Adds seven partial interface translations and GitHub bug reporting links. Choose your WordPress site or profile language to use them. Custom wording and existing settings are retained; untranslated technical text uses English.<\/p>","1.3.2":"
Replace [sso_oauth_login] placements with [portalweave_sso_login]. Custom button CSS is no longer rendered; move needed styles into WordPress's built-in editor. Existing private-media files retain their recorded recovery paths.<\/p>","1.3.1":"
Security update for REST content restrictions, Application Password account policies and login auditing. Existing settings and credentials are retained.<\/p>","1.3.0":"
Choose whether to sign out of this site alone or also the named identity provider. Providers without a configured end-session endpoint show site-only sign-out and Go back. Existing confirmation preferences are retained.<\/p>","1.2.1":"
Adds trusted-proxy IP resolution. Configure trusted proxy addresses and the forwarding header in wp-config.php when the web server has not already restored REMOTE_ADDR. IP collection remains off by default.<\/p>","1.2.0":"
Adds visual mapping editors, an unsaved-settings reminder, organized integration panels, audit pagination and media-library logos. Existing configuration and credentials are retained. Find PortalWeave SSO directly in the admin sidebar.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3797445,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3797445,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3797445,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3797445,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.2","1.4.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[602,2061,43290,191844,2469],"plugin_category":[38],"plugin_contributors":[292123],"plugin_business_model":[],"class_list":["post-401893","plugin","type-plugin","status-publish","hentry","plugin_tags-login","plugin_tags-oauth","plugin_tags-openid-connect","plugin_tags-scim","plugin_tags-sso","plugin_category-authentication","plugin_contributors-robothanzo","plugin_committers-robothanzo"],"banners":{"banner":"https:\/\/ps.w.org\/portalweave-sso\/assets\/banner-772x250.png?rev=3797445","banner_2x":"https:\/\/ps.w.org\/portalweave-sso\/assets\/banner-1544x500.png?rev=3797445","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/portalweave-sso\/assets\/icon-128x128.png?rev=3797445","icon_2x":"https:\/\/ps.w.org\/portalweave-sso\/assets\/icon-256x256.png?rev=3797445","generated":false},"screenshots":[],"raw_content":"\n
PortalWeave SSO connects a site to administrator-configured OAuth 2.0 and OpenID Connect identity providers. Authorization Code with S256 PKCE is the default. Public clients can use PKCE without a client secret.<\/p>\n\n
All bundled functionality is available without a developer account, license key, paid upgrade or trial expiry. Optional module switches are configuration controls. Guest-account expiry is a site access policy, not a limit on plugin functionality. Identity providers may impose their own account, subscription or usage requirements.<\/p>\n\n
SSO requires HTTPS and PHP OpenSSL. Client credentials and tokens are encrypted using this installation's WordPress salts; keep those salts stable. Native abilities require WordPress 6.9+. External MCP clients also require the separately installed WordPress MCP Adapter. This plugin does not call an AI model service.<\/p>\n\n
This is an independent plugin. Provider names describe integrations and do not imply endorsement or affiliation.<\/p>\n\n
The plugin has no developer-hosted authentication, tracking, licensing or update service. It sends no telemetry to its author and downloads no remote executable code. All plugin JavaScript and CSS are distributed locally.<\/p>\n\n
Report a bug opens the GitHub issue tracker<\/a> only when selected. No configuration or logs are attached automatically. GitHub receives the browser request and any information you submit. Privacy<\/a>, terms<\/a>.<\/p>\n\n Each service below is an optional identity provider used to sign users in and obtain the configured profile\/group claims for local account and access decisions. No provider is contacted until an administrator configures it and its authentication flow runs. Preset setup and bundled logos work locally.<\/p>\n\n For every configured identity service below, sign-in sends the browser to its authorization endpoint with the client identifier, scopes, callback URL, random state\/nonce and PKCE challenge. WordPress sends the returned authorization code, PKCE verifier and configured client authentication to that service's token endpoint; it sends an access token when requesting profile or group data. Public signing-key requests send no user token. Explicit refresh sends the refresh token and client authentication. Configured logout sends the browser to that service with client ID, callback, state and an ID-token hint when available. An explicitly enabled legacy Password grant sends the entered username\/password to that provider over HTTPS without retaining the password; the legacy Implicit grant returns tokens through the browser callback. These transfers happen only for the configured login, validation, refresh or logout operation. Tokens are never included in audit or support exports.