{"id":347051,"date":"2026-08-01T17:57:18","date_gmt":"2026-08-01T17:57:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/active-directory-multi-domain-auth-acl\/"},"modified":"2026-08-01T17:57:08","modified_gmt":"2026-08-01T17:57:08","slug":"sanch-multidomain-ldap-auth","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/sanch-multidomain-ldap-auth\/","author":23539842,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.0.2","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Sanch MultiDomain LDAP Auth for Active Directory","header_author":"sanchshevchuk","header_description":"Enterprise AD Integration: Zero-Trust ACL, Smart Tree Routing, Loop\/Search Leak Protection, LDAP Clone Guard, and Role Cap Merge.","assets_banners_color":"","last_updated":"2026-08-01 17:57:08","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":33,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"sanchshevchuk","date":"2026-08-01 17:57:08"}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[14437,2463,710,2464,10643],"plugin_category":[38],"plugin_contributors":[274183],"plugin_business_model":[],"class_list":["post-347051","plugin","type-plugin","status-publish","hentry","plugin_tags-acl","plugin_tags-active-directory","plugin_tags-authentication","plugin_tags-ldap","plugin_tags-multi-domain","plugin_category-authentication","plugin_contributors-sanchshevchuk","plugin_committers-sanchshevchuk"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/sanch-multidomain-ldap-auth.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Sanch MultiDomain LDAP Auth for Active Directory provides enterprise-grade Single Sign-On (SSO) and access control for corporate WordPress intranets. Built for multi-forest environments, it allows users to authenticate seamlessly against multiple Domain Controllers while strictly enforcing path-based access policies and dynamic role propagation.<\/p>\n\n<h4>Key Features<\/h4>\n\n<ul>\n<li><strong>Multi-Domain &amp; Multi-DC Authentication:<\/strong> Connect and authenticate against multiple LDAP\/LDAPS servers across different Active Directory domains\/UPN suffixes.<\/li>\n<li><strong>Zero-Trust Path-Based ACL:<\/strong> Restrict intranet sections, categories, and custom routes based on AD Group Membership (CN) or mapped WP Roles.<\/li>\n<li><strong>JIT Provisioning &amp; Single Source of Truth:<\/strong> Automatic user creation on first successful AD bind, with optional strict role sync on every login.<\/li>\n<li><strong>LDAP Clone Protection:<\/strong> Detects and prevents authentication if multiple accounts match the same SAMAccountName across refined Base DNs to block privilege escalation.<\/li>\n<li><strong>REST API &amp; Write ACL Protection:<\/strong> Enforces URL routing policies over REST API endpoints and post\/page editing privileges (<code>map_meta_cap<\/code>).<\/li>\n<li><strong>Secure Connections:<\/strong> Supports LDAP (Plaintext), LDAP + StartTLS, and LDAPS (SSL\/TLS Encrypted).<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>sanch-multidomain-ldap-auth<\/code> directory to the <code>\/wp-content\/plugins\/<\/code> directory.<\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n<li>Ensure the PHP LDAP extension (<code>php-ldap<\/code>) is installed and enabled on your web server.<\/li>\n<li>Navigate to <strong>Settings -&gt; AD Auth Settings<\/strong> in your WordPress admin dashboard.<\/li>\n<li>Configure your Domain Controllers (IP, Port, Domain, Base DN) and define your AD Group to WP Role mapping rules.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20require%20the%20php%20ldap%20extension%3F\"><h3>Does this plugin require the PHP LDAP extension?<\/h3><\/dt>\n<dd><p>Yes, your web server must have the <code>php-ldap<\/code> PHP module enabled to initiate connections with your Active Directory Domain Controllers.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20an%20ad%20user%20does%20not%20belong%20to%20any%20mapped%20group%3F\"><h3>What happens if an AD user does not belong to any mapped group?<\/h3><\/dt>\n<dd><p>By default under Zero-Trust policy, authentication will fail with an \"Access Denied\" message if the user does not belong to at least one mapped AD Group.<\/p><\/dd>\n<dt id=\"how%20are%20custom%20wp%20roles%20handled%3F\"><h3>How are custom WP roles handled?<\/h3><\/dt>\n<dd><p>You can select existing WordPress roles or create custom role slugs directly from the settings page, assigning base capability sets (<code>subscriber<\/code>, <code>editor<\/code>, <code>author<\/code>, <code>administrator<\/code>).<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release. Features Multi-Domain authentication, LDAP Clone Guard, StartTLS\/LDAPS support, and Zero-Trust path-based ACL routing.<\/li>\n<\/ul>","raw_excerpt":"Enterprise Active Directory integration featuring multi-domain authentication, Zero-Trust ACL URL routing, and dynamic role mapping.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/347051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=347051"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sanchshevchuk"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=347051"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=347051"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=347051"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=347051"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=347051"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=347051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}