Single Sign-On (SSO) for WordPress

Single Sign-On (SSO) for logging in to a WordPress site can be enabled using any identity provider (IdP) that supports Security Assertion Markup Language (SAML). Most IdPs can support SAML.

VIP does not support other SSO technologies for WordPress logins at this time, and cannot install any middleware required in some Shibboleth configurations.

Requirement

WordPress sites with SSO enabled must provide a method of site access for VIP Support in order for VIP to provide comprehensive support for an application.

Set up the Identity Provider (IdP)

SAML IdPs require that the VIP application is registered as a service provider. SAML IdPs have different ways of approaching this but the purpose is to:

• Set up the application as a legitimate service provider
• Tell the IdP where and how to communicate with the VIP application
• Generate the certificate and URLs the IdP will use to send and encrypt communication with the VIP application

Documentation for creating custom applications for some common IdP’s:

• Okta
• Google G Suite
• Microsoft Entra ID
• SecureAuth
• Auth0

Setting up the SAML IdP requires:

• The ACS location, usually example.com/wp-login.php?saml_acs (where “example.com” is the site’s domain)
• The entity-id: php-saml

Once the SAML application is created, the IdP will provide the following:

• Entity ID (a unique URL)
• Single Sign-on URL
• X.509 Certificate to setup WordPress.

Set up the WordPress site

A plugin to support SAML will need to be added to the WordPress site. The IdP may be able to provide further support or recommend a specific plugin that can be used.

Settings on the WordPress site must meet the following requirements:

• Configure the SSO plugin to create local user accounts.
• If SSO is forced for all users, provide a way for VIP Support users to circumvent the SSO flow on login.
• If SSO is forced on all pages of the site, expose the XML-RPC endpoints to Jetpack requests.

Providing a url parameter such as wp-login.php?normal is the simplest method for allowing users to circumvent the SSO flow and directing them to the wp-login form. A more secure method is to only allow access to the wp-login form by requests made from VIP’s proxy servers using the is_proxied_request() function to verify the requests.

Require SSO to login

Creating local accounts on the WordPress install are required so that VIP Support can more easily troubleshoot when users are having issues. This does not prevent the customer from requiring SSO to log in. If the customer requires SSO for all logins from their users, enable the following options in the OneLogin plugin’s settings:

• Prevent reset password: This will prevent users from resetting their WordPress account passwords.
• Prevent change password: This will prevent users from changing their WordPress account passwords.
• Prevent change mail: This will prevent users from changing the email address in their WordPress account profile.

Test SSO configuration

Completing these tests prior to a site’s launch is recommended.

Check users

• Create test users within the IdP, one for each role that is mapped to WordPress to make sure users have the correct role when they sign in.
• Test any known role conflicts to make sure they are resolved as expected.
• Test whether users can successfully log in and out without affecting other SSO sessions in their organization.

Test content protections

• If the entire site requires authentication, make sure clients verify by anonymously accessing the site.
• Make sure all login requests go through the single sign-on process.