开发者 |
getpantheon
danielbachhuber Outlandish Josh jspellman jazzs3quence |
---|---|
更新时间 | 2023年4月9日 11:09 |
PHP版本: | 7.3 及以上 |
WordPress版本: | 6.2 |
版权: | GPLv2 or later |
版权网址: | 版权信息 |
permit_wp_login=>false
will force all authentication to go through the SAML identity provider, bypassing wp-login.php
. Similiarly, auto_provision=>false
will disable automatic creation of new WordPress users.
See installation instructions for full configuration details.
~/code/simplesaml
to be properly handled by Nginx. Read the docs for more details about configuring SimpleSAMLphp on Pantheon.
Because SAML authentication is handled as a part of the login flow, your SAML identity provider will need to send responses back to wp-login.php
. For instance, if your domain is pantheon.io
, then you'd use http://pantheon.io/wp-login.php
as your AssertionConsumerService
configuration value.
To configure the plugin with a filter, or for additional detail on each setting, use this code snippet:
function wpsax_filter_option( $value, $option_name ) {
$defaults = array(
/
* Type of SAML connection bridge to use.
*
* 'internal' uses OneLogin bundled library; 'simplesamlphp' uses SimpleSAMLphp.
*
* Defaults to SimpleSAMLphp for backwards compatibility.
*
* @param string
*/
'connection_type' => 'internal',
/
* Configuration options for OneLogin library use.
*
* See comments with "Required:" for values you absolutely need to configure.
*
* @param array
/
'internal_config' => array(
// Validation of SAML responses is required.
'strict' => true,
'debug' => defined( 'WP_DEBUG' ) && WP_DEBUG ? true : false,
'baseurl' => home_url(),
'sp' => array(
'entityId' => 'urn:' . parse_url( home_url(), PHP_URL_HOST ),
'assertionConsumerService' => array(
'url' => wp_login_url(),
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
),
),
'idp' => array(
// Required: Set based on provider's supplied value.
'entityId' => '',
'singleSignOnService' => array(
// Required: Set based on provider's supplied value.
'url' => '',
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
),
'singleLogoutService' => array(
// Required: Set based on provider's supplied value.
'url' => '',
'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
),
// Required: Contents of the IDP's public x509 certificate.
// Use file_get_contents() to load certificate contents into scope.
'x509cert' => '',
// Optional: Instead of using the x509 cert, you can specify the fingerprint and algorithm.
'certFingerprint' => '',
'certFingerprintAlgorithm' => '',
),
),
/
* Path to SimpleSAMLphp autoloader.
*
* Follow the standard implementation by installing SimpleSAMLphp
* alongside the plugin, and provide the path to its autoloader.
* Alternatively, this plugin will work if it can find the
* SimpleSAML_Auth_Simple
class.
*
* @param string
/
'simplesamlphp_autoload' => dirname( FILE ) . '/simplesamlphp/lib/_autoload.php',
/
* Authentication source to pass to SimpleSAMLphp
*
* This must be one of your configured identity providers in
* SimpleSAMLphp. If the identity provider isn't configured
* properly, the plugin will not work properly.
*
* @param string
*/
'auth_source' => 'default-sp',
/
* Whether or not to automatically provision new WordPress users.
*
* When WordPress is presented with a SAML user without a
* corresponding WordPress account, it can either create a new user
* or display an error that the user needs to contact the site
* administrator.
*
* @param bool
/
'auto_provision' => true,
/
* Whether or not to permit logging in with username and password.
*
* If this feature is disabled, all authentication requests will be
* channeled through SimpleSAMLphp.
*
* @param bool
/
'permit_wp_login' => true,
/
* Attribute by which to get a WordPress user for a SAML user.
*
* @param string Supported options are 'email' and 'login'.
*/
'get_user_by' => 'email',
/
* SAML attribute which includes the user_login value for a user.
*
* @param string
/
'user_login_attribute' => 'uid',
/
* SAML attribute which includes the user_email value for a user.
*
* @param string
/
'user_email_attribute' => 'mail',
/
* SAML attribute which includes the display_name value for a user.
*
* @param string
*/
'display_name_attribute' => 'display_name',
/
* SAML attribute which includes the first_name value for a user.
*
* @param string
/
'first_name_attribute' => 'first_name',
/
* SAML attribute which includes the last_name value for a user.
*
* @param string
/
'last_name_attribute' => 'last_name',
/*
* Default WordPress role to grant when provisioning new users.
*
* @param string
/
'default_role' => get_option( 'default_role' ),
);
$value = isset( $defaults[ $option_name ] ) ? $defaults[ $option_name ] : $value;
return $value;
}
add_filter( 'wp_saml_auth_option', 'wpsax_filter_option', 10, 2 );
If you need to adapt authentication behavior based on the SAML response, you can do so with the wp_saml_auth_pre_authentication
filter:
/*
* Reject authentication if $attributes doesn't include the authorized group.
