The wpCAS plugin appears to be working: I have a subdomain on a website which contains the WordPress installation (i.e. test.mywebsite.com), and I'm running through a WordPress GitHub Repo along with Capistrano for actual deployment. This is important because, due to this setup, the content is within a subdirectory, i.e. test.mywebsite.com/wp. The result is that, in order to access the site's admin section, I have to input test.mywebsite.com/wp/wp-admin in my browser. Accessing the frontend website, however, only requires that I input test.website.com. Confusing enough?

I'm testing all of this with a localhost MAMP server. It should also be worth nothing that I have also redirected the IP of test.mywebsite.com to my local box via my Mac's hosts file, so everything is correctly taking place on the local box.

Now, here's the catch: I'm using the wpCAS plugin with a RubyCAS server. Everything works up until the actual login process.

wpCAS is designed to simply re-direct the login page to my CAS login, and then match the credentials typed into the CAS interface with those in WordPress's database. If there's a match, it (theoretically) would bring me to the admin page with my credentials logged in and working correctly.

As a result of this setup, my typing in localhost/wp/wp-admin takes me to auth.mywebsite.com, the CAS interface where I can input my credentials.

However, once I put my credentials into the CAS interface I'm instead hit with a redirect loop that looks like:




so around and around we go!

Any idea why this would happen and how to solve the problem?

1 Answer 1


I got it! Within the wpcas.php file inside of the wpCAS plugin folder, lines 85-123 detail the actual login function of wpCAS. Lines 104 & 108 detail specifically on how wpCAS redirects you to the admin page:


wp_redirect( preg_match( '/^http/', $_GET['redirect_to'] ) ? $_GET['redirect_to'] : site_url( $_GET['redirect_to'] ));


wp_redirect( site_url( '/wp-admin/' ));

However, this results (for reasons unknown to me) in a redirect loop of DOOM. Thanks to this tip, however (many thanks to Mr. Luigi Balzano), I found a solution. Change the wp_redirect functions on these two lines to wp_safe_redirect, like so:


wp_safe_redirect( preg_match( '/^http/', $_GET['redirect_to'] ) ? $_GET['redirect_to'] : site_url( $_GET['redirect_to'] ));


wp_safe_redirect( site_url( '/wp-admin/' ));

This kicked me out of the redirect loop of DOOM.

The plugin, despite being two years old, still works beautifully with WordPress version 3.5.1 and below.

Hope this helps you wpCAS vagrants!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.