Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have applications that I wrote that use SAML and then a user database to define permissions for them all. And basically once a user signs on via our SSO they can use the applications with their defined perms.

I want to do the same thing for WP. Where do I start? I would like WP to recognize their session username before they login and then create wordpress cookie. I saw a root cookie plugin that would pass the user info to other wp sites but how about getting the session username to begin with?

I would like users to come to WP site and see that they are logged in with their username but I am open for other ways too.

Right now what is given to me for SAML authentication is:

  • app url: redirect to the SSO sign in
  • app key: hash to encrypt
  • uid
  • firstname
  • lastname
  • email
  • time (POST time is used for validation)

Note: I have just tried using the SAML2 plugin for WP. First it is a beta plugin and very confusing. Second I keep getting fatal error that it cannot find IDP information.

Would really just like to take the session uid I have an log a person in using that.

share|improve this question
    
Out of curiosity, have you tried any plugins, like SAML 2.0 SSO? –  Matthew Boynes Oct 7 '13 at 20:49
    
@MatthewBoynes - I tried out an earlier version of that plugin maybe a year ago. Right now I am basically given an app url with an app key and a few fields and told to have fun (3rd party does our company's SSO). So on my custom apps I simply verify that they have a session uid sent from the SSO (redirects to the app url if they dont). Then I automatically authenticate based on the session uid on a user table that I maintain. This might not be the most secure way but it works because it is all internal users. I want the same session id to be WP username and log them in - no pass. –  STing Oct 8 '13 at 16:59
    
So you already have the users synced to wordpress and present in wp_users or what? Or where are the permissions coming from so Wordpress knows what the user is able to do? –  s1lv3r Oct 11 '13 at 13:28
    
@s1lv3r I do a join with LDAP data and wp_users perm fields to make my own wp_users table. The wp_users table works fine. In a test environment I just took out the password authentication and when I login stating a uid I get the right perms per user. The problem is how do I ensure that the uid is correct or keep someone from typing in whatever they want. –  STing Oct 11 '13 at 14:17
    
The problem is how do I ensure that the uid is correct. As far as I understand that is the part where SAML comes in. I.e you have a local service provider which checks this information against the IdP. If you don't get the SAML SSO plugin working you can also try to do this yourself with simplesamlphp.org. –  s1lv3r Oct 11 '13 at 14:40

2 Answers 2

If you will work with sessions, then init this at first in your plugin, theme.

add_action( 'init', 'my_start_session' );

function my_start_session() {

    if ( session_id() )
        return;

    @session_cache_limiter('private, must-revalidate'); //private_no_expire
    @session_cache_expire(0);
    @session_start();
}

Alternative use the library from Eric Mann: WP Session Manager, also his tutorial.

share|improve this answer
up vote 0 down vote accepted

I have a really simple script that is linked What do I need to do to fully integrate a custom session login into WP?.

Basically I am assuming that your SSO is secure, that you have the users in your database, and that you don't need to keep the session alive except for authentication. From my standpoint I just want to pass the user onto WP and let the WP user system do the rest. Hope this helps others doing session logins.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.