WP SAML Auth

SAML authentication for WordPress, using the bundled OneLogin SAML library or optionally installed SimpleSAMLphp. OneLogin provides a SAML authentication bridge; SimpleSAMLphp provides SAML plus a variety of other authentication mechanisms. This plugin acts as a bridge between WordPress and the authentication library.

If your organization uses Google Apps, integrating Google Apps with WP SAML Auth takes just a few steps.

The standard user flow looks like this:

• User can log in via SAML using a button added to the standard WordPress login view.
• When the button is clicked, the user is handed off to the authentication library. With OneLogin, the user is redirected to the SAML identity provider. With SimpleSAMLphp, the user is redirected to the SimpleSAMLphp install.
• Once the user is authenticated with the identity provider, they’re redirected back to WordPress and signed in to their account. A new WordPress user will be created if none exists (although this behavior can be disabled).
• When the user logs out of WordPress, they are also logged out of the identity provider.

A set of configuration options allow you to change the plugin’s default behavior. For instance, permit_wp_login=>false will force all authentication to go through the SAML identity provider, bypassing wp-login.php. Similiarly, auto_provision=>false will disable automatic creation of new WordPress users.

See installation instructions for full configuration details.

Installing SimpleSAMLphp

The plugin supports both SimpleSAMLphp v1.x and v2.x. The autoloader is automatically detected:

SimpleSAMLphp v2.x uses vendor/autoload.php
SimpleSAMLphp v1.x uses lib/_autoload.php

Default Search Paths

The plugin automatically searches for SimpleSAMLphp in these locations:
* ABSPATH . 'simplesaml'
* ABSPATH . 'private/simplesamlphp'
* ABSPATH . 'simplesamlphp'
* ABSPATH . 'vendor/simplesamlphp/simplesamlphp' (Composer installation)
* plugin_dir_path . 'simplesamlphp'

For each path, the plugin checks for both vendor/autoload.php (v2.x) and lib/_autoload.php (v1.x).

This means Composer installations work automatically! If you run composer require simplesamlphp/simplesamlphp in your site root, the plugin will find it without any additional configuration.

Composer Installation (Advanced)

If you install SimpleSAMLphp via Composer to a custom location (not the standard vendor/simplesamlphp/simplesamlphp), you can specify the autoloader path:

add_filter( 'wp_saml_auth_option', function( $value, $option_name ) {
    if ( 'simplesamlphp_autoload' === $option_name ) {
        // Point to your custom Composer vendor autoloader
        return '/custom/path/vendor/autoload.php';
    }
    return $value;
}, 10, 2 );

Custom Installation Paths

If SimpleSAMLphp is installed in a non-default location, you can set custom search paths with the wp_saml_auth_simplesamlphp_path_array filter:

add_filter( 'wp_saml_auth_simplesamlphp_path_array', function( $simplesamlphp_path_array ) {
    // Override default paths with custom paths
    return [ '/custom/path/to/simplesamlphp' ];
} );

Or define an explicit autoloader path with the wp_saml_auth_ssp_autoloader filter:

add_filter( 'wp_saml_auth_ssp_autoloader', function( $ssp_autoloader ) {
    return ABSPATH . 'path/to/simplesamlphp/vendor/autoload.php';
} );<h3>WP-CLI Commands</h3>

This plugin implements a variety of WP-CLI commands. All commands are grouped into the wp saml-auth namespace.

$ wp help saml-auth

NAME

  wp saml-auth

DESCRIPTION

  Configure and manage the WP SAML Auth plugin.

SYNOPSIS

  wp saml-auth <command>

SUBCOMMANDS

  scaffold-config      Scaffold a configuration filter to customize WP SAML Auth usage.

Use wp help saml-auth <command> to learn more about each command.

Note: The scaffold-config command generates a configuration function with default values. The simplesamlphp_autoload option is not included in the scaffolded output because the plugin auto-detects SimpleSAMLphp installations. Only add this option manually if SimpleSAMLphp is in a non-standard location.

Contributing

See CONTRIBUTING.md for information on contributing.

Once you’ve activated the plugin, and have access to a functioning SAML Identity Provider (IdP), there are a couple of ways WP SAML Auth can be configured:

1. Settings page in the WordPress backend. The settings page offers the most common configuration options, but not all. It’s located at “Settings” -> “WP SAML Auth”.
2. Code snippet applied with a filter. The code snippet approach, documented below, allows access to all configuration settings. The settings page is disabled entirely when a code snippet is present.

