Here's the overview of the setup:

  • I have a multisite installation of WordPress 3.4.2.
  • I've installed the Active Directory Authentication Integration plugin to allow users to use their AD credentials. This also allows assigning AD groups to each site, so that the site admins do not manually have to assign permissions.
  • I have installed the Network Privacy plugin, so that certain sites must be logged into before you are able to see any content. Anonymous users only see the login page.

In many regards, this setup works. I am having one problem however, which is stopping me from rolling this out to our primary WordPress multi-site installation:

  • Bob is a member of the "IT Support" group in AD.
  • Bob is also a member of the "Domain Users" group in AD.
  • The main site (www.mysite.com) is locked down to only allow "Domain Users" members to login.
  • The sub-site (www.mysite.com/itsupport) is locked down to only allow "IT Support" members to login.
  • Bob visits www.mysite.com and is prompted for authentication. He enters his AD credentials and is allowed into the site.
  • Now that he's logged in on www.mysite.com, Bob clicks the link to go to www.mysite.com/itsupport and receives an error that he is not a member of the site.
    • It appears that no user entry has been created in the WordPress database for this sub-site.
  • Bob logs out of www.mysite.com.
  • Now that he is logged out, Bob goes directly to www.mysite.com/itsupport and is prompted for authentication. He enters his AD credentials and is allowed into the site.
    • It appears that the user entry in the WordPress database is created at this point for this sub-site.
  • Now if he logs out and logs into www.mysite.com, he can traverse to the itsupport site without any issues.

If I delete Bob's user entries for both sites and disable the Network Privacy plugin, Bob is able to login to www.mysite.com and then traverse to the itsupport site. But if I delete his user entries and re-enable the Network Privacy plugin, the problem reappears.

I had the same problem with one other privacy plugin, though I can't remember which one.

If you can spot the problem or if you have setup something similar, I'm willing to try anything, as long as I meet the basic criteria of using AD groups and being able to lock down certain sites.

  • It sounds like a plugin / edge use case conflict. Have you checked with the plugin developer if it supports external user databases?
    – Damien
    Oct 3, 2012 at 19:40
  • Damien - I've logged support items in the forums for both plugins. I'm just seeing if I can pick the brains of those who may have tackled something similar before. I don't believe that the privacy plugin really needs to know about external user databases, it just needs to let the AD plugin do its thing and add the user to the internal WordPress database. Unfortunately, the privacy plugin seems to be getting in the way of that.
    – Phil Erb
    Oct 3, 2012 at 23:25
  • 2
    How did you get on with this? Im researching a similar implementation for a school.
    – orionrush
    Jun 26, 2013 at 12:26
  • 1
    It almost sounds like AD is only giving back the group that is assigned for that site - as in, "Hey, this is the IT site, so I'm only going to verify that the account logging in is the IT group and ignore the other groups." Maybe see if there is a way to get AD to remember all groups a user belongs to.
    – phatskat
    Apr 25, 2016 at 13:32
  • 1
    How can a 4 year old question be at the very top of Unanswered? This is not even relevant anymore since both plugins linked are deprecated. Nov 21, 2016 at 22:35

2 Answers 2


Try a different approach. Instead of using plugins, I suggest modifying wordpress a little as described in the following answer.


So in your case you should setup the wordpress installations like this:

  • mysite.com
    • root: */domains/mysite.com/public_html
    • db: user_mysite
    • table prefix: root_
  • mysite.com/itsupport
    • root: */domains/mysite.com/public_html/itsupport
    • db: user_mysite
    • table prefix: itsupport_

than in addition to the configuration given in the answer which i linked to, add the following to the wp-config files of both the wordpress installations:

define( 'CUSTOM_USER_TABLE', 'mysite_users );
define( 'CUSTOM_USER_META_TABLE', 'mysite_usermeta' );

If you have a multi-site install you should switch your IT Tech Support site to a subdomain.

You are probably experiencing a cookie login mismatch. Since it is set at the root of the domain it is the same for both of the sites. So if you set up support.example.com it should be clearer than example.com/support

Unless I'm misunderstanding completely, in which case, try a different plugin to restrict the content to the user and don't run this as a sub-site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.