secureparrot

SecurePie SSO SAML is a SAML 2.0 Single Sign-On (SSO) plugin for WordPress that provides enterprise SSO login, SAML login, and federated login via any SAML 2.0 Identity Provider — including Azure AD (Entra ID), Okta, Google Workspace, OneLogin, ADFS, Auth0, PingFederate, and Keycloak.
Whether you need SAML SSO for an intranet, an enterprise SSO portal for customers, or federated authentication for your team, this plugin turns your WordPress site into a SAML Service Provider with zero external dependencies.
SecurePie SSO SAML allows you to configure your WordPress site as a SAML 2.0 Service Provider (SP), enabling Single Sign-On with any SAML 2.0 compliant Identity Provider (IdP) such as Azure AD, Okta, Google Workspace, OneLogin, ADFS, and more.
This is a zero-dependency plugin — it uses only PHP’s built-in <code>dom</code>, <code>openssl</code>, and <code>zlib</code> extensions. No Composer, no external libraries, no conflicts with other plugins.
<h4>Features</h4>
<ul>
<li>Full SAML 2.0 SSO — AuthnRequest generation, Response validation, user provisioning</li>
<li>SP Metadata Endpoint — Auto-generated metadata XML for easy IdP configuration</li>
<li>IdP Metadata Parsing — Import IdP settings from a metadata URL or XML file</li>
<li>XML Digital Signature Verification — RSA-SHA256 and RSA-SHA1 support</li>
<li>Security Hardened — XXE prevention, signature wrapping attack protection, replay prevention, audience validation</li>
<li>Attribute Mapping — Map SAML attributes to WordPress user fields (username, email, first name, last name, display name)</li>
<li>Role Mapping — Assign WordPress roles based on IdP group/role attributes</li>
<li>Auto User Provisioning — Automatically create WordPress users on first SSO login</li>
<li>SSO Login Button — Customizable SSO button on the WordPress login page</li>
<li>Force SAML Login — Optionally redirect all login attempts through the IdP</li>
<li>Single Logout (SLO) — Send LogoutRequest to the IdP when users log out of WordPress</li>
<li>Test Configuration — Validate your SSO setup and see returned attributes before going live</li>
<li>HTTP-Redirect and HTTP-POST Bindings — Support for both SAML binding types</li>
<li>Clean Admin Interface — Professional tabbed settings page with copy-to-clipboard functionality</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Enterprise SSO — Centralize WordPress login through your corporate Identity Provider so employees use one set of credentials.</li>
<li>SAML Login for Customer Portals — Let B2B customers sign in to your WordPress site using their own SAML SSO identity.</li>
<li>Federated Login Across Sites — Use a single SAML IdP to federate authentication across multiple WordPress installs.</li>
<li>SSO Authentication for Membership Sites — Replace WordPress’s default signin flow with SAML SSO login from Azure AD, Okta, or Google Workspace.</li>
<li>Intranet Single Sign-On — Add WordPress to your existing SSO ecosystem alongside other SAML 2.0 enabled apps.</li>
</ul>
<h4>Supported Identity Providers</h4>
<ul>
<li>Microsoft Azure Active Directory (Entra ID)</li>
<li>Okta</li>
<li>Google Workspace</li>
<li>OneLogin</li>
<li>Salesforce</li>
<li>Auth0</li>
<li>PingFederate</li>
<li>Shibboleth</li>
<li>ADFS (Active Directory Federation Services)</li>
<li>Keycloak</li>
<li>Any SAML 2.0 compliant IdP</li>
</ul>
<h4>Setting up SAML SSO with Azure AD (Entra ID)</h4>
Connecting WordPress to Azure AD / Entra ID for SAML SSO with SecurePie takes about ten minutes:
<ol>
<li>In the WordPress admin, open SecurePie SSO → Service Provider and copy the SP Entity ID and ACS URL.</li>
<li>In Azure, create a new Enterprise Application of type “Non-gallery application” and open its Single sign-on → SAML blade.</li>
<li>Paste the SP Entity ID into Azure’s Identifier (Entity ID) field and the ACS URL into the Reply URL (Assertion Consumer Service URL) field.</li>
