt, Delicious, Dailymotion, Bitly, Mondo, Netatmo, Amazon, WHMCS, FitBit, Clever, Sqaure Connect, Windows, Dash 10, Github, Invision Comminuty, Blizzar, authlete etc.</li>
</ul>
<h4>List of grant types we support</h4>
<ul>
<li>Authorization code grant</li>
<li>Implicit grant</li>
<li>Resource owner credentials grant (Password Grant)</li>
<li>Client credentials grant</li>
<li>Refresh token grant</li>
</ul>
<h4>FREE VERSION FEATURES</h4>
<ul>
<li>WordPress OpenID Connect Client (OIDC Client) supports single sign-on / SSO with any 3rd party OAuth / OpenIDConnect server or custom OAuth / OpenIDConnect server.</li>
<li>Auto Create Users : After SSO, new user automatically gets created in WordPress</li>
<li>Account Linking : After user SSO to WordPress, if user already exists in WordPress, then his profile gets updated or it will create a new WordPress User</li>
<li>Attribute Mapping : OpenIDConnect Client supports username Attribute Mapping feature to map WordPress user profile username attribute.</li>
<li>Login Widget : Use Widgets to easily integrate the login link with your WordPress site</li>
<li>OAuth / OpenID Connect Provider Support : OpenIDConnect / OAuth Login supports only one OAuth / OpenID Connect Provider. </li>
<li>Redirect URL after Login : OpenIDConnect / OAuth Login Automatically Redirects user after successful login. </li>
<li>Logging :  If you run into issues OAuth Login can be helpful to enable debug logging</li>
</ul>
<h4>STANDARD VERSION FEATURES</h4>
<ul>
<li>All the FREE Version Features included.</li>
<li>Optionally Auto Register Users : OpenIDConnect Login does automatic user registration after login if the user is not already registered with your site</li>
<li>Basic Role Mapping :  OpenIDConnect Client provides basic Attribute Mapping feature to map WordPress user profile attributes like username, firstname, lastname, email and profile picture. Manage username & email with data provided.<br />
                      Also, Assign default role to user registering through OIDC Login based on rules you define.</li>
<li>Support for Shortcode : Use shortcode to place OIDC / OAuth login button anywhere in your Theme or Plugin</li>
<li>Customize Login Buttons / Icons / Text : Wide range of OpenIDConnect / OAuth Login Buttons/Icons and it allows you to customize Text shadow</li>
<li>Custom Redirect URL after Login : WordPress OpenIDConnect SSO provides auto redirection and this is useful if you wanted to globally protect your whole site</li>
<li>Custom Redirect URL after logout : WordPress OIDC SSO allows you to auto redirect Users to custom URL after he logs out from your WordPress site</li>
</ul>
<h4>PREMIUM VERSION FEATURES</h4>
<ul>
<li>All the STANDARD Version Features</li>
<li>Advanced Role Mapping : Assign roles to users registering through OAuth Login based on rules you define.</li>
<li>Force Authentication / Protect Complete Site : Allows user to restrict login / authorization for particular site</li>
<li>Multiple Userinfo Endpoints Support : OIDC Login supports multiple Userinfo Endpoints.</li>
<li>App domain specific Registration Restrictions : OIDC Login restricts registration on your site based on the person’s email address domain</li>
<li>Multi-site Support : OIDC Login have unique ability to support multiple sites under one account</li>
</ul>
<h4>ENTERPRISE VERSION FEATURES</h4>
<ul>
<li>All the PREMIUM Version Features</li>
<li>Multiple OAuth / OpenID Connect Provider Support</li>
<li>Single Login button for Multiple Apps : It provides single login button for multiple providers</li>
<li>Extended OIDC / OAuth API support : Extend OAuth API support to extend functionality to the existing OAuth client.</li>
<li>BuddyPress Attribute Mapping : OIDC Login allows BuddyPress Attribute Mapping.</li>
<li>Page Restriction according to roles : Limit Access to pages based on user status or roles. This WordPress OIDC Login plugin allows you to restrict access to the content of a page or post to which only certain group of users can access.</li>
<li>WP Hooks for Different Events : Provides support for different hooks for user defined functions</li>
<li>Login Reports : OIDC Login creates user login and registration reports based on application used. </li>
</ul>
<h4>REST API Authentication</h4>
<p>Secures the unauthorized access to your WordPress sites/pages using our <a href="https://wordpress.org/plugins/wp-rest-api-authentication/">WordPress REST API Authentication</a> plugin.</p>


WordPress OpenID Connect Client

Wordpress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any…

Datawiza Proxy Auth Plugin – SSO vs WordPress OpenID Connect Client