meritstory

karolismerit

<p><strong>Microsoft Login for WordPress</strong> lets your users sign in to WordPress using their Microsoft Azure AD / Entra ID credentials – no separate password needed. Choose between SAML 2.0 and OpenID Connect (OIDC) to match your organization’s configuration.</p>
<h4>Why this plugin?</h4>
<ul>
<li><strong>Microsoft-focused.</strong> Built specifically for Azure AD / Entra ID.</li>
<li><strong>Simple setup.</strong> Import SAML metadata or use OIDC discovery to auto-fill endpoints.</li>
<li><strong>Clean admin UX.</strong> One settings area with guided setup and test tools.</li>
<li><strong>Security-first.</strong> SAML uses <code>onelogin/php-saml</code>; OIDC validates RS256 tokens against JWKS.</li>
</ul>
<h4>Free Features</h4>
<ul>
<li>SAML 2.0 SP login flow (Azure AD / Entra ID as IdP)</li>
<li>OpenID Connect Authorization Code + PKCE login flow</li>
<li>Auto-create WordPress users on first login (JIT provisioning)</li>
<li>Configurable default role for new users</li>
<li>SP metadata download and SAML metadata URL import</li>
<li>OIDC tenant discovery and endpoint validation tools</li>
<li>Emergency admin bypass URL for lockout recovery</li>
<li>WP-CLI commands (<code>wp saml status</code>, <code>wp saml import-metadata</code>, <code>wp saml regen-cert</code>, <code>wp saml test</code>)</li>
</ul>
<h4>Pro Features (separate plugin)</h4>
<ul>
<li>Role mapping (map Azure AD roles/groups to WordPress roles)</li>
<li>SSO enforcement by WordPress role, with per-user bypass exceptions</li>
<li>Attribute sync on login (first name, last name, display name)</li>
<li>Audit log (login success/failure, user creation, role mapping, SSO enforcement, logout)</li>
<li>Audit log CSV export and retention settings</li>
<li>Microsoft Graph user sync and import tools:</li>
<li>App-only Graph connection test</li>
<li>Group member preview/import</li>
<li>Daily background sync via WP-Cron</li>
<li>Optional deprovisioning (remove role when user is disabled/removed)</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>PHP 8.0 or higher</li>
<li>PHP extensions: <code>openssl</code>, <code>dom</code>, <code>zlib</code></li>
<li>WordPress 6.3 or higher</li>
<li>A Microsoft Azure AD / Entra ID tenant</li>
</ul>
<h4>Setup Overview</h4>
<p><strong>SAML:</strong></p>
<ol>
<li>Install and activate the plugin.</li>
<li>Go to <strong>Settings -> SSO & SAML Login</strong>.</li>
<li>Copy the <strong>SP Entity ID</strong> and <strong>ACS URL</strong> from the SP Information tab.</li>
<li>Create a new Enterprise Application in Azure AD (non-gallery app, enable SAML SSO).</li>
<li>Paste your <strong>App Federation Metadata URL</strong> into the plugin and click <strong>Import Metadata</strong>.</li>
<li>Save settings. Your Microsoft login button appears on <code>wp-login.php</code>.</li>
</ol>
<p><strong>OIDC:</strong></p>
<ol>
<li>Create an App Registration in Azure and add your site’s <code>/saml/oidc-callback</code> as Redirect URI.</li>
<li>In plugin settings, select <strong>OpenID Connect</strong>, enter Tenant ID, click <strong>Fetch Discovery</strong>.</li>
<li>Enter <strong>Client ID</strong> and <strong>Client Secret</strong>, then save.</li>
</ol>
<h4>Privacy</h4>
<p>This plugin does not send data to third parties except as described in the External services section below. SSO and audit data are stored in your own WordPress database.</p>
<h3>External services</h3>
<p>This plugin connects to external services to provide authentication and optional paid features. No data is sent to any external service except as described below.</p>
<p><strong>1) Microsoft Azure AD / Entra ID (required for SSO login)</strong></p>
<p>Used for SAML 2.0 and OpenID Connect authentication.</p>
<p>Data sent and when:</p>
<ul>
<li>On SSO login start, the browser is redirected to Microsoft with Azure app/protocol parameters (tenant endpoint, app/client ID, redirect URI, state, scopes, SAML request/relay state as applicable).</li>
<li>On OIDC callback, the site sends the one-time authorization code (and PKCE verifier) to Microsoft’s token endpoint.</li>
<li>On SAML setup import/test actions, the site fetches your tenant’s federation metadata URL.</li>
<li>On logout (if SLO/end-session is enabled), the browser is redirected to Microsoft’s logout endpoint.</li>
</ul>
<p>Returned identity claims (email, name, subject/object ID, roles/groups) are used to authenticate/provision users and stored in your WordPress database.</p>
<ul>
<li>Service: https://login.microsoftonline.com/</li>
<li>Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement</li>
<li>Terms of Service: https://www.microsoft.com/en-us/servicesagreement</li>
</ul>
<p><strong>2) Microsoft Graph API (Pro only; when configured by the site admin)</strong></p>
<p>Used to sync users and groups from Microsoft Entra ID into WordPress.</p>
<p>Data sent and when:</p>
<ul>
<li>When an admin runs a Graph test, import, or sync (manual or scheduled), the site sends requests to Microsoft Graph using app-only access tokens.</li>
<li>Requests include query parameters for the configured sync operations (group/member lookups, account status checks, etc.).</li>
</ul>
<p>Returned directory fields (user principal name, email, display name, object IDs, group membership, account status) are used to create, update, or deprovision WordPress users per plugin settings.</p>
<ul>
<li>Service: https://graph.microsoft.com/</li>
<li>Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement</li>
<li>Terms of Service: https://www.microsoft.com/en-us/servicesagreement</li>
</ul>
<p><strong>3) Freemius (optional; only when admin opts in or activates a paid license)</strong></p>
<p>Used for licensing, upgrade flow, and optional analytics.</p>
<p>Data sent and when:</p>
<ul>
<li>On activation, an opt-in prompt is shown; no data is sent unless the admin consents.</li>
<li>On license activation/validation, the site exchanges license, account, and site information with Freemius servers.</li>
<li>
<p>If telemetry opt-in is accepted, usage and diagnostic events may be sent per Freemius configuration.</p>
</li>
<li>
<p>Service: https://freemius.com/</p>
</li>
<li>Privacy Policy: https://freemius.com/privacy/</li>
<li>Terms of Service: https://freemius.com/terms/</li>
</ul>