<li>Under “SAML Signing Certificate”, download the Federation Metadata XML (or copy the Login URL and certificate).</li>
<li>Back in WordPress, open Identity Provider → Quick Setup and either upload the metadata XML or paste the metadata URL. SecurePie auto-fills Entity ID, Login URL and X.509 Certificate.</li>
<li>Assign your Azure users / groups to the Enterprise Application, then run Test Configuration in WordPress to confirm attributes flow through correctly before enabling the SSO button on the login page.</li>
</ol>
<h4>Setting up SAML SSO with Okta</h4>
Okta-to-WordPress SAML SSO with SecurePie follows the same pattern:
<ol>
<li>In the WordPress admin, open SecurePie SSO → Service Provider and copy the SP Entity ID, ACS URL and Single Logout URL.</li>
<li>In the Okta admin, go to Applications → Create App Integration → SAML 2.0, give the app a name, and continue to step 2 of Okta’s wizard.</li>
<li>Paste the SP Entity ID into Okta’s Audience URI (SP Entity ID) field and the ACS URL into the Single Sign-on URL field.</li>
<li>Configure Okta’s attribute statements to send <code>email</code>, <code>firstName</code>, <code>lastName</code>, and optionally a <code>groups</code> claim for role mapping.</li>
<li>After saving, open the Okta Sign On tab, click View SAML setup instructions, and copy the Identity Provider Single Sign-On URL, Identity Provider Issuer and the X.509 Certificate.</li>
<li>Back in WordPress, paste these into Identity Provider Setup (or use Okta’s metadata URL). Run Test Configuration to verify the SAML assertion before going live.</li>
</ol>
<h4>Requirements</h4>
<ul>
<li>PHP 7.4 or higher</li>
<li>PHP extensions: <code>dom</code>, <code>openssl</code>, <code>zlib</code> (enabled by default on most hosts)</li>
<li>WordPress 5.8 or higher</li>
</ul>
<h3>External Services</h3>
This plugin implements the SAML 2.0 protocol, which requires communication with an external Identity Provider (IdP) that is configured by the site administrator. No data is sent to any external service without the administrator explicitly configuring the connection.
<h4>Identity Provider Communication</h4>
When a user initiates SSO login, the plugin redirects the user’s browser to the Identity Provider’s SAML Login URL (configured by the administrator). The following data is sent as part of the standard SAML 2.0 AuthnRequest:
<ul>
<li>The Service Provider Entity ID (your site’s identifier)</li>
<li>The Assertion Consumer Service URL (your site’s callback URL)</li>
<li>A unique request ID for replay prevention</li>
</ul>
The Identity Provider then authenticates the user and sends a SAML Response back to your site containing the user’s identity attributes (such as email, name, and group membership).
This communication is entirely between your WordPress site and the IdP that you configure. No data is sent to SecurePie or any other third party.
The terms of service and privacy policy for the Identity Provider depend on which provider you choose to configure (e.g., Microsoft Azure AD, Okta, Google Workspace). Please consult your Identity Provider’s documentation for their specific terms.
<h4>IdP Metadata Import (Optional)</h4>
The plugin can optionally fetch Identity Provider metadata from a URL provided by the administrator. This is a one-time server-to-server request to retrieve the IdP’s public configuration (Entity ID, Login URL, X.509 Certificate). No user data is sent during this request.
<h4>SAML Attribute Namespace URIs</h4>
The plugin references standard SAML attribute namespace URIs (e.g., <code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</code>) as identifiers within SAML assertions. These are XML namespace strings used for attribute identification and are not HTTP requests to external services.

SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress

SAML 2.0 SSO for WordPress. Enterprise login with Azure AD, Okta, Google Workspace, OneLogin, ADFS & any SAML 2.0 Identity Provider.

miniorange

SCIM User Sync/provisioning plugin provides Automated user synchronization from the identity provider to WordPress.
SCIM User Sync/provisioning provides SCIM capability to your WordPress site, converting it to a SCIM compliant endpoint which can be configured with many identity providers like Azure AD, Okta, OneLogin, G-suite / Google Apps, Centrify, JumpCloud, Keycloak, miniOrange IDP, and Custom Providers supporting SCIM protocol.
SCIM User Sync/provisioning plugin allows you to automate user creation, update and delete user information from the IDP (identity provider) in real-time to your WordPress site and automate user sync for WordPress from different IDPs.
To set up the user provisioning in your identity provider (IdP), use the SCIM endpoint from the plugin and configure the bearer token in your application. Users’ feeds will be synchronized from the Identity Provider to your WordPress site instantaneously or in a time interval set in your IDP. 
Our SCIM Automated User Sync/Provisioning plugin also allows real-time provisioning with custom Providers. Our User Sync/Provisioning (Auto Provisioning) plugin works with any IDP that conforms to the SCIM standard.
<h3>REQUIREMENTS</h3>
<h3>PHP</h3>
Minimum PHP version: 5.4.0
<h3>PHP HTTP Authorization Header enable</h3>
Most of the shared hosting has disabled the HTTP Authorization Header by default.
To enable this option you’ll need to edit your .htaccess file adding the following code
<pre><code>RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</code></pre>
<h4>WPENGINE</h4>
To enable this option you’ll need to edit your .htaccess file adding the following code
<pre><code>SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</code></pre>
<h3>Bitnami</h3>
To enable this option you’ll need to edit your /opt/bitnami/apps/wordpress/conf/htaccess.conf file adding the following line.
You can also check this issue using this link https://community.bitnami.com/t/need-to-pass-authorization-headers/44690
<pre><code>SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</code></pre>
<h3>Why do you need SCIM User Sync/Provisioning-WordPress plugin?</h3>
If your team uses Okta, Azure AD, OneLogin, G-Suite, or Centrify for employee/User provisioning, you can use SCIM User Sync/Provisioning integration to automatically keep your WordPress employee directory/Users in sync. The SCIM push-based system treats the IdP directory as your source of truth. When changes are made in IdP, they push immediately to WordPress, so you need not worry about the WordPress employee/User directory being out of sync.
Note: You can manually create new employees/users or add employees/users from other locations while maintaining your directory sync. This feature is helpful for contractors, temps or other people who may host visitors/receive deliveries but are not core team members.
PRE-INTEGRATED IDPs FOR PROVISIONING
miniOrange provides pre-integrated IdPs for many applications like Azure AD, Okta, OneLogin, G-suite / Google Apps, Centrify, JumpCloud, Keycloak, miniOrange IDP, and Custom Providers. Once you configure the SCIM base URL and Bearer token in your SCIM capable Identity providers (IdPs) they can use the SCIM User Sync/Provisioning plugin for WordPress sites to update, create, delete, deactivate users automatically within seconds. (Auto User Provisioning).
<ul>
<li>SCIM user sync/provisioning plugin works with JumpCloud and G-Suite.You can always <a href="https://www.miniorange.com/contact/" rel="nofollow ugc">Contact Us</a>, or Email us at <a href="mailto:info@xecurify.com" rel="nofollow ugc">info@xecurify.com</a> and we would be happy to help you out in setting up user-provisioning with SCIM supported IdP.</li>
</ul>
<h4>Free Features</h4>
<ul>
<li>
Create Users: You can create users by using the SCIM User Sync/Provisioning plugin supporting IdP (eg Okta, OneLogin AzureAD , Centrify and G-Suite), and then you can sync those users (user create) as configured in IdP either real-time or one can schedule the Identity-life
</li>
<li>
Unlimited Users: There is no restriction for the number of users to be updated to your WordPress site.
</li>
<li>
Real-time provisioning: Real-time provisioning permits you to update recently created or updated Identity Authentication clients without physically running a task, or waiting for a scheduled one. This proves to be useful for situations that require coordinated provisioning, similar to client self-enrollment that needs immediate system access.
</li>
<li>
Pre-configured IDPs: Since SCIM is a standard protocol one can use any SCIM supporting IdP. SCIM User Sync/Provisioning provides pre-integrated IdPs like Azure AD, Okta, OneLogin, and miniOrange IdP. The System for Cross-domain Identity Management (SCIM) is an open standard for securely synchronizing user (user sync tool) information between multiple applications.
</li>
</ul>
<h4>Premium Features</h4>
<ul>
<li>
Includes all the Free version features
</li>
<li>
Delete Users: The removal of access privilege and system resources for an employee, User, business partner for your WordPress website. It is a security process that removes access of a system to an end-user along with their data in WordPress site when you de-provision the same user in your IdP. (User delete)
