Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:saml_wordpress [2025/04/27 02:02] – kainhofer
+++ en:2.0:single_sign_on:saml_wordpress [2025/04/27 22:07] (current) – [Configuring the Service Provider (Wordpress)] kainhofer
@@ Line 2: / Line 2: @@
 Starting with version 5.0, Admidio can be used by other applications to authenticate users against Admidios user base. These instructions will guide you through the process of connecting Wordpress to Admidio to use Admidio's login. For general instructions, and other apps, please visit the [[en:2.0:single_sign_on|general Single-Sign-On overview page]].
+While the Wordpress plugin directory lists several choices for SAML login, only the [[https://wordpress.org/plugins/onelogin-saml-sso/|OneLogin SAML SOO]] plugin is free and supports permissions depending on the Admidio groups/roles.
 ===== Prerequisites =====
@@ Line 11: / Line 13: @@
 Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
-The page preferences https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+The page preferences https://admidio.local/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
 ===== TL;DR; - Quick Overview =====
@@ Line 52: / Line 54: @@
 === Setting up encryption ===
-If encryption is desired for all SAML messages sent by Admidio to Wordpress, or if Wordpress should sign all its SAML requests, then Wordpress needs a private/public key pair to decrypt or sign messages. These need to be entered into the Wordpress SAML config in PEM format and can be generated by openssl's command line tools, or in Admidio's key administration. Simply create a new Key for Wordpress (RSA 2048 bits). The certificate can be copied directly from the key's edit page, but the private key is not available in Admidio's GUI for security reason. Instead, it can be downloaded (secured with a password!) from the list of keys in Admidio:
+If encryption is desired for all SAML messages sent by Admidio to Wordpress, or if Wordpress should sign all its SAML requests, then Wordpress needs a private/public key pair to decrypt or sign messages. These need to be entered into the Wordpress SAML config in PEM format and can be generated by openssl's command line tools, by sites like https://www.samltool.com/self_signed_certs.php or in Admidio's key administration. Simply create a new Key for Wordpress (RSA 2048 bits). The certificate can be copied directly from the key's edit page, but the private key is not available in Admidio's GUI for security reason. Instead, it can be downloaded (secured with a password!) from the list of keys in Admidio:
 {{ :en:2.0:sso:sso_saml_02-03a_nc_saml_keysetup1.png?direct&400 |}}
@@ Line 80: / Line 82: @@
-The Wordpress SAML configuration also provides attribute and role mapping sections. The attribute mapping defines how Admidio's user profile fields are translated to Wordpress profile fields (currently only first and last name and the login name). If you also want to use Admidio's group memberships / roles to determine access permissions in Wordpress, make sure sure include the roles in the mapping!
+The Wordpress SAML configuration also provides **attribute and role mapping** sections. The attribute mapping defines how Admidio's user profile fields are translated to Wordpress profile fields (currently only first and last name and the login name). If you also want to use Admidio's group memberships / roles to determine access permissions in Wordpress, make sure sure include the roles in the mapping!
 {{ :en:2.0:sso:sso_saml_wp_03_plugin_fieldmapping.png?direct |}}
-=== Role mapping between Admidio and Wordpress
+=== Role mapping between Admidio and Wordpress, Security Settings ===
-ne also needs to define the attribute and role mapping. The username is the most relevant. To use Admidio's group memberships as Wordpress roles, make sure to include the "Roles" or "Groups" field and provide the correct field name in Wordpress.
+To use Admidio's group memberships or roles to define **access permissions to Wordpress**, make sure to include the roles / groups profile field in the field mapping as described in the previous paragraph. In Admidio, you can select which groups should be communicated to Wordpress, and even map them to other names. In the Wordpress SAML configuration, you can choose which group defines rights for Wordpress permissions (Administrator/Editor/Author/Contributor/Subscriber).
-{{ :en:2.0:sso:sso_saml_02-06_nc_admidio_clientsetup1.png?direct&600 |}}
+{{ :en:2.0:sso:sso_saml_wp_04_plugin_rolemapping.png?direct |}}
+If your users have multiple roles, which are mapped to different permissions, one can even choose which permission level should take precendence, but in most cases this is not needed.
+The final section with advanced settings in Wordpress contains settings to fine-tune also cryptographic capabilities. It is important that the settings in Wordpress and Admidio are consistent and do not collide (e.g. if Wordpress is configured not to sign requests, while Admidio is configure to require signatures). The choices shown in the following Screenshot can be changed, but they need to be consistent in Wordpress and Admidio.
+{{ :en:2.0:sso:sso_saml_wp_05_plugin_cryptosettings.png?direct |}}
-<WRAP center round todo 60%>
-TODO: Describe signing and encryption settings (synced)
-</WRAP>
-{{ :en:2.0:sso:sso_saml_02-07_nc_admidio_clientsetup3.png?direct&600 |}}
 ==== Setup completed, test Single-Sign-On ====
-Admidio and Nextcloud should now be set up to use Admidio for logging in to Nextcloud. If you log out of Nextcloud, you should see the login screen with the choice of logging in with password or via SAML.
+Admidio and Wordpress should now be set up to use Admidio for logging in to Wordpress. If you log out of Wordpress (or open Wordpress in an incognito browser window) and go to the wordpress admin location, you should see the login screen with the choice of logging in with password or via SAML.
-{{ :en:2.0:sso:sso_saml_02-08_nc_saml_login.png?direct&400 |}}
+{{ :en:2.0:sso:sso_saml_wp_08_saml_wordpress_login.png?direct&400 |}}
 After choosing SAML login and loggin in with a user from Admidio, you should be logged in to Nextcloud.
-{{:en:2.0:sso:sso_saml_02-09_nc_saml_loggedin.png?direct&200|}}
+{{ :en:2.0:sso:sso_saml_wp_08b_saml_admidio_login.png?direct&400 |}}{{ :en:2.0:sso:sso_saml_wp_09_loggedin.png?direct |}}
-{{:en:2.0:sso:sso_saml_02-10_nc_saml_users.png?direct&600|}}
@@ Line 106: / Line 109: @@
 ==== Caveats and Things to Consider ====
-  * For security reasons, Nextcloud will prepend **SAML_ prefix to the group names** obtained from the SAML IdP. This makes hybrid environments quite hard in practice, where some users authenticate via SAML, others via local accounts or other network accounts. In these hybrid cases, the SAML-generated groups will be different than the local groups and all group permissions need to be set twice! As a **workaround**, one can **enter a single space into the prefix input box**. This will cause Nextcloud's SAML extension to clear the prefix, but the input field will appear empty in the future, so it is not clarly visible whether the prefix was "cleared" or the default prefix will be applied!
+  * The permission levels of Wordpress are very limited, so figuring out the proper mapping of groups to permissions is important to prevent accidental admin permissions to users.
+  * Even though Wordpress has fields for Website, Bio and Profile Picture, the SAML plugin does not provide a way to populate them from Admidio.