Signclave – SSO for SAML and LDAP
| 开发者 |
considadam
considboras |
|---|---|
| 更新时间 | 2026年10月30日 19:16 |
| PHP版本: | 8.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
WordPress SAML Service Provider with optional LDAP fallback.
Source: https://github.com/Considbrs-Webdev/signclave-sso
Features:
- SAML SSO redirect on
wp-login.php - Signed assertion validation (XML signature + digest)
- Replay protection, signed RelayState, redirect allowlisting
- Optional LDAP authentication fallback
- Optional group-to-role mapping
- Security audit logging
安装:
- Upload
signclave-ssoto/wp-content/plugins/. - Activate the plugin.
- Configure SAML (and optionally LDAP) under Settings → Signclave SSO.
- Import SP metadata in your IdP (e.g. F5 APM).
- Copy the Emergency local login URL from Security settings.
常见问题:
Where are the settings?
Settings → Signclave SSO (options-general.php?page=signclave-sso). There is no top-level admin menu.
How do local WordPress admins log in when SSO is enabled?
Use the emergency URL shown under Security in plugin settings. It includes a secret key. Existing WordPress accounts can also sign in via SAML when the IdP uid matches user_login; after the first login identity is the stored NameID.
Does SAML require LDAP?
No. Leave Enable LDAP fallback authentication unchecked for SAML-only sites. Turn it on only when you want directory verification for new account creation and LDAP password login.
Does this plugin contact external servers?
Yes. Browser SSO sends the user to your Identity Provider (for example F5 APM). When LDAP is enabled, the WordPress server connects to your directory (ldaps:// recommended) for binds and searches. No traffic is sent to the plugin author or to wordpress.org for authentication.
Behind a reverse proxy / load balancer?
Enable Trust proxy HTTPS headers only if the proxy is trusted and strips client-supplied headers.
How do I hide the plugin log directory on Nginx?
Apache gets .htaccess automatically. On Nginx, deny wp-content/uploads/signclave-sso/ in the server block. See docs/instructions.md in the plugin folder.
What if wp-admin is locked out?
From the WordPress root, with the plugin active: wp signclave sso disable turns off auto-redirect to the IdP. wp signclave rotate-key prints a new emergency login URL. Full command list is in docs/instructions.md.
Where is the F5 / eDirectory profile documented?
docs/f5-apm.md ships with the plugin, including the staging checks. The IdP SSO URL must be the HTTP-POST endpoint; the plugin does not send HTTP-Redirect AuthnRequests.
Which filters are supported?
These four filters are the public extension API (signatures will not change in patch releases):
signclave_sso_map_attributes—( array $mapped, array $rawAttrs ).$mappedkeys:username,email,first,last,groups,nameId. Runs after SAML attribute extraction, before LDAP enrich.nameIdis informational (identity stays the signed assertion NameID).signclave_sso_user_roles—( string[] $roles, WP_User $user, string[] $groups, string $source ). Last word on roles after group mapping.signclave_sso_allow_login—( true|WP_Error $allow, WP_User $user, array $context ). Return aWP_Errorto reject a valid SAML assertion before the auth cookie is set.signclave_sso_authn_request—( string $xml, array $saml ). Adjust the outbound AuthnRequest XML before it is POSTed to the IdP.
signclave_sso_trust_proxy_headers remains available for proxy HTTPS detection.
更新日志:
1.0.3
- Reject XML signatures that use an XPath transform or more than one reference, before signature cryptography runs.
- Directory banner and icon.
- Source repository is github.com/Considbrs-Webdev/signclave-sso. The directory contributor is
considboras.
- First release on wordpress.org.
- Plugin Check: print the SAML auto-submit through the script API, list
considborasas a contributor, and delete onlysignclave_sso_transients on uninstall.
- Plugin Check: WordPress options, query parameters, AJAX, user meta, cron, and transients use the
signclave_sso_prefix. Existingsls_optionsare still read until the first save.
- Plugin Check: global constants use the
SIGNCLAVE_SSO_prefix.
- Plugin Check: ignore exception-message escaping. Those strings are logged or thrown, and the browser only sees a fixed escaped message.
- Rename the plugin to Signclave – SSO for SAML and LDAP. Slug and text domain are
signclave-sso. WP-CLI iswp signclave. - Existing settings in
sls_optionsare read until the first save, which storessc_options. - Public filters use the
signclave_sso_prefix.
- Update dependencies
- PHPStan: treat
node_modulesas an optional exclude so CI can run without npm install.
- CI: drop GitHub Actions Composer oauth before Strauss; use actions/checkout@v5 (Node 24).
- CI: lock Composer to PHP 8.2 so the lockfile installs on the 8.2 runner; ignore GitHub Actions tokens when running Strauss.
- Settings screen: show WordPress’s “Settings saved” notice once (remove the duplicate plugin notice).
- SAML first login may bind to an existing WordPress
user_login(LDAP-optional 0.1.3 rule). Afterwards identity stays the stored NameID. Email still cannot choose the SAML account. - When Automatic SSO is off, wp-login.php shows a Log in with SSO button below the form.
- Plugin Check: zero errors against the wordpress.org zip surface (
bin/plugin-check.sh,.distignore). - Sanitize
wp_unslashonREMOTE_ADDRand trusted forwarded HTTPS headers.
- Tests: Pest Unit + Security, PHPStan level 8, type coverage 100 %, GitHub Actions (PHP 8.2/8.4).
- SAML: reject transient NameID; unspecified remains the happy path (F5 profile).
- Roles: do not map slugs missing from
wp_roles(). Uninstall deletessc_*transients. - Docs: F5 checklist and default attribute/NameID profile. Captured F5 XML fixture still deferred.
- Settings API (
options.php) and menu under Settings (not a top-level item). - i18n: POT + Swedish
sv_SE;npm run translate*. - Public filters:
sc_map_attributes,sc_user_roles,sc_allow_login,sc_authn_request. - WP-CLI:
wp signclave sso,rotate-key,test-ldap,test-saml,doctor. - Daily log retention (default 90 days), Site Health tests, privacy/threat-model/F5 docs.
- Security: xmlseclibs (Strauss-prefixed) replaces custom XML-DSig; SHA-1 rejected; assertion must be signed.
- Security: NameID identity binding, comment-injection protection, dual IdP certs, SAMLResponse size limit.
- Security: configurable role downgrade (on by default), protected logins, last-admin guard.
- Ops: LDAP host failover, randomized log filenames, WP_Filesystem on activation, clearer bind-secret decrypt errors.
- Emergency login POST preserves bypass key; IdP-initiated SSO opt-in (off by default).
- Internal architecture: PSR-4 (
Signclave\), config helpers, instance DI, Vite-built admin assets indist/. Login behavior unchanged from 0.1.5.
- Version bump.
- Code structure and WordPress coding hygiene: settings view, diagnostics class, shared LDAP connection helper, i18n on admin UI. Login behavior unchanged from 0.1.3.
- LDAP is optional by default. SAML works without a directory; existing WordPress accounts can sign in via SAML even if LDAP is unavailable. LDAP is required only when creating new users and LDAP is fully configured.
- SAML login always verifies LDAP when LDAP is enabled (mandatory, not optional).
- Optional LDAP existence check on every SAML login.
- Security hardening: pinned IdP cert, strict SAML validation, secret emergency login, opt-in proxy trust.
- Account linking by email disabled by default.
- Improved uninstall cleanup.
- F5-compatible SAML digest verification and ACS error handling.
- Initial release.