/
add_filter( 'wp_saml_auth_pre_authentication', function( $ret, $attributes ) {
if ( empty( $attributes['group'] ) || ! in_array( 'administrators', $attributes['group'] ) ) {
return new WP_Error( 'unauthorized-group', "Sorry, you're not a member of an authorized group." );
}
return $ret;
}, 10, 2 );If you'd like to make sure the user's display name, first name, and last name are updated in WordPress when they log back in, you can use the following code snippet:
/*
* Update user attributes after a user has logged in via SAML.
/
add_action( 'wp_saml_auth_existing_user_authenticated', function( $existing_user, $attributes ) {
$user_args = array(
'ID' => $existing_user->ID,
);
foreach ( array( 'display_name', 'first_name', 'last_name' ) as $type ) {
$attribute = \WP_SAML_Auth::get_option( "{$type}_attribute" );
$user_args[ $type ] = ! empty( $attributes[ $attribute ][0] ) ? $attributes[ $attribute ][0] : '';
}
wp_update_user( $user_args );
}, 10, 2 );
The wp_saml_auth_existing_user_authenticated
action fires after the user has successfully authenticated with the SAML IdP. The code snippet then uses a pattern similar to WP SAML Auth to fetch display name, first name, and last name from the SAML response. Lastly, the code snippet updates the existing WordPress user object.
Because SimpleSAMLphp uses PHP sessions to manage user authentication, it will work unreliably or not at all on a server configuration with multiple web nodes. This is because PHP's default session handler uses the filesystem, and each web node has a different filesystem. Fortunately, there's a way around this.
First, install and activate the WP Native PHP Sessions plugin, which registers a database-based PHP session handler for WordPress to use.
Next, modify SimpleSAMLphp's www/_include.php
file to require wp-load.php
. If you installed SimpleSAMLphp within the wp-saml-auth
directory, you'd edit wp-saml-auth/simplesamlphp/www/_include.php
to include:
<?php
require_once dirname( dirname( dirname( dirname( dirname( dirname( FILE ) ) ) ) ) ) . '/wp-load.php';
Note: the declaration does need to be at the top of _include.php
, to ensure WordPress (and thus the session handling) is loaded before SimpleSAMLphp.
There is no third step. Because SimpleSAMLphp loads WordPress, which has WP Native PHP Sessions active, SimpleSAMLphp and WP SAML Auth will be able to communicate to one another on a multi web node environment.
onelogin/php-saml
to v4.0.0
, which requires PHP 7.3 or higher [#275].wp_saml_auth_pre_logout
action that fires before logout [#274].wp_saml_auth_login_parameters
filter to allow login parameters to be filtered [#262].wp_saml_auth_internal_logout_args
filter to allow the internal logout args to be filterable [#255].wp_saml_auth_force_authn
filter to allow forceAuthn="true" to be enabled [#248].onelogin/php-saml
to v3.6.1
[#236].onelogin/php-saml
to v3.6.0
[#233].onelogin/php-saml
to v3.5.0
[#218].session_start()
when using SimpleSAMLphp [#196].wp-login.php
while avoiding redirect loop [#192].placeholder
value that's causing PHP notices [#178].onelogin/php-saml
to v3.4.1
[#174].onelogin/php-saml
to v3.4.0
[#173].onelogin/php-saml
to v3.3.1
[#172].onelogin/php-saml
to v3.3.0
[#160].onelogin/php-saml
to v3.1.1
for PHP 7.3 support [#139].wp_saml_auth_attributes
filter to permit modifying SAML response attributes before they're processed by WordPress [#136].onelogin/php-saml
to v3.0.0
for PHP 7.2 support [#133].onelogin/php-saml
from v2.13.0
to v2.14.0
[#127].redirect_to
URLs don't lose query parameters by encoding with rawurlencode()
[#124].onelogin/php-saml
from v2.12.0
to v2.13.0
action=wp-saml-auth
when redirect_to
is persisted, to ensure authentication is handled [#115].redirect_to
value in a more accurate manner, as a follow up to the change in v0.3.6 [#113]./wp-admin/
URLs [#112].wp-login.php
string with parse_url( wp_login_url(), PHP_URL_PATH )
for compatibility with plugins and functions that alter the standard login url [#109].internal
connection type to be used without signout URL, for integration with Google Apps [#106].$attributes
to wp_saml_auth_insert_user
filter, so user creation behavior can be modified based on SAML response.permit_wp_login=true
.wp_saml_auth_login_strings
filter to permit login text strings to be filterable.wp_saml_auth_pre_authentication
filter to allow authentication behavior to be adapted based on SAML response.composer.json
.wp_saml_auth_new_user_authenticated
and wp_saml_auth_existing_user_authenticated
actions to permit themes / plugins to run a callback post-authentication.wp saml-auth scaffold-config
, a WP-CLI command to scaffold a configuration filter to customize WP SAML Auth usage.