Daniel Bachhuber

Chris Reynolds

Pantheon Systems

John Spellman

Josh Koenig

Anais Pantheor

SAML authentication for WordPress, using the bundled OneLogin SAML library or optionally installed <a href="https://simplesamlphp.org/" rel="nofollow ugc">SimpleSAMLphp</a>. OneLogin provides a SAML authentication bridge; SimpleSAMLphp provides SAML plus a variety of other authentication mechanisms. This plugin acts as a bridge between WordPress and the authentication library.
If your organization uses Google Apps, <a href="https://pantheon.io/docs/wordpress-google-sso/" rel="nofollow ugc">integrating Google Apps with WP SAML Auth</a> takes just a few steps.
The standard user flow looks like this:
<ul>
<li>User can log in via SAML using a button added to the standard WordPress login view.</li>
<li>When the button is clicked, the user is handed off to the authentication library. With OneLogin, the user is redirected to the SAML identity provider. With SimpleSAMLphp, the user is redirected to the SimpleSAMLphp install.</li>
<li>Once the user is authenticated with the identity provider, they’re redirected back to WordPress and signed in to their account. A new WordPress user will be created if none exists (although this behavior can be disabled).</li>
<li>When the user logs out of WordPress, they are also logged out of the identity provider.</li>
</ul>
A set of configuration options allow you to change the plugin’s default behavior. For instance, <code>permit_wp_login=>false</code> will force all authentication to go through the SAML identity provider, bypassing <code>wp-login.php</code>. Similiarly, <code>auto_provision=>false</code> will disable automatic creation of new WordPress users.
See installation instructions for full configuration details.
<h3>Installing SimpleSAMLphp</h3>
The plugin supports both SimpleSAMLphp v1.x and v2.x. The autoloader is automatically detected:
SimpleSAMLphp v2.x uses <code>vendor/autoload.php</code> 
SimpleSAMLphp v1.x uses <code>lib/_autoload.php</code>
<h4>Default Search Paths</h4>
The plugin automatically searches for SimpleSAMLphp in these locations: 
* <code>ABSPATH . 'simplesaml'</code> 
* <code>ABSPATH . 'private/simplesamlphp'</code> 
* <code>ABSPATH . 'simplesamlphp'</code> 
* <code>ABSPATH . 'vendor/simplesamlphp/simplesamlphp'</code> (Composer installation) 
* <code>plugin_dir_path . 'simplesamlphp'</code>
For each path, the plugin checks for both <code>vendor/autoload.php</code> (v2.x) and <code>lib/_autoload.php</code> (v1.x).
This means Composer installations work automatically! If you run <code>composer require simplesamlphp/simplesamlphp</code> in your site root, the plugin will find it without any additional configuration.
<h4>Composer Installation (Advanced)</h4>
If you install SimpleSAMLphp via Composer to a custom location (not the standard <code>vendor/simplesamlphp/simplesamlphp</code>), you can specify the autoloader path:
<pre><code>add_filter( 'wp_saml_auth_option', function( $value, $option_name ) {
 if ( 'simplesamlphp_autoload' === $option_name ) {
 // Point to your custom Composer vendor autoloader
 return '/custom/path/vendor/autoload.php';
 }
 return $value;
}, 10, 2 );
</code></pre>
<h4>Custom Installation Paths</h4>
If SimpleSAMLphp is installed in a non-default location, you can set custom search paths with the <code>wp_saml_auth_simplesamlphp_path_array</code> filter:
<pre><code>add_filter( 'wp_saml_auth_simplesamlphp_path_array', function( $simplesamlphp_path_array ) {
 // Override default paths with custom paths
 return [ '/custom/path/to/simplesamlphp' ];
} );
</code></pre>
Or define an explicit autoloader path with the <code>wp_saml_auth_ssp_autoloader</code> filter:
<pre><code>add_filter( 'wp_saml_auth_ssp_autoloader', function( $ssp_autoloader ) {
 return ABSPATH . 'path/to/simplesamlphp/vendor/autoload.php';
} );<h3>WP-CLI Commands</h3>
</code></pre>
This plugin implements a variety of <a href="https://wp-cli.org" rel="nofollow ugc">WP-CLI</a> commands. All commands are grouped into the <code>wp saml-auth</code> namespace.
<pre><code>$ wp help saml-auth

NAME

 wp saml-auth

DESCRIPTION

 Configure and manage the WP SAML Auth plugin.

SYNOPSIS

 wp saml-auth <command>

SUBCOMMANDS

 scaffold-config Scaffold a configuration filter to customize WP SAML Auth usage.
</code></pre>
Use <code>wp help saml-auth <command></code> to learn more about each command.
Note: The <code>scaffold-config</code> command generates a configuration function with default values. The <code>simplesamlphp_autoload</code> option is not included in the scaffolded output because the plugin auto-detects SimpleSAMLphp installations. Only add this option manually if SimpleSAMLphp is in a non-standard location.
<h3>Contributing</h3>
See <a href="https://github.com/pantheon-systems/wp-saml-auth/blob/main/CONTRIBUTING.md" rel="nofollow ugc">CONTRIBUTING.md</a> for information on contributing.

