Initial release of SecurePie SSO SAML.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3530386,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3530386,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3530386,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3530386,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.10","1.0.11","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Service Provider Setup - Copy metadata to configure your IdP","2":"Identity Provider Setup - Enter your IdP's SAML details or import metadata","3":"Attribute & Role Mapping - Map SAML attributes to WordPress fields","4":"Test Configuration - Verify your SSO setup and view returned attributes","5":"Redirection & SSO Links - Configure login behavior and SSO button","6":"Test SSO Configuration - Results page showing NameID and the full SAML attribute table","7":"Help & Support - In-plugin contact form with 24\/7 response"}},"plugin_section":[],"plugin_tags":[138854,160675,9213,5136,2469],"plugin_category":[38],"plugin_contributors":[262831],"plugin_business_model":[],"class_list":["post-294515","plugin","type-plugin","status-publish","hentry","plugin_tags-azure-ad","plugin_tags-okta","plugin_tags-saml","plugin_tags-single-sign-on","plugin_tags-sso","plugin_category-authentication","plugin_contributors-secureparrot","plugin_committers-akashrathi","plugin_committers-secureparrot"],"banners":{"banner":"https:\/\/ps.w.org\/securepie-sso-saml\/assets\/banner-772x250.png?rev=3530386","banner_2x":"https:\/\/ps.w.org\/securepie-sso-saml\/assets\/banner-1544x500.png?rev=3530386","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/securepie-sso-saml\/assets\/icon-128x128.png?rev=3530386","icon_2x":"https:\/\/ps.w.org\/securepie-sso-saml\/assets\/icon-256x256.png?rev=3530386","generated":false},"screenshots":[],"raw_content":"\n
SecurePie SSO SAML<\/strong> is a SAML 2.0 Single Sign-On (SSO) plugin for WordPress that provides enterprise SSO login, SAML login, and federated login via any SAML 2.0 Identity Provider \u2014 including Azure AD (Entra ID), Okta, Google Workspace, OneLogin, ADFS, Auth0, PingFederate, and Keycloak.<\/p>\n\n Whether you need SAML SSO for an intranet, an enterprise SSO portal for customers, or federated authentication for your team, this plugin turns your WordPress site into a SAML Service Provider with zero external dependencies.<\/p>\n\n SecurePie SSO SAML allows you to configure your WordPress site as a SAML 2.0 Service Provider (SP), enabling Single Sign-On with any SAML 2.0 compliant Identity Provider (IdP) such as Azure AD, Okta, Google Workspace, OneLogin, ADFS, and more.<\/p>\n\n This is a zero-dependency<\/strong> plugin \u2014 it uses only PHP's built-in Connecting WordPress to Azure AD \/ Entra ID for SAML SSO with SecurePie takes about ten minutes:<\/p>\n\n Okta-to-WordPress SAML SSO with SecurePie follows the same pattern:<\/p>\n\n This plugin implements the SAML 2.0 protocol, which requires communication with an external Identity Provider (IdP) that is configured by the site administrator. No data is sent to any external service without the administrator explicitly configuring the connection.<\/p>\n\n When a user initiates SSO login, the plugin redirects the user's browser to the Identity Provider's SAML Login URL (configured by the administrator). The following data is sent as part of the standard SAML 2.0 AuthnRequest:<\/p>\n\n The Identity Provider then authenticates the user and sends a SAML Response back to your site containing the user's identity attributes (such as email, name, and group membership).<\/p>\n\n This communication is entirely between your WordPress site and the IdP that you configure. No data is sent to SecurePie or any other third party.<\/p>\n\n The terms of service and privacy policy for the Identity Provider depend on which provider you choose to configure (e.g., Microsoft Azure AD, Okta, Google Workspace). Please consult your Identity Provider's documentation for their specific terms.