If you’re connecting directly to an existing IdP, you should use the bundled OneLogin SAML library. The necessary and most common settings are available in the WordPress backend.

If you have more complex authentication needs, then you can also use a SimpleSAMLphp installation running in the same environment. These settings are not configurable through the WordPress backend; they’ll need to be defined with a filter. And, if you have a filter in place, the WordPress backend settings will be removed.

Note: A security vulnerability was found in SimpleSAMLphp versions 2.0.0 and below. It is highly recommended if you are using SimpleSAMLphp with WP SAML Auth that you update your SimpleSAMLphp library to 2.4.0 or above. (See CVE-2025-27773 and The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect bindings for more information.)

Additional explanation of each setting can be found in the code snippet below.

To install SimpleSAMLphp locally for testing purposes, the Identity Provider QuickStart is a good place to start. On Pantheon, the SimpleSAMLphp web directory needs to be symlinked to ~/code/simplesaml to be properly handled by Nginx. Read the docs for more details about configuring SimpleSAMLphp on Pantheon.

Because SAML authentication is handled as a part of the login flow, your SAML identity provider will need to send responses back to wp-login.php. For instance, if your domain is pantheon.io, then you’d use http://pantheon.io/wp-login.php as your AssertionConsumerService configuration value.

Where to add configuration code: When using the filter-based configuration approach, add your code to a location that loads before the plugin initializes. You can create a custom must-use plugin or add the code to your theme’s functions.php file (note: theme-based configuration will need to be migrated if you switch themes).

To configure the plugin with a filter, or for additional detail on each setting, use this code snippet:

function wpsax_filter_option( $value, $option_name ) {
    $defaults = array(
        /**
         * Type of SAML connection bridge to use.
         *
         * 'internal' uses OneLogin bundled library; 'simplesamlphp' uses SimpleSAMLphp.
         *
         * Defaults to SimpleSAMLphp for backwards compatibility.
         *
         * @param string
         */
        'connection_type' => 'internal',
        /**
         * Configuration options for OneLogin library use.
         *
         * See comments with "Required:" for values you absolutely need to configure.
         *
         * @param array
         */
        'internal_config'        => array(
            // Validation of SAML responses is required.
            'strict'       => true,
            'debug'        => defined( 'WP_DEBUG' ) && WP_DEBUG ? true : false,
            'baseurl'      => home_url(),
            'sp'           => array(
                'entityId' => 'urn:' . parse_url( home_url(), PHP_URL_HOST ),
                'assertionConsumerService' => array(
                    'url'  => wp_login_url(),
                    'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
                ),
            ),
            'idp'          => array(
                // Required: Set based on provider's supplied value.
                'entityId' => '',
                'singleSignOnService' => array(
                    // Required: Set based on provider's supplied value.
                    'url'  => '',
                    'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
                ),
                'singleLogoutService' => array(
                    // Required: Set based on provider's supplied value.
                    'url'  => '',
                    'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
                ),
                // Required: Contents of the IDP's public x509 certificate.
                // Use file_get_contents() to load certificate contents into scope.
                'x509cert' => '',
                // Optional: Instead of using the x509 cert, you can specify the fingerprint and algorithm.
                'certFingerprint' => '',
                'certFingerprintAlgorithm' => '',
            ),
        ),
        /**
         * Path to SimpleSAMLphp autoloader.
         *
         * SimpleSAMLphp v2.x uses 'vendor/autoload.php'
         * SimpleSAMLphp v1.x uses 'lib/_autoload.php'
         *
         * The plugin will automatically search for SimpleSAMLphp in common
         * installation paths and detect the correct autoloader for both versions.
         *
         * You typically don't need to set this - leave it commented out to use auto-detection.
         * Only set this value if SimpleSAMLphp is in a non-standard location.
         *
         * Examples:
         * - SimpleSAMLphp v2.x: dirname( __FILE__ ) . '/simplesamlphp/vendor/autoload.php'
         * - SimpleSAMLphp v1.x: dirname( __FILE__ ) . '/simplesamlphp/lib/_autoload.php'
         * - Composer (site root): ABSPATH . 'vendor/autoload.php'
         *
         * @param string
         */
        // 'simplesamlphp_autoload' => dirname( __FILE__ ) . '/simplesamlphp/vendor/autoload.php',
        /**
         * Authentication source to pass to SimpleSAMLphp
         *
         * This must be one of your configured identity providers in
         * SimpleSAMLphp. If the identity provider isn't configured
         * properly, the plugin will not work properly.
         *
         * @param string
         */
        'auth_source'            => 'default-sp',
        /**
         * Whether or not to automatically provision new WordPress users.
         *
         * When WordPress is presented with a SAML user without a
         * corresponding WordPress account, it can either create a new user
         * or display an error that the user needs to contact the site
         * administrator.
         *
         * @param bool
         */
        'auto_provision'         => true,
        /**
         * Whether or not to permit logging in with username and password.
         *
         * If this feature is disabled, all authentication requests will be
         * channeled through SimpleSAMLphp.
         *
         * @param bool
         */
        'permit_wp_login'        => true,
        /**
         * Attribute by which to get a WordPress user for a SAML user.
         *
         * @param string Supported options are 'email' and 'login'.
         */
        'get_user_by'            => 'email',
        /**
         * SAML attribute which includes the user_login value for a user.
         *
         * @param string
         */
        'user_login_attribute'   => 'uid',
        /**
         * SAML attribute which includes the user_email value for a user.
         *
         * @param string
         */
        'user_email_attribute'   => 'mail',
        /**
         * SAML attribute which includes the display_name value for a user.
         *
         * @param string
         */
        'display_name_attribute' => 'display_name',
        /**
         * SAML attribute which includes the first_name value for a user.
         *
         * @param string
         */
        'first_name_attribute' => 'first_name',
        /**
         * SAML attribute which includes the last_name value for a user.
         *
         * @param string
         */
        'last_name_attribute' => 'last_name',
        /**
         * Default WordPress role to grant when provisioning new users.
         *
         * @param string
         */
        'default_role'           => get_option( 'default_role' ),
    );
    $value = isset( $defaults[ $option_name ] ) ? $defaults[ $option_name ] : $value;
    return $value;
}
add_filter( 'wp_saml_auth_option', 'wpsax_filter_option', 10, 2 );