WP SAML Auth

miniorange

The <a href="https://www.miniorange.com/customer-identity" rel="nofollow ugc">Customer Identity and Access Management (CIAM)</a> solution by miniOrange provides secure customer registration and login experiences through WordPress and multiple login devices and with strong authentication methods. miniOrange offers CIAM (Customer Identity and Access Management) solutions for both Cloud and On-premise environments. It allows you to securely manage customer identity and profile data as well as control user access to applications and services on WordPress easily. CIAM also offers customized and branded experiences for consumers, businesses, and enterprise customers.
<a href="https://blog.miniorange.com/what-is-ciam-customer-identity-and-access-management/" rel="nofollow ugc">miniOrange CIAM solution</a> for WordPress ensures a secure, seamless customer experience at extreme scale & performance whether it is web (or) mobile. Companies that use a Customer Identity solution can quickly onboard prospective customers by simplifying registration and providing <a href="https://www.miniorange.com/products/single-sign-on-sso" rel="nofollow ugc">Single Sign-On (SSO)</a>. In addition to acquiring customers faster, this solution helps organizations deliver frictionless user experiences and protect customer data throughout the customer lifecycle.
While IAM focuses on an inside solution (for employees), CIAM is a solution that focuses on the outside world (for external customers). Also, in a CIAM, users manage their own accounts and profiles. The CIAM Stores user data in a centralized cloud directory for maintaining customer profiles and data associated with it.
<h4>Multiple Login and Authentication methods:</h4>
<ul>
<li>
Social Login: 
Social Login through CIAM for WordPress allows social login, social share & commenting using widely used apps like Facebook, Google, LinkedIn, Twitter, Apple, Discord, Twitch, Line, Wechat, and 40 other apps available. Instead of requiring your visitors to waste time filling out the typical registration form, it allows them to register/login to your website using their social media profiles.
</li>
<li>
<a href="https://www.miniorange.com/products/single-sign-on-sso" rel="nofollow ugc">Single Sign-On</a>: 
Single Sign-On simplifies the user’s onboarding process allowing users to register by signing up or using social registration. It allows users to log in to multiple applications by using just one set of credentials.
</li>
<li>
<a href="https://www.miniorange.com/products/multi-factor-authentication-mfa" rel="nofollow ugc">Multi-Factor Authentication:</a> 
You can configure multiple WordPress 2FA/MFA methods like google authenticator, OTP over Email, OTP over SMS, etc., and choose any one method from a list of configured methods to use as 2FA/MFA for your WordPress website. Multi-factor authentication is helpful for cases such as when you do not have your phone and cannot access your TOTP app for login. You can then use other MFA methods like OTP over Email to login.
</li>
<li>
<a href="https://www.miniorange.com/products/identity-broker-service" rel="nofollow ugc">Identity Brokering</a>: 
Enables organizations to connect WordPress with other multiple service providers (SP) with different identity providers (IdP). This creates a trusting relationship with external identity providers & simplifies how online service providers can use existing trusted digital identities.
</li>
<li>
<a href="https://blog.miniorange.com/passwordless-authentication/" rel="nofollow ugc">Passwordless Login</a><a>:</a> 
Passwordless Login is a modern way of logging into your WordPress site without the use of a password. The plugin allows you to easily set up Passwordless Login for your site. Users would now be able to log in using their Username and OTP. If you wish to allow our users to fall back to Username and Password then the plugin also allows that.
</li>
<li>
<a href="https://www.miniorange.com/products/adaptive-multi-factor-authentication-mfa" rel="nofollow ugc">IP/Device/Time/Location Based Restriction:</a> 
CIAM for WordPress includes Adaptive Authentication which is an advanced form of <a href="https://blog.miniorange.com/what-is-multi-factor-authentication-mfa/" rel="nofollow ugc">Multi-factor authentication (MFA)</a> is a process of selecting the right authentication factors depending on a user’s risk profile like user’s behavior, device IP, time, geo-location, etc. to adapt the type of authorization factors.
</li>
<li>
Automated User Management: 
<a href="https://blog.miniorange.com/automated-user-provisioning/" rel="nofollow ugc">Automated User Management</a> (Automated User Provisioning & Deprovisioning) provides automated user synchronization from the identity provider to WordPress. It allows you to automate user creation, update and delete user information from the <a>IDP (identity provider)</a> in real-time to your WordPress site and automate user sync for WordPress from different IDPs. Streamline creation of app accounts, their access requests, and termination like a pro with an easy-to-implement <a>Provisioning solution.</a>
</li>
<li>
Password Policy Manager: 
It includes user’s password management features like auto password expiration, one-click password reset, Enforce strong password, role-based password policy, Enforce strong password for inactive users, password history management, and many more. Weak passwords are the primary perpetrator of WordPress hack assaults. To fix this issue, a password policy Manager was developed, password policy will help administrators ensure that their users use strong passwords
</li>
<li>
Universal Directory Authentication: 
One Directory to manage all identities, groups, and devices on-premises or in the cloud. We can help integrate multiple user directories, IDPs, and databases into one <a href=”https://www.miniorange.com/products/directory-services” target=”_blank”>Universal Directory which allows easy and seamless SSO and MFA access to WordPress. This Unified Directory stores all user attributes such as email addresses, usernames, passwords, user preferences, information about devices and networks, and much more.
</li>
</ul>
<h4>Key Features of miniOrange CIAM solution for WordPress:</h4>