<\/p>\n\n The plugin can optionally fetch Identity Provider metadata from a URL provided by the administrator. This is a one-time server-to-server request to retrieve the IdP's public configuration (Entity ID, Login URL, X.509 Certificate). No user data is sent during this request.<\/p>\n\n The plugin references standard SAML attribute namespace URIs (e.g., SAML (Security Assertion Markup Language) Single Sign-On allows users to log in to WordPress using their existing organizational credentials from an Identity Provider like Azure AD, Okta, or Google Workspace.<\/p><\/dd>\n SecurePie SSO SAML works with any SAML 2.0 compliant Identity Provider.<\/p><\/dd>\n Your Identity Provider's admin console will provide the Entity ID, Login URL, Logout URL, and X.509 Certificate needed for configuration. You can also import these from the IdP's metadata URL.<\/p><\/dd>\n Yes. Even with Force SAML Login enabled, you can access the standard WordPress login at Yes. When a user authenticates via SAML for the first time, the plugin creates a WordPress user account with the configured default role and mapped attributes.<\/p><\/dd>\n The plugin validates XML digital signatures (RSA-SHA256\/SHA1), prevents XXE attacks, guards against signature wrapping attacks, validates audience restrictions, checks assertion timestamps with clock skew tolerance, and uses single-use transients for replay prevention.<\/p><\/dd>\n No. SecurePie SSO SAML is built entirely with PHP's built-in extensions ( Yes. SecurePie SSO SAML is built for enterprise SSO and federated login scenarios. It implements the SAML 2.0 Web Browser SSO profile, which is the industry standard for federated authentication used by Azure AD, Okta, OneLogin, Google Workspace, and other enterprise Identity Providers.<\/p><\/dd>\n This plugin implements SAML 2.0 only \u2014 the protocol most enterprise Identity Providers use for SSO. If your IdP only supports OAuth 2.0 or OpenID Connect (OIDC), you will need a different plugin. SAML is the standard for enterprise federation; OAuth\/OIDC is more common for consumer login.<\/p><\/dd>\n Copy the SP Entity ID and ACS URL from the Service Provider<\/strong> tab, paste them into a new Azure AD \/ Entra ID Enterprise Application (SAML), and download Azure's Federation Metadata XML. Upload the XML in Identity Provider \u2192 Quick Setup<\/strong> \u2014 SecurePie auto-fills the Entity ID, Login URL and X.509 Certificate. Run Test Configuration<\/strong> to confirm the attributes are flowing, then enable the SSO button on the WordPress login page.<\/p><\/dd>\n In Okta, create a new SAML 2.0 App Integration<\/strong>, then paste the SP Entity ID into Okta's \"Audience URI\" field and the ACS URL into \"Single Sign-on URL\". Configure attribute statements for email, firstName, lastName, and groups. After saving, copy Okta's IdP Issuer, IdP Single Sign-On URL and X.509 Certificate (or use the metadata URL) into the Identity Provider Setup<\/strong> tab in WordPress. Verify with Test Configuration<\/strong>.<\/p><\/dd>\n Yes for per-site activation. Each subsite in a MultiSite install can be configured as its own SAML Service Provider with its own IdP. If you need a single SAML configuration shared across the network (network-level activation, cross-site SSO federation, or domain-based IdP routing), upgrade to SecurePie SSO Premium \u2014 those federation features are not included in the free plugin.<\/p><\/dd>\n\n<\/dl>\n\n\n This release addresses one critical and several high-severity findings from an independent security audit. All sites are strongly encouraged to update.<\/p>\n\ndom<\/code>, openssl<\/code>, and zlib<\/code> extensions. No Composer, no external libraries, no conflicts with other plugins.<\/p>\n\nFeatures<\/h4>\n\n
\n
Use Cases<\/h4>\n\n
\n
Supported Identity Providers<\/h4>\n\n
\n
Setting up SAML SSO with Azure AD (Entra ID)<\/h4>\n\n
\n
Setting up SAML SSO with Okta<\/h4>\n\n
\n
email<\/code>, firstName<\/code>, lastName<\/code>, and optionally a groups<\/code> claim for role mapping.<\/li>\nRequirements<\/h4>\n\n
\n
dom<\/code>, openssl<\/code>, zlib<\/code> (enabled by default on most hosts)<\/li>\nExternal Services<\/h3>\n\n
Identity Provider Communication<\/h