6

I have applications that I wrote that use SAML and then a user database to define permissions for them all. And basically once a user signs on via our SSO they can use the applications with their defined perms.

I want to do the same thing for WP. Where do I start? I would like WP to recognize their session username before they login and then create wordpress cookie. I saw a root cookie plugin that would pass the user info to other wp sites but how about getting the session username to begin with?

I would like users to come to WP site and see that they are logged in with their username but I am open for other ways too.

Right now what is given to me for SAML authentication is:

  • app url: redirect to the SSO sign in
  • app key: hash to encrypt
  • uid
  • firstname
  • lastname
  • email
  • time (POST time is used for validation)

Note: I have just tried using the SAML2 plugin for WP. First it is a beta plugin and very confusing. Second I keep getting fatal error that it cannot find IDP information.

Would really just like to take the session uid I have an log a person in using that.

Improve this question
9
  • Out of curiosity, have you tried any plugins, like SAML 2.0 SSO?
    – Matthew Boynes
    Commented Oct 7, 2013 at 20:49
  • @MatthewBoynes - I tried out an earlier version of that plugin maybe a year ago. Right now I am basically given an app url with an app key and a few fields and told to have fun (3rd party does our company's SSO). So on my custom apps I simply verify that they have a session uid sent from the SSO (redirects to the app url if they dont). Then I automatically authenticate based on the session uid on a user table that I maintain. This might not be the most secure way but it works because it is all internal users. I want the same session id to be WP username and log them in - no pass.
    – STing
    Commented Oct 8, 2013 at 16:59
  • So you already have the users synced to wordpress and present in wp_users or what? Or where are the permissions coming from so Wordpress knows what the user is able to do?
    – s1lv3r
    Commented Oct 11, 2013 at 13:28
  • @s1lv3r I do a join with LDAP data and wp_users perm fields to make my own wp_users table. The wp_users table works fine. In a test environment I just took out the password authentication and when I login stating a uid I get the right perms per user. The problem is how do I ensure that the uid is correct or keep someone from typing in whatever they want.
    – STing
    Commented Oct 11, 2013 at 14:17
  • The problem is how do I ensure that the uid is correct. As far as I understand that is the part where SAML comes in. I.e you have a local service provider which checks this information against the IdP. If you don't get the SAML SSO plugin working you can also try to do this yourself with simplesamlphp.org.
    – s1lv3r
    Commented Oct 11, 2013 at 14:40

2 Answers 2

Reset to default
2

If you will work with sessions, then init this at first in your plugin, theme.

add_action( 'init', 'my_start_session' );

function my_start_session() {

    if ( session_id() )
        return;

    @session_cache_limiter('private, must-revalidate'); //private_no_expire
    @session_cache_expire(0);
    @session_start();
}

Alternative use the library from Eric Mann: WP Session Manager, also his tutorial.

Improve this answer
0

I have a really simple script that is linked https://wordpress.stackexchange.com/questions/154802/what-do-i-need-to-do-to-fully-integrate-a-custom-session-login-into-wp.

Basically I am assuming that your SSO is secure, that you have the users in your database, and that you don't need to keep the session alive except for authentication. From my standpoint I just want to pass the user onto WP and let the WP user system do the rest. Hope this helps others doing session logins.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.