Daniel Bachhuber

Chris Reynolds

Pantheon Systems

John Spellman

Josh Koenig

Anais Pantheor

SAML authentication for WordPress, using the bundled OneLogin SAML library or optionally installed <a href="https://simplesamlphp.org/" rel="nofollow ugc">SimpleSAMLphp</a>. OneLogin provides a SAML authentication bridge; SimpleSAMLphp provides SAML plus a variety of other authentication mechanisms. This plugin acts as a bridge between WordPress and the authentication library.
If your organization uses Google Apps, <a href="https://pantheon.io/docs/wordpress-google-sso/" rel="nofollow ugc">integrating Google Apps with WP SAML Auth</a> takes just a few steps.
The standard user flow looks like this:
<ul>
<li>User can log in via SAML using a button added to the standard WordPress login view.</li>
<li>When the button is clicked, the user is handed off to the authentication library. With OneLogin, the user is redirected to the SAML identity provider. With SimpleSAMLphp, the user is redirected to the SimpleSAMLphp install.</li>
<li>Once the user is authenticated with the identity provider, they’re redirected back to WordPress and signed in to their account. A new WordPress user will be created if none exists (although this behavior can be disabled).</li>
<li>When the user logs out of WordPress, they are also logged out of the identity provider.</li>
</ul>
A set of configuration options allow you to change the plugin’s default behavior. For instance, <code>permit_wp_login=>false</code> will force all authentication to go through the SAML identity provider, bypassing <code>wp-login.php</code>. Similiarly, <code>auto_provision=>false</code> will disable automatic creation of new WordPress users.
See installation instructions for full configuration details.
<h3>Installing SimpleSAMLphp</h3>
The plugin supports both SimpleSAMLphp v1.x and v2.x. The autoloader is automatically detected:
SimpleSAMLphp v2.x uses <code>vendor/autoload.php</code> 
SimpleSAMLphp v1.x uses <code>lib/_autoload.php</code>
<h4>Default Search Paths</h4>
The plugin automatically searches for SimpleSAMLphp in these locations: 
* <code>ABSPATH . 'simplesaml'</code> 
* <code>ABSPATH . 'private/simplesamlphp'</code> 
* <code>ABSPATH . 'simplesamlphp'</code> 
* <code>ABSPATH . 'vendor/simplesamlphp/simplesamlphp'</code> (Composer installation) 
* <code>plugin_dir_path . 'simplesamlphp'</code>
For each path, the plugin checks for both <code>vendor/autoload.php</code> (v2.x) and <code>lib/_autoload.php</code> (v1.x).
This means Composer installations work automatically! If you run <code>composer require simplesamlphp/simplesamlphp</code> in your site root, the plugin will find it without any additional configuration.
<h4>Composer Installation (Advanced)</h4>
If you install SimpleSAMLphp via Composer to a custom location (not the standard <code>vendor/simplesamlphp/simplesamlphp</code>), you can specify the autoloader path:
<pre><code>add_filter( 'wp_saml_auth_option', function( $value, $option_name ) {
 if ( 'simplesamlphp_autoload' === $option_name ) {
 // Point to your custom Composer vendor autoloader
 return '/custom/path/vendor/autoload.php';
 }
 return $value;
}, 10, 2 );
</code></pre>
<h4>Custom Installation Paths</h4>
If SimpleSAMLphp is installed in a non-default location, you can set custom search paths with the <code>wp_saml_auth_simplesamlphp_path_array</code> filter:
<pre><code>add_filter( 'wp_saml_auth_simplesamlphp_path_array', function( $simplesamlphp_path_array ) {
 // Override default paths with custom paths
 return [ '/custom/path/to/simplesamlphp' ];
} );
</code></pre>
Or define an explicit autoloader path with the <code>wp_saml_auth_ssp_autoloader</code> filter:
<pre><code>add_filter( 'wp_saml_auth_ssp_autoloader', function( $ssp_autoloader ) {
 return ABSPATH . 'path/to/simplesamlphp/vendor/autoload.php';
} );<h3>WP-CLI Commands</h3>
</code></pre>
This plugin implements a variety of <a href="https://wp-cli.org" rel="nofollow ugc">WP-CLI</a> commands. All commands are grouped into the <code>wp saml-auth</code> namespace.
<pre><code>$ wp help saml-auth

NAME

 wp saml-auth

DESCRIPTION

 Configure and manage the WP SAML Auth plugin.

SYNOPSIS

 wp saml-auth <command>

SUBCOMMANDS

 scaffold-config Scaffold a configuration filter to customize WP SAML Auth usage.
</code></pre>
Use <code>wp help saml-auth <command></code> to learn more about each command.
Note: The <code>scaffold-config</code> command generates a configuration function with default values. The <code>simplesamlphp_autoload</code> option is not included in the scaffolded output because the plugin auto-detects SimpleSAMLphp installations. Only add this option manually if SimpleSAMLphp is in a non-standard location.
<h3>Contributing</h3>
See <a href="https://github.com/pantheon-systems/wp-saml-auth/blob/main/CONTRIBUTING.md" rel="nofollow ugc">CONTRIBUTING.md</a> for information on contributing.