<ul>
<li>Use-case: one can use this feature when a user leaves a company/organization to remove her/his data from your WordPress site.</li>
</ul>
</li>
<li>
Deactivate Users or Soft delete: Deactivating a user makes a user inactive or ineffective which means that the user will not be deleted from the system but will no longer be able to log in to your WordPress website and their records can be transferred to another user.
<ul>
<li>Use-case: One can use this feature when the admin wants to deny access to the WordPress site but this keeps the user data in the WordPress database.</li>
</ul>
</li>
<li>
Update Users: This integration allows you to automatically (Automated User Provisioning / Auto user provisioning) update the users and groups for your WordPress Website when you make updates in your identity provider. Attributes like firstName, lastName, are automatically updated ( Auto provisioning ) in the user’s profile when there are any changes in these attributes.
</li>
<li>
Custom attribute mapping: This feature allows to sync custom attributes sent by IdP in WordPress. We also give the option to show these attributes in the User table list.
</li>
</ul>
HOW WE ARE DIFFERENT
miniOrange has various types of deployments that give the customer a safe and protective choice. We provide a reliable plugin with extended functionality in a cost-beneficial manner. Our SCIM Auto User Provisioning for WordPress sites carries a lot of features within it like modifying, creating, deleting, deactivating users. We also provide Automatically deactivated/deleted user accounts (Auto-provisioning / Automated user provisioning ) on your WordPress site feature when a user is deleted from your IdP with the best Operational Efficiency. Our continuous integration helps you to reduce. If you are looking for a greater amount of administrative control over your WordPress website in a cost-efficient manner. miniOrange offers you the best plugin with the powerful User deployment and continuous integration management feature at an affordable price.
<h3>Integrate user provisioning with SAML and OpenID</h3>
<ul>
<li>
SCIM User Sync/Provisioning plugin can be integrated with SAML and OpenID plugins to provide complete Life Cycle Management. SCIM User Sync/Provisioning plugin can be integrated with JumpCloud, Okta, AzureAD, OneLogin, and G-suite along with SAML and OpenID. You can use 3rd party pre-integrated apps that support user provisioning and SSO solution using SAML and OpenID protocol.
</li>
<li>
You can check out this link to check pre-configured apps in G-suite to enable user sync & user provisioning on your WordPress site.<a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-google-apps" rel="nofollow ugc">SCIM supported apps in G-suite/</a>.
</li>
<li>
You can check out this link to enable user sync & user provisioning in JumpCloud and WordPress. <a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-jumpcloud" rel="nofollow ugc"> SCIM integration with JumpCloud </a>
</li>
<li>
You can check out this link to enable user sync & user provisioning in Okta and WordPress. <a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-okta" rel="nofollow ugc"> SCIM integration with Okta </a>
</li>
<li>
You can check out this link to enable user sync & user provisioning in OneLogin and WordPress. <a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-onelogin" rel="nofollow ugc"> SCIM integration with OneLogin </a>
</li>
<li>
You can check out this link to enable user sync & user provisioning in AzureAD and WordPress. <a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-azuread" rel="nofollow ugc"> SCIM integration with AzureAD </a>
</li>
<li>
You can check out this link to enable user sync & user provisioning in PingOne and WordPress. <a href="https://plugins.miniorange.com/wordpress-scim-user-provisioning-with-pingone" rel="nofollow ugc"> SCIM integration with PingOne </a>
</li>
</ul>
<h3>DOCUMENTATION</h3>
Our SCIM User Sync/Provisioning (User Account Management) plugin for WordPress comes with a great number of setup guidelines with ensured content, expectations to make sure you don’t get lost along the way. 
<a href="https://plugins.miniorange.com/wordpress-user-provisioning" rel="nofollow ugc"> https://plugins.miniorange.com/wordpress-user-provisioning</a>
<h3>CONTRIBUTED BY MINIORANGE</h3>
SCIM User Sync/Provisioning for WordPress is built by miniOrange. We create high-quality WordPress plugins that help you grow your WordPress sites.
Check out our website for other plugins <a href="https://plugins.miniorange.com/" rel="nofollow ugc">https://plugins.miniorange.com/ </a> or click here to see all our listed WordPress plugins.
<h3>CONTACT SUPPORT</h3>
If you are still nervous about your website security or how the plugin would work for you specifically, customized solutions and Active support are available. You can always <a href="https://www.miniorange.com/contact/" rel="nofollow ugc">Contact Us</a>, or Email us at <a href="mailto:info@xecurify.com" rel="nofollow ugc">info@xecurify.com</a> and we would be happy to help you out.

SCIM User Sync/Provisioning

SCIM User Sync & User Provisioning. Create, delete, update users & automated user sync from Azure AD, Okta, Google Apps & many IDPs into WordPress.

SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress vs SCIM User Sync/Provisioning