jeremyjsimmons

TWL SSO is a secure single sign-on plugin for WordPress that enables seamless authentication using RS256 JWT tokens from an external SSO application. 
This plugin provides login security features and is designed for allowing Twelve Legs Marketing centralized authentication management.
<h4>Key Features</h4>
<ul>
<li>Single Sign In: Agency employees can log into websites they manage from a central dashboard.</li>
<li>Just-in-Time User Provisioning: Automatic user creation and role assignment</li>
<li>JWT Validation: Full RS256 signature verification with JWKS endpoint integration</li>
<li>Key Rotation: Support key rotation through JWKS endpoint</li>
<li>Role Management: Flexible role assignment from JWT claims</li>
<li>Referrer Validation: Enhanced security through referrer validation</li>
<li>Audience Validation: Ensures tokens are valid for the specific WordPress site</li>
<li>Token Expiration: Built-in token expiration and clock skew tolerance</li>
<li>Email Validation: Comprehensive email validation with optional allowlist</li>
<li>Caching: JWKS caching for improved performance</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Referrer validation to prevent unauthorized access</li>
<li>JWT signature verification using public key cryptography</li>
<li>Issuer validation to ensure tokens come from trusted sources</li>
<li>Audience validation to prevent token reuse across sites</li>
<li>Token expiration validation with configurable leeway</li>
<li>Email format validation and filtering via hook</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>WordPress installations managed centrally by agency</li>
<li>Organization using Google for external identity provider</li>
</ul>
<h3>Usage</h3>
<h4>Authentication Flow</h4>
<ol>
<li>User clicks login link from SSO application sso.twelvelegsmarketing.com</li>
<li>SSO application redirects to WordPress with JWT token: <code>/wp-login.php?action=twl_sso&token=JWT_TOKEN</code></li>
<li>Plugin validates the JWT token signature and claims</li>
<li>Plugin extracts user information from JWT claims</li>
<li>Plugin creates or retrieves WordPress user</li>
<li>Plugin assigns appropriate role based on JWT claims</li>
<li>User is logged into WordPress</li>
</ol>
<h4>JWT Claims</h4>
The plugin expects the following JWT claims:
<ul>
<li><code>email</code> or <code>sub</code>: User’s email address</li>
<li><code>iss</code>: Issuer (must match allowed issuers)</li>
<li><code>aud</code>: Audience (must match WordPress site URL)</li>
<li><code>exp</code>: Expiration time</li>
<li><code>nbf</code>: Not before time (optional)</li>
<li><code>wp_role</code>: WordPress role to assign (optional)</li>
<li><code>name</code>: User’s display name (optional)</li>
<li><code>given_name</code>: User’s first name (optional)</li>
<li><code>family_name</code>: User’s last name (optional)</li>
</ul>
<h4>Configuration</h4>
The plugin automatically configures itself based on the WordPress environment:
<ul>
<li>Production: Only allows <code>https://sso.twelvelegsmarketing.com</code> as issuer</li>
<li>Development/Staging: Also allows <code>https://localhost:8443</code> as issuer</li>
</ul>
<h4>Customization</h4>
You can customize the plugin behavior using WordPress filters:
<ul>
<li><code>twl_sso_allow_email</code>: Filter to control which email addresses are allowed</li>
<li><code>twl_sso_allowed_roles</code>: Filter to control which roles can be assigned</li>
<li><code>twl_sso_allowed_issuers</code>: Filter to control which issuers are allowed</li>
</ul>
<h3>Support</h3>
For support, please contact Twelve Legs Marketing at https://twelvelegsmarketing.com
<h3>Privacy Policy</h3>
This plugin does not collect, store, or transmit any personal data. All authentication is handled through secure JWT tokens from your configured SSO provider.

Twelve Legs Marketing SSO

Single sign-on plugin for WordPress that accepts RS256 JWTs from the TWL SSO application for secure authentication.