WP SAML Auth

miniorange

Login with Salesforce allows users residing at SAML 2.0 capable Identity Provider to login to your WordPress website. We support all known IdPs – Google Apps, ADFS, Azure AD, Okta, Salesforce, Shibboleth, SimpleSAMLphp, OpenAM, Centrify, Ping, RSA, IBM, Oracle, OneLogin, Bitium, WSO2, NetIQ etc.
Login with Salesforce Plugin acts as a SAML 2.0 Service Provider which can be configured to establish the trust between the plugin and a SAML 2.0 capable Identity Providers to securely authenticate the user to the WordPress site.
WordPress Multi-Site Environment and ability to configure Multiple IDP’s against wordpress as service provider is also supported in premium plugin.
This plugin is also compatible with WordPress OAuth Server plugin. You can now make your WordPress site an OAuth Server and have the users authenticate themselves with your SAML-compliant IDPs like ADFS, Azure AD, OneLogin instead of their WordPress credentials.
If you require any Single Sign On (SSO) application or need any help with installing this plugin, please feel free to email us at info@xecurify.com or <a href="http://miniorange.com/contact" rel="nofollow ugc">Contact us</a>.
<h4>Free Version Features</h4>
<ul>
<li>Unlimited authentication with your SAML 2.0 compliant Identity Providers like ADFS, Azure AD, Okta, Salesforce, Shibboleth, SimpleSAMLphp, OpenAM, Centrify, Ping, RSA, IBM, Oracle, OneLogin, Bitium, WSO2, NetIQ etc.</li>
<li>Automatic user registration after login if the user is not already registered with your site.</li>
<li>Use Widgets to easily integrate the login link with your WordPress site.</li>
<li>Use Basic Attribute Mapping feature to map wordpress user profile attributes like First Name, Last Name to the attributes provided by your IDP.</li>
<li>Select default role to assign to users on auto registration.</li>
<li>Force authentication with your IDP on each login attempt.</li>
</ul>
<h4>Premium Version Features</h4>
<ul>
<li>All the Free version features.</li>
<li>SAML Single Logout [Premium] – Support for SAML Single Logout (Works only if your IDP supports SLO).</li>
<li>Auto-redirect to IDP [Premium] – Auto-redirect to your IDP for authentication without showing them your WordPress site’s login page.</li>
<li>Protect Site [Premium] – Protect your complete site. Have users authenticate themselves before they could access your site content.</li>
<li>Advanced Attribute Mapping [Premium] – Use this feature to map your IDP attributes to your WordPress site attributes like Username, Email, First Name, Last Name, Group/Role, Display Name.</li>
<li>Advanced Role Mapping [Premium] – Use this feature to assign WordPress roles your users based on the group/role sent by your IDP.</li>
<li>Short Code [Premium] – Use Short Code (PHP or HTML) to place the login link wherever you want on the site.</li>
<li>Reverse-proxy Support [Premium] – Support for sites behind a reverse-proxy.</li>
<li>Select Binding Type [Premium] – Select HTTP-Post or HTTP-Redirect binding type to use for sending SAML Requests.</li>
<li>Integrated Windows Authentication [Premium] – Support for Integrated Windows Authentication (IWA)</li>
<li>Step-by-step Guides [Premium] – Use step-by-step guide to configure your Identity Provider like ADFS, Centrify, Google Apps, Okta, OneLogin, Salesforce, SimpleSAMLphp, Shibboleth, WSO2, JBoss Keycloak, Oracle.</li>
<li>
WordPress Multi-site Support [Premium] – Multi-Site environment is one which allows multiple subdomains / subdirectories to share a single installation. With multisite premium plugin, you can configure the IDP in minutes for all your sites in a network. While, if you have basic premium plugin, you have to do plugin configuration on each site individually as well as multiple service provider configuration’s in the IDP.
For Example – If you have 1 main site with 3 subsites. Then, you have to configure the plugin 3 times on each site as well as 3 service provider configurations in your IDP. Instead, with multisite premium plugin. You have to configure the plugin only once on main network site as well as only 1 service provider configuration in the IDP.
</li>
<li>
Multiple SAML IDPs Support [Premium] – We now support configuration of Multiple IDPs in the plugin to authenticate the different group of users with different IDP’s. You can give access to users by users to IDP mapping (which IDP to use to authenticate a user) is done based on the domain name in the user’s email. (This is a PREMIUM feature with separate licensing. Contact us at info@xecurify.com to get licensing plans for this feature.)
</li>
<li>
If you are looking for an Identity Provider,you can try out <a href="https://idp.miniorange.com" rel="nofollow ugc">miniOrange On-Premise IdP</a>.
</li>
</ul>
<h4>Website –</h4>
Check out our website for other plugins <a href="http://miniorange.com/plugins" rel="nofollow ugc">http://miniorange.com/plugins</a> or <a href="https://wordpress.org/plugins/search.php?q=miniorange" rel="ugc">click here</a> to see all our listed WordPress plugins. 
For more support or info email us at info@xecurify.com or <a href="http://miniorange.com/contact" rel="nofollow ugc">Contact us</a>. You can also submit your query from plugin’s configuration page.

Login with Salesforce

Login with Salesforce provides SSO into Wordpress via Salesforce communities and much more.

WP SAML Auth vs Login with Salesforce