WordPress SAML Service Provider with optional LDAP fallback.<\/p>\n\n
Source: https:\/\/github.com\/Considbrs-Webdev\/signclave-sso<\/p>\n\n
Features:\n- SAML SSO redirect on This plugin follows WordPress and OWASP-oriented practices:<\/p>\n\n Settings \u2192 Signclave SSO<\/strong> ( Use the emergency URL shown under Security<\/strong> in plugin settings. It includes a secret key. Existing WordPress accounts can also sign in via SAML when the IdP No. Leave Enable LDAP fallback authentication<\/strong> unchecked for SAML-only sites. Turn it on only when you want directory verification for new account creation and LDAP password login.<\/p><\/dd>\n Yes. Browser SSO sends the user to your Identity Provider<\/strong> (for example F5 APM). When LDAP is enabled, the WordPress server connects to your directory<\/strong> (ldaps:\/\/ recommended) for binds and searches. No traffic is sent to the plugin author or to wordpress.org for authentication.<\/p><\/dd>\n Enable Trust proxy HTTPS headers<\/strong> only if the proxy is trusted and strips client-supplied headers.<\/p><\/dd>\n Apache gets From the WordPress root, with the plugin active: docs\/f5-apm.md ships with the plugin, including the staging checks. The IdP SSO URL must be the HTTP-POST<\/strong> endpoint; the plugin does not send HTTP-Redirect AuthnRequests.<\/p><\/dd>\n These four filters are the public extension API (signatures will not change in patch releases):<\/p>\n\n signclave_sso_trust_proxy_headers remains available for proxy HTTPS detection.<\/p><\/li>\n<\/ul><\/dd>\n\n<\/dl>\n\n\nwp-login.php<\/code>\n- Signed assertion validation (XML signature + digest)\n- Replay protection, signed RelayState, redirect allowlisting\n- Optional LDAP authentication fallback\n- Optional group-to-role mapping\n- Security audit logging<\/p>\n\nSecurity<\/h3>\n\n
\n
?password=1&signclave_sso_key=...<\/code>), not a public flag.<\/li>\nmanage_options<\/code> and nonces.<\/li>\n.htaccess<\/code>.<\/li>\n<\/ul>\n\n\n\n
signclave-sso<\/code> to \/wp-content\/plugins\/<\/code>.<\/li>\n\n
Where are the settings?<\/h3><\/dt>\n
options-general.php?page=signclave-sso<\/code>). There is no top-level admin menu.<\/p><\/dd>\nHow do local WordPress admins log in when SSO is enabled?<\/h3><\/dt>\n
uid<\/code> matches user_login<\/code>; after the first login identity is the stored NameID.<\/p><\/dd>\nDoes SAML require LDAP?<\/h3><\/dt>\n
Does this plugin contact external servers?<\/h3><\/dt>\n
Behind a reverse proxy \/ load balancer?<\/h3><\/dt>\n
How do I hide the plugin log directory on Nginx?<\/h3><\/dt>\n
.htaccess<\/code> automatically. On Nginx, deny wp-content\/uploads\/signclave-sso\/<\/code> in the server block. See docs\/instructions.md<\/code> in the plugin folder.<\/p><\/dd>\nWhat if wp-admin is locked out?<\/h3><\/dt>\n
wp signclave sso disable<\/code> turns off auto-redirect to the IdP. wp signclave rotate-key<\/code> prints a new emergency login URL. Full command list is in docs\/instructions.md<\/code>.<\/p><\/dd>\nWhere is the F5 \/ eDirectory profile documented?<\/h3><\/dt>\n
Which filters are supported?<\/h3><\/dt>\n
\n
signclave_sso_map_attributes<\/code> \u2014 ( array $mapped, array $rawAttrs )<\/code>. $mapped<\/code> keys: username<\/code>, email<\/code>, first<\/code>, last<\/code>, groups<\/code>, nameId<\/code>. Runs after SAML attribute extraction, before LDAP enrich. nameId<\/code> is informational (identity stays the signed assertion NameID).<\/li>\nsignclave_sso_user_roles<\/code> \u2014 ( string[] $roles, WP_User $user, string[] $groups, string $source )<\/code>. Last word on roles after group mapping.<\/li>\nsignclave_sso_allow_login<\/code> \u2014 ( true|WP_Error $allow, WP_User $user, array $context )<\/code>. Return a WP_Error<\/code> to reject a valid SAML assertion before the auth cookie is set.<\/li>\nsignclave_sso_authn_request<\/code> \u2014 ( string $xml, array $saml )<\/code>. Adjust the outbound AuthnRequest XML before it is POSTed to the IdP.<\/p>\n\n1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
considboras<\/code>.<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n
\n
0.1.21<\/h4>\n\n
\n
considboras<\/code> as a contributor, and delete only signclave_sso_<\/code> transients on uninstall.<\/li>\n<\/ul>\n\n0.1.20<\/h4>\n\n
\n
signclave_sso_<\/code> prefix. Existing sls_options<\/code> are still read until the first save.<\/li>\n<\/ul>\n\n0.1.19<\/h4>\n\n
\n
SIGNCLAVE_SSO_<\/code> prefix.<\/li>\n<\/ul>\n\n0.1.18<\/h4>\n\n
\n
0.1.17<\/h4>\n\n
\n
signclave-sso<\/code>. WP-CLI is wp signclave<\/code>.<\/li>\nsls_options<\/code> are read until the first save, which stores sc_options<\/code>.<\/li>\nsignclave_sso_<\/code> prefix.<\/li>\n<\/ul>\n\n0.1.16<\/h4>\n\n
\n
0.1.15<\/h4>\n\n
\n
node_modules<\/code> as an optional exclude so CI can run without npm install.<\/li>\n<\/ul>\n\n0.1.14<\/h4>\n\n
\n
0.1.13<\/h4>\n\n
\n
0.1.12<\/h4>\n\n
\n
0.1.11<\/h4>\n\n
\n
user_login<\/code> (LDAP-optional 0.1.3 rule). Afterwards identity stays the stored NameID. Email still cannot choose the SAML account.<\/li>\n0.1.10<\/h4>\n\n
\n
bin\/plugin-check.sh<\/code>, .distignore<\/code>).<\/li>\nwp_unslash<\/code> on REMOTE_ADDR<\/code> and trusted forwarded HTTPS headers.<\/li>\n<\/ul>\n\n0.1.9<\/h4>\n\n
\n
wp_roles()<\/code>. Uninstall deletes sc_*<\/code> transients.<\/li>\n0.1.8<\/h4>\n\n
\n
options.php<\/code>) and menu under Settings<\/strong> (not a top-level item).<\/li>\nsv_SE<\/code>; npm run translate*<\/code>.<\/li>\nsc_map_attributes<\/code>, sc_user_roles<\/code>, sc_allow_login<\/code>, sc_authn_request<\/code>.<\/li>\nwp signclave sso<\/code>, rotate-key<\/code>, test-ldap<\/code>, test-saml<\/code>, doctor<\/code>.<\/li>\n0.1.7<\/h4>\n\n
\n
0.1.6<\/h4>\n\n
\n
Signclave\\<\/code>), config helpers, instance DI, Vite-built admin assets in dist\/<\/code>. Login behavior unchanged from 0.1.5.<\/li>\n<\/ul>\n\n0.1.5<\/h4>\n\n
\n
0.1.4<\/h4>\n\n
\n
0.1.3<\/h4>\n\n
\n
0.1.2<\/h4>\n\n
\n
0.1.1<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n
0.0.2<\/h4>\n\n
\n
0.0.1<\/h4>\n\n
\n