<ul>
<li>
Cloud & On-Premise Hosting: 
The hosting of CIAM solutions on the cloud & on-premise allows organizations to leverage it across different environments and devices. Also, both types of hosting can be extended to support any number of applications.
</li>
<li>
Strong Authentication: 
Protocols like MFA, SSO, etc. enable the solution to detect identity theft and prevent dangerous bots from sending fake traffic to a website.
</li>
<li>
Scalability & Integration: 
Customer-facing apps see tens of thousands of users and the number keeps on growing as the business scales, hence the miniOrange CIAM solution is able to adapt to new integrations and fast-growing user volume.
</li>
<li>
Platform-based functionalities: 
The platform combines multiple features and services into a single user experience that is simple to understand and use.
</li>
<li>
Multisite Support: 
Supports configuring WordPress Multisite Network installation as an Identity Provider, allowing users to SSO login into Service Provider applications using WordPress Multisite credentials. (Premium Feature).
</li>
<li>
Interface customization: 
This allows for modifying and delivering a personalized and user-friendly experience to customers.
</li>
<li>
No Setup required: 
Simply register with us and use our pre-configured application. We will handle everything for you.
</li>
<li>
24 / 7 Support: 
If you face any issues or simply require assistance with the WordPress CIAM solution by miniOrange, please contact us. Whatever it may be, we will solve the issue for you and get everything working as soon as possible.
</li>
</ul>
<h4>Personalization to Improve the Customer Experience</h4>

<a href=”https://miniorange.com” target=”_blank”>miniOrange’s Customer Identity and Access Management (CIAM) for WordPress Solution can help companies build customer trust while minimizing operating costs and maximizing revenue and retention. By building trust and loyalty with customers, CIAM can help you acquire more customers, build more customer interactions, and influence cross-sells. 
Customer Identity Management System gathers data about customers as they move through the customer journey. This data is used to build a profile of customer preferences on WordPress, which can then be used to customize product offerings and communications. New information, such as a change of address, is automatically shared with apps that use the customer profile. 
Although CIAM and IAM solutions share the same building blocks, the traditional IAM solutions cannot be extended to replace/act in place of a CIAM solution. The unique requirement of a client-facing application needs a flexible and scalable Identity and Access Management solution that requires a dedicated solution built on top of IAM features. 
By exploiting identification data to gain and retain consumers, CIAM generates revenue growth. CIAM systems are intended to supply, authenticate, authorize, collect, and store consumer information from a variety of sources.
<h4>Benefits of using the CIAM WordPress plugin:</h4>
<ul>
<li>
Effortless Secure Login 
CIAM WordPress ensures that only authorized users get access to sensitive data. Implement password policies like Password length, complexity, restrictions on password reuse, session timeout and self-service password reset policy to strengthen security without holding up your users access.
</li>
<li>
Easy Integration 
Delight customers with secure, easy-to-use scalable plugins and APIs which improve the overall customer experience.
</li>
<li>
Seamless Customer Experience 
CIAM for WordPress provides brands with a holistic view of customers found in customer profiles while providing users with a better experience.
</li>
<li>
Remote Workforce Access 
Get secure access to tools and devices they require in a timely manner from any location – without compromising security.
</li>
<li>
Maximize Conversion Rate 
Provide an easy-to-use environment that would boost productivity for the customer workforce.
</li>
<li>
Migrate to a Digital Environment 
Retire legacy identity and integrate our secure and scalable app development.
</li>
<li>
Secure On-premise and Cloud services 
Choose the cloud or on-premise service provider and deployment option that fits your long-term growth strategy through the CIAM WordPress solution.
</li>
</ul>
<h4>Website –</h4>
For more support or info email us at idpsupport@xecurify.com or <a href="https://idp.miniorange.com/free-trial" rel="nofollow ugc">Contact us</a> for a free trial. You can also submit your query from the plugin’s configuration page.

Customer Identity (CIAM) – miniOrange

SSO into 4500+ cloud applications using SAML.

WP SAML Auth vs Customer Identity (CIAM) – miniOrange