If you need to adapt authentication behavior based on the SAML response, you can do so with the wp_saml_auth_pre_authentication filter:

/**
 * Reject authentication if $attributes doesn't include the authorized group.
 */
add_filter( 'wp_saml_auth_pre_authentication', function( $ret, $attributes ) {
    if ( empty( $attributes['group'] ) || ! in_array( 'administrators', $attributes['group'] ) ) {
        return new WP_Error( 'unauthorized-group', "Sorry, you're not a member of an authorized group." );
    }
    return $ret;
}, 10, 2 );

If you’re using the OneLogin connection type and need to modify the internal_config (e.g. to set requestedAuthnContext to false), you can use the wp_saml_auth_internal_config filter:

/**
 * Modify the OneLogin SAML configuration.
 */
add_filter( 'wp_saml_auth_internal_config', function( $config ) {
    $config['security'] = array(
        'requestedAuthnContext' => false,
    );
    return $config;
} );

In multisite environments, you can prevent auto-provisioned users from being automatically added to sites using the wp_saml_auth_auto_add_to_blog filter. By default, WordPress multisite adds new users to the site where they log in (typically site ID 1) with the default_role.

/**
 * Prevent auto-provisioned users from being added to any site.
 * Users will be created as network users only.
 */
add_filter( 'wp_saml_auth_auto_add_to_blog', '__return_false' );

You can also prevent users from being added only to specific sites:

/**
 * Prevent auto-provisioned users from being added to site ID 1,
 * but allow them to be added to other sites.
 */
add_filter( 'wp_saml_auth_auto_add_to_blog', function( $add_user, $blog_id ) {
    // Don't add users to site ID 1
    if ( 1 === $blog_id ) {
        return false;
    }
    return $add_user;
}, 10, 2 );

When this filter returns false, users are created as network users without being added to the site. This is useful for large multisite installations where you want to manage site membership separately from authentication.

Note for developers using the wp_saml_auth_new_user_authenticated action: When this filter returns false, the user passed to wp_saml_auth_new_user_authenticated will have no role on the current site. If your hook relies on $user->roles, check for an empty array:

add_action( 'wp_saml_auth_new_user_authenticated', function( $user, $attributes ) {
    if ( empty( $user->roles ) ) {
        // Network-only user, no role on this site.
        return;
    }
    // Your existing logic.
}, 10, 2 );