<\/p>\n\n Preset service policy references:<\/p>\n\n Optional mapped pictures and custom provider or WordPress sign-in icons are browser requests to the selected image hosts when displayed, including login pages and administrator previews. Hosts receive the visitor's IP address and ordinary browser request information; sign-in icons use a no-referrer policy. Uploaded icons use the site's media delivery service. Support email sends the administrator's message through the site's mail service to the chosen recipient only on explicit submission (or an explicit support-ability send request); redacted configuration is attached only when requested. Booking, forum and demo links open only when selected. The site operator must disclose these actual image, mail, support and link destinations and their policies.<\/p>\n\n Optional SCIM accepts incoming authenticated provisioning requests from the administrator's chosen client and returns account\/group data; it does not select or contact a vendor. Optional shared-subdomain SSO sends selected identity claims in a signed, unencrypted one-minute cookie to explicitly trusted sites, without OAuth tokens. Optional abilities return authorized configuration, diagnostics and audit data through the separately installed MCP Adapter to the chosen client; this plugin does not call an AI service. Disclose the actual provisioning, trusted-site and MCP\/client operators' terms and privacy policies before enabling them.<\/p>\n\n The external-services document is included in the ZIP. Its maintained source is available here<\/a>. Site operators must publish the policies applicable to their configured providers. One Identity policy pages may restrict automated retrieval; confirm the applicable OneLogin agreement with your account contact. ClassLink's privacy notice refers to school\/organization license and service-level agreements supplied by ClassLink, rather than a universal public service contract.<\/p>\n\n The plugin stores local identity links, mapped profile fields, group memberships and encrypted tokens. Authentication auditing can be disabled. When enabled, it retains username, email, provider, status, time and navigation path for the configured retention period (90 days by default). IP recording is a separate opt-in and defaults off. Debug records expire after seven days; local support drafts expire after one day. Scheduled cleanup requires working WordPress cron.<\/p>\n\n Login\/logout state cookies last up to ten minutes. Optional JWT sign-in uses a five-minute challenge cookie; optional shared-subdomain sign-in uses a signed one-minute cookie containing selected identity attributes, not OAuth tokens. WordPress manages its normal login cookies.<\/p>\n\n Suggested privacy-policy text is available in the WordPress privacy tools. Personal-data exports include audit and linked profile information but exclude credentials. Erasure anonymizes audit data, removes local provider links\/tokens\/groups and known plugin-mapped custom fields, and revokes sessions. It preserves the WordPress account, roles, content, moderation\/provisioning blocks and private files. Other multisite sites and external providers manage their own retained data. Later sign-in\/provisioning may supply profile data again.<\/p>\n\n Deactivation preserves data. Uninstall preserves settings unless the administrator enables data removal. Even with removal enabled, WordPress accounts, content, public mapped profile values, private-media files and their recovery metadata are retained. Review docs\/privacy.md and include the private vault in server backups. The plugin does not claim to provide or guarantee legal compliance.<\/p>\n\n\n Upgrades from PortalWeave SSO 1.0.1 retain existing configuration. Replacing an installation that uses the earlier technical namespace requires the controlled procedure in docs\/provider-setup.md; there are no earlier-name aliases or automatic conversion of that stored data. Restrict access externally during that replacement, including settings, identity links, access rules, provider URLs and private-media metadata.<\/p>\n\n Optional features start disabled. Use the distributed user guides for provider, SCIM, media and MCP setup. Development source and build tools are publicly maintained<\/a>.<\/p>\n\n\n Bundled translations cover common interface text and sign-in\/sign-out screens in Spanish, French, German, Brazilian Portuguese, Simplified Chinese, Traditional Chinese and Japanese. Choose your Site Language in WordPress Settings > General, or your personal administration language in Users > Profile. Technical text without a translation uses English. Custom provider names, button text and messages stay as entered.<\/p><\/dd>\n\n
Privacy and data retention<\/h3>\n\n
\n
\n
Which languages are included?<\/h3><\/dt>\n
Where can I report a bug?<\/h3><\/dt>\n