SSO & SAML Login — Azure AD / Entra ID

Log in to WordPress with Microsoft Azure AD / Entra ID using SAML 2.0 or OpenID Connect (OIDC). Simple setup, enterprise-grade security.

Automattic

WordPress.org

Alex Kirk

Ashish Kumar (Ashfame)

Paulo Pinto

<p>With this plugin you can use your own WordPress install to authenticate with a webservice that provides <a href="https://openid.net/connect/" rel="nofollow ugc">OpenID Connect</a> to implement Single-Sign On (SSO) for your users.</p>
<p>The plugin is currently only configured using constants and hooks as follows:</p>
<h3>Define the RSA keys</h3>
<p>If you don’t have keys that you want to use yet, generate them using these commands:</p>
<pre><code>openssl genrsa -out oidc.key 4096
openssl rsa -in oidc.key -pubout -out public.key
</code></pre>
<p>And make them available to the plugin as follows (this needs to be added before WordPress loads):</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', <<<OIDC_PUBLIC_KEY
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
OIDC_PUBLIC_KEY
);

define( 'OIDC_PRIVATE_KEY', <<<OIDC_PRIVATE_KEY
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
OIDC_PRIVATE_KEY
);
</code></pre>
<p>Alternatively, you can also put them outside the webroot and load them from the files like this:</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', file_get_contents( '/web-inaccessible/oidc.key' ) );
define( 'OIDC_PRIVATE_KEY', file_get_contents( '/web-inaccessible/private.key' ) );
</code></pre>
<h3>Define the clients</h3>
<p>Define your clients by adding a filter to <code>oidc_registered_clients</code> in a separate plugin file or <code>functions.php</code> of your theme or in a MU-plugin like:</p>
<pre><code>add_filter( 'oidc_registered_clients', 'my_oidc_clients' );
function my_oidc_clients() {
    return array(
        'client_id_random_string' => array(
            'name' => 'The name of the Client',
            'secret' => 'a secret string',
            'redirect_uri' => 'https://example.com/redirect.uri',
            'grant_types' => array( 'authorization_code' ),
            'scope' => 'openid profile',
        ),
    );
}
</code></pre>
<h3>Exclude URL from caching</h3>
<ul>
<li><code>example.com/wp-json/openid-connect/userinfo</code>: We implement caching exclusion measures for this endpoint by setting <code>Cache-Control: 'no-cache'</code> headers and defining the <code>DONOTCACHEPAGE</code> constant. If you have a unique caching configuration, please ensure that you manually exclude this URL from caching.</li>
</ul>
<h3>Github Repo</h3>
<p>You can report any issues you encounter directly on <a href="https://github.com/Automattic/wp-openid-connect-server" rel="nofollow ugc">Github repo: Automattic/wp-openid-connect-server</a></p>


OpenID Connect Server

Use OpenID Connect to log in to other webservices using your own WordPress.

SSO & SAML Login — Azure AD / Entra ID vs OpenID Connect Server