Title: block internal authentication
Last modified: January 8, 2020

---

# block internal authentication

 *  [tabbsomat](https://wordpress.org/support/users/tabbsomat/)
 * (@tabbsomat)
 * [6 years, 3 months ago](https://wordpress.org/support/topic/block-internal-authentication/)
 * I’m missing the option to restrict the authentication to external services. This
   plugin currently creates too much effort when users have left the company.
    Besides
   of that the plugin seems to do a good job.

Viewing 6 replies - 1 through 6 (of 6 total)

 *  Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/)
 * (@figureone)
 * [6 years, 3 months ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12306400)
 * How would that help though? If their email account is also tied into the same
   external authentication, when they are removed from it, they can’t access their
   email anymore, and thus can’t reset their WordPress password to regain access.(
   This is assuming you are using the default behavior, where WordPress accounts
   are linked to external accounts via email.)
 *  Thread Starter [tabbsomat](https://wordpress.org/support/users/tabbsomat/)
 * (@tabbsomat)
 * [6 years, 3 months ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12308915)
 * Thank you, Paul, for your quick response.
    Our users authenticate with user name,
   only, omitting the domain part. I have concerns about the password hash stored
   in WordPress for users from the directory….
 * Besides of that: there’s always a risk that admin users create ordinary wordpress
   users accidently or intentionally. It is difficult do differentiate between these
   users and those from the directory. I want to have it clear: local users should
   be ignored.
 * I like the strict behavior of the simple ldap plugin in this case. Since that
   plugin has not been maintained for a while it has become incompatible to current
   versions of WP. Hence I have started to research for more recent ldap plugins.
   The Authorizer seems to fit best so far 🙂
 *  Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/)
 * (@figureone)
 * [6 years, 2 months ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12350446)
 * We’ll look into adding an option to disable local (WordPress) authentication,
   but just be aware that it can make your WordPress admin unreachable if something
   happens to your LDAP server.
 * Also FYI, no LDAP user passwords are stored in the WordPress database; when a
   new LDAP user authenticates, they get a random password assigned using `wp_generate_password()`:
   
   [https://github.com/uhm-coe/authorizer/blob/master/src/authorizer/class-authorization.php#L210](https://github.com/uhm-coe/authorizer/blob/master/src/authorizer/class-authorization.php#L210)
   [https://developer.wordpress.org/reference/functions/wp_generate_password/](https://developer.wordpress.org/reference/functions/wp_generate_password/)
 *  Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/)
 * (@figureone)
 * [6 years, 2 months ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12350449)
 * Will track that feature request here:
    [https://github.com/uhm-coe/authorizer/issues/89](https://github.com/uhm-coe/authorizer/issues/89)
 *  Thread Starter [tabbsomat](https://wordpress.org/support/users/tabbsomat/)
 * (@tabbsomat)
 * [6 years, 2 months ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12350689)
 * Thank you Paul, I’d still be happy to get that feature. 😉
 * Of course, once restricted to external authentication there’s no way to authenticate
   without having the external data source available – that is exactly my expected
   behavior.
 * On the other hand: WordPress Administrators chosing LDAP as Directory always 
   should be able to find their ways to bypass WordPress and to fix potential issues
   with their directories.
 * Regarding the password hashes: Accidently created local users have valid hashes.
   As long issue 89 hasn’t been implemented I continue to run a regular job checking
   for changed hashes in the database and updating them to a unusable one.
 * Thanks again and have a nice day,
    Thomas
    -  This reply was modified 6 years, 2 months ago by [tabbsomat](https://wordpress.org/support/users/tabbsomat/).
 *  Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/)
 * (@figureone)
 * [6 years, 1 month ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12479763)
 * Aloha, version 2.9.12 is out now with the “Disable WordPress logins” feature.
   Please test it out and let us know if you have any feedback.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘block internal authentication’ is closed to new replies.

 * ![](https://ps.w.org/authorizer/assets/icon-256x256.jpg?rev=1967453)
 * [Authorizer](https://wordpress.org/plugins/authorizer/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/authorizer/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/authorizer/)
 * [Active Topics](https://wordpress.org/support/plugin/authorizer/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/authorizer/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/authorizer/reviews/)

 * 6 replies
 * 2 participants
 * Last reply from: [Paul Ryan](https://wordpress.org/support/users/figureone/)
 * Last activity: [6 years, 1 month ago](https://wordpress.org/support/topic/block-internal-authentication/#post-12479763)