Nicu Micle

Simple JWT Login is a FREE WordPress plugin that enables secure authentication for your WordPress REST API using JSON Web Tokens (JWT).
With this powerful plugin, you can: 
– Log in, register, and authenticate users effortlessly 
– Connect mobile apps, external websites, or third-party services to WordPress with ease 
– Change or delete user passwords securely
Whether you’re building a headless WordPress setup or integrating with external platforms, Simple JWT Login provides a fast, secure, and reliable authentication solution.
You can read more on our plugin documentation website <a href="https://simplejwtlogin.com" rel="nofollow ugc">https://simplejwtlogin.com</a>.
<h3>Some awesome features</h3>
<ul>
<li>Auto-login using JWT and AUTH_KEY</li>
<li>Register new users via API</li>
<li>Delete WordPress users based on a JWT</li>
<li>Reset user password</li>
<li>Allow auto-login / register / delete users only from specific IP addresses</li>
<li>Allow register users only from a specific domain name</li>
<li>API Route for generating new JWT</li>
<li>Get JWT from URL, SESSION, COOKIE or HEADER</li>
<li>Pass request parameters to login URL</li>
<li>CORS settings for plugin Routes</li>
<li>Hooks</li>
<li>JWT Authentication</li>
<li>Allow access private endpoints with JWT</li>
<li>Protect endpoints with JWT</li>
<li>beta Google OAuth Integration</li>
<li>beta Google JWT on all endpoints</li>
<li>beta <a href="https://wordpress.org/plugins/wp-graphql/" rel="ugc">WPGraphQL</a> integration</li>
</ul>
Check the plugin <a href="https://simplejwtlogin.com" rel="nofollow ugc">website</a> for more features.
<h3>Login User</h3>
This plugin is customizable and offers you multiple methods to log in to you website, based on multiple scenarios.
In order to login, users have to send JWT. The plugin, validates the JWT, and if everything is OK, it can extract the WordPress email address or user ID. 
Users can specify the exact key of the JWT payload where this information can be found.
Here are the methods how you can send the JWT in order to auto-login:
<ol>
<li>URL</li>
<li>Header</li>
<li>Cookie</li>
<li>Session</li>
</ol>
If the JWT is present in multiple places ( like URL and Header), the JWT will be overwritten.
This plugin supports multiple JWT Decryption algorithms, like: HS256, HS512, HS384, RS256,RS384 and RS512.
After the user is logged in you can automatically redirect the user to a page like:
<ul>
<li>Dashboard</li>
<li>Homepage</li>
<li>or any other custom Page ( this is mainly used for redirecting users to a landing page)</li>
</ul>
You can attach to your redirect a URL parameter <code>redirectUrl</code> that will be used for redirect instead of the defined ones. 
In order to use this, you have to enable it by checking the option <code>Allow redirect to a specific URL</code>.
Also, redirect after login offers some variables that you can use in the customURL and redirectUrl. 
Here are the variables which you can use in your URL: 
– <code>{{site_url}}</code> : Site URL 
– <code>{{user_id}}</code> : Logged in user ID 
– <code>{{user_email}}</code> : Logged in user email 
– <code>{{user_login}}</code> : Logged in username 
– <code>{{user_first_name}}</code> : User first name 
– <code>{{user_last_name}}</code> : User last name 
– <code>{{user_nicename}}</code> : User nice name
You can generate dynamic URLs with these variables, and, before the redirect, the specific value will be replaced.
Here is an example:
<pre><code>http://yourdomain.com?param1={{user_id}}&param2={{user_login}}
</code></pre>
Also, this plugin allows you to limit the auto-login based on the client IP address. 
If you are concerned about security, you can limit the auto-login only from some IP addresses.
<a href="https://simplejwtlogin.com/docs/autologin/" rel="nofollow ugc">Read more</a> on our website.
<h3>Register Users</h3>
This plugin also allows you to create WordPress users.
This option is disabled by default, but you can enable it at any time.
In order to create users, you just have to make a POST request to the route URL, and send an email and a password as parameter and the new user will be created.
You can select the type for the new users: editor, author, contributor, subscriber, etc.
Also, you can limit the user creating only for specific IP addresses, or specific email domains.
Another cool option is “Generate a random password when a new user is created”. 
If this option is selected, the password is no more required when a new user is created a random password will be generated.
Another option that you have for register user is “Initialize force login after register”. 
When the user registration is completed, the user will continue on the flow configured on login config.
If auto-login is disabled, this feature will not work and the register user will go on a normal flow and return a json response.
If you want to add custom user_meta on user creation, just add the parameter <code>user_meta</code> with a json. This will create user_meta for the new user.
<pre><code>{
 "meta_key":"meta_value",
 "meta_key2":"meta_value"
}
</code></pre>
These properties can be passed in the request when the new user is created.
<ul>
<li>email : (required) (string) The user email address.</li>
<li>password : (required) (string) The plain-text user password.</li>
<li>user_login : (string) The user’s login username.</li>
<li>user_nicename : (string) The URL-friendly username.</li>
<li>user_url : (string) The user URL.</li>
<li>display_name : (string) The user’s display name. Default is the user’s username.</li>
<li>nickname : (string) The user’s nickname. Default is the user’s username.</li>
<li>first_name : (string) The user’s first name. For new users, will be used to build the first part of the user’s display name if $display_name is not specified.</li>
<li>last_name : (string) The user’s last name. For new users, will be used to build the second part of the user’s display name if $display_name is not specified.</li>
<li>description : (string) The user’s biographical description.</li>
<li>rich_editing : (string) Whether to enable the rich-editor for the user. Accepts ‘true’ or ‘false’ as a string literal, not boolean. Default ‘true’.</li>
<li>syntax_highlighting : (string) Whether to enable the rich code editor for the user. Accepts ‘true’ or ‘false’ as a string literal, not boolean. Default ‘true’.</li>
<li>comment_shortcuts : (string) Whether to enable comment moderation keyboard shortcuts for the user. Accepts ‘true’ or ‘false’ as a string literal, not boolean. Default ‘false’.</li>
<li>admin_color : (string) Admin color scheme for the user. Default ‘fresh’.</li>
<li>use_ssl : (bool) Whether the user should always access the admin over https. Default false.</li>
<li>user_registered : (string) Date the user registered. Format is <code>Y-m-d H:m:s</code>.</li>
<li>user_activation_key : (string) Password reset key. Default empty.</li>
<li>spam : (bool) Multisite only. Whether the user is marked as spam. Default false.</li>
<li>show_admin_bar_front : (string) Whether to display the Admin Bar for the user on the site’s front end. Accepts ‘true’ or ‘false’ as a string literal, not boolean. Default ‘true’.</li>
<li>locale : (string) User’s locale. Default empty.</li>
</ul>
<a href="https://simplejwtlogin.com/docs/register-user/" rel="nofollow ugc">Read More</a> on our website.
<h3>Delete User</h3>
Delete user it is disabled by default.
In order to delete a user, you have to configure where to search the details in the JWT. 
You can delete users by WordPress User ID or by Email address.
Also, you have to choose the JWT parameter key where email or user ID it is stored in the JWT.
Also, you can limit the deletion of users to specific IP addresses for security reasons.
<h3>Reset Password</h3>
Reset password and change password endpoints are disabled by default.
This plugin allows you to send the reset password endpoint, just by calling an endpoint. An email with the code will be sent to a specific email address.
Also, you are able to customize this email, or even not send at email at all.
The change password endpoint, changes the user password, based on the reset password code.
<a href="https://simplejwtlogin.com/docs/delete-user/" rel="nofollow ugc">Read More</a> on our website.
<h3>Authentication</h3>
This plugin allows users to generate JWT tokens based from WordPress user email and password.
In order to Get a new JWT, just make a POST request to /auth route with your WordPress email(or username) and password ( or password_hash) and the response will look something like this:
<pre><code> {
 "success": true,
 "data": {
 "jwt": "NEW_GENERATED_JWT_HERE"
 }
 }
</code></pre>
If you want to add extra parameters in the JWT payload, just send the parameter <code>payload</code> on <code>/auth</code> endpoint, and add a json with the values you want to be added in the payload.
At some point, the JWT will expire. 
So, if you want to renew it without having to ask again for user and password, you will have to make a POST request to the auth/refresh route.
This will generate a response with a new JWT, similar to the one that <code>/auth</code> generates.
If you want to get some details about a JWT, and validate that JWT, you can call <code>/auth/validate</code>. If you have a valid JWT, details about the available WordPress user will be returned, and some JWT details.
If you want to revoke a JWT, access <code>/auth/revoke</code> and send the <code>jwt</code> as a parameter.
The plugin auto-generates the example URL you might need to test these scenarios.
<a href="https://simplejwtlogin.com/docs/authentication/" rel="nofollow ugc">Read More</a> on our website.
<h3>Auth codes</h3>
Auth codes are optional, but you can enable them for Auto-login, Register User and Delete user.
This feature allows you to add a layer of protection to your API routes.
The Auth codes contains 3 parts: 
1. Authentication Key: This is the actual code that you have to add in the request. 
2. WordPress new User Role: can be used when you want to create multiple user types with the create user endpoint. If you leave it blank, the value configured in the ‘Register Settings’ will be used. 
3. Expiration Date: This allows you to set an expiration date for you auth codes. The format is `Y-M-D H:m:s’. Example : 2020-12-24 23:00:00. If you leave it blank, it will never expire.
Expiration date format: year-month-day hours:minutes:seconds
<a href="https://simplejwtlogin.com/docs/auth-codes/" rel="nofollow ugc">Read More</a> on our website.
<h3>Hooks</h3>
This plugin allows advanced users to link some hooks with the plugin and perform some custom scripts. 
Some available hooks:
<ul>
<li>
simple_jwt_login_login_hook
<ul>
<li>type: action</li>
<li>parameters: Wp_User $user</li>
<li>description: This hook it is called after the user has been logged in. </li>
</ul>
</li>
<li>
simple_jwt_login_redirect_hook
<ul>
<li>type: action</li>
<li>parameters: string $url, array $request</li>
<li>description: This hook it is called before the user it will be redirected to the page he specified in the login section. </li>
</ul>
</li>
<li>
simple_jwt_login_register_hook
<ul>
<li>type: action</li>
<li>parameters: Wp_User $user, string $plain_text_password</li>
<li>description: This hook it is called after a new user has been created. </li>
</ul>
</li>
<li>
simple_jwt_login_delete_user_hook
<ul>
<li>type: action</li>
<li>parameters: Wp_User $user</li>
<li>description: This hook it is called right after the user has been deleted.</li>
</ul>
</li>
<li>
simple_jwt_login_jwt_payload_auth
<ul>
<li>type: filter</li>
<li>parameters: array $payload, array $request</li>
<li>return: array $payload</li>
<li>description: This hook is called on /auth endpoint. Here you can modify payload parameters. </li>
</ul>
</li>
<li>
simple_jwt_login_no_redirect_message
<ul>
<li>type: filter</li>
<li>parameters: array $payload, array $request</li>
<li>return: array $payload</li>
<li>description: This hook is called on /autologin endpoint when the option <code>No Redirect</code> is selected. You can customize the message and add parameters.</li>
</ul>
</li>
<li>
simple_jwt_login_reset_password_custom_email_template
<ul>
<li>type: filter</li>
<li>parameters: string $template, array $request</li>
<li>return: string $template</li>
<li>description: This is executed when POST /user/reset_password is called. It will replace the email template that has been added in Reset Password settings </li>
</ul>
</li>
</ul>
View full list of hooks on <a href="https://simplejwtlogin.com/docs/hooks" rel="nofollow ugc">https://simplejwtlogin.com/docs/hooks</a>.
<h3>CORS</h3>
The CORS standard it is needed because it allows servers to specify who can access its assets and how the assets can be accessed. 
Cross-origin requests are made using the standard HTTP request methods like GET, POST, PUT, DELETE, etc.
<a href="https://simplejwtlogin.com/docs/cors/" rel="nofollow ugc">Read More</a> on our website.
<h3>Protect endpoints</h3>
This option is disabled by default. In order to enable it, you need to set “Protect endpoints enabled” to true.
This feature comes with 2 actions: 
– Apply on All REST Endpoints 
– Apply only on specific REST endpoints
When you choose <code>Apply on All REST Endpoints</code>, you will be able to whitelist some endpoints from your WordPress REST by adding them to the whitelist section. 
For example, If you only want to allow users to access the <code>wp/v2/posts</code> endpoint without having to provide the JWT, you save in the whitelist section <code>wp/v2/posts</code>
When you choose <code>Apply only on specific endpoints</code>, you will have to add all the endpoints you want to be protected by JWT.
When an endpoint is protected, and you don’t provide a JWT, you will get the following response:
<pre><code>{
 "success":false,
 "data":{
 "message":"Your are not authorized to access this endpoint.",
 "errorCode":403,
 "type":"simple-jwt-login-route-protect"
 }
}
</code></pre>
<a href="https://simplejwtlogin.com/docs/protect-endpoints/" rel="nofollow ugc">Read More</a> on our website.
<h3>Integration</h3>
PHP
In order to easily integrate your app/site with simple-jwt-login, we have developed a composer package.
<pre><code>composer require nicumicle/simple-jwt-login-client-php
</code></pre>
You can check the <a href="https://packagist.org/packages/nicumicle/simple-jwt-login-client-php" rel="nofollow ugc">package page</a> for more details and code examples.
Javascript
Also, there is a <a href="https://github.com/simple-jwt-login/js-sdk" rel="nofollow ugc">Javascript SDK</a> that you can install with <code>npm</code> or <code>yarn</code>.
<pre><code>npm install "simple-jwt-login"
</code></pre>
or
<pre><code>yarn add "simple-jwt-login"
</code></pre>

Simple JWT Login – Allows you to use JWT on REST endpoints.

This is what I needed, works as expected. Nice work!

Awesome plugin

Enhance the WordPress REST API with JWT authentication for secure access by mobile apps, external sites, and third-party services.

Twelve Legs Marketing SSO vs Simple JWT Login – Allows you to use JWT on REST endpoints.