sojweb

THIS IS FOR DEVELOPMENT PURPOSES, NOT FOR USE ON PRODUCTION SITES
This plugin is meant to be a reference; I’ve talked to several people who have similar setups, and thought it would beneficial to share some code.
This plugin allows users to be authenticated via CAS, and logins to be controlled via LDAP. Default user roles can be assigned based on LDAP group membership, and accounts can be auto-created for users that exist in LDAP, but not yet in WordPress.
It assumes that, for CAS authentication, the user is redirected to an outside address, then back to the referring address; that’s how it works where I’m at :-). You can also specify a group in LDAP that will always have admin privileges; useful for tech staff.
Before the plugin is used, the constants in <code>soj-ldap_constants.inc.php</code> must be filled out. The CAS default password is the one the user is registered with in WordPress; so all WP users will have this password. Be aware of that. There is obviously more that could be done there, and I’m happy to work with others who have ideas.
I’ve adapted this from an in-house plugin I made, so there might be leftover code bits or things that look strange… feel free to harass me about that, I did this in a bit of a rush.
I’ve only ever used this plugin on one environment, so it might not work out-of-the-box for you. I’m interested in making this plugin more robust, however, so please let me know of any issues.
Contact me: jj56@indiana.edu

SoJ CAS/LDAP Login

This plugin allows users to be authenticated via CAS, and logins to be controlled via LDAP.

Casey Bisson

wpCAS integrates WordPress into an established CAS architecture, allowing centralized management and authentication of user credentials in a heterogeneous environment.
<a href="http://en.wikipedia.org/wiki/Central_Authentication_Service" rel="nofollow ugc">From Wikipedia</a>:
<blockquote>The Central Authentication Service (CAS) is a single sign-on protocol for the web. Its purpose is to permit a user to log into multiple applications simultaneously and automatically. It also allows untrusted web applications to authenticate users without gaining access to a user’s security credentials, such as a password. The name CAS also refers to a software package that implements this protocol.</blockquote>
Users who attempt to login to WordPress are redirected to the central CAS sign-on screen. After the user’s credentials are verified, s/he is then redirected back to the WordPress site. If the CAS username matches the WordPress username, the user is recognized as valid and allowed access.
<a href="http://en.wikipedia.org/wiki/AuthZ" rel="nofollow ugc">Authorization</a> of that user’s capabilities is based on native WordPress settings and functions. CAS only authenticates that the user is who s/he claims to be.
If the CAS user does not have an account in the WordPress site, an administrator defined function can be called to provision the account or do other actions. By default, CAS users without WordPress accounts are simply refused access.

wpCAS

wpCAS integrates WordPress into an established CAS architecture, allowing centralized management and authentication of user credentials in a heterogen …

SoJ CAS/LDAP Login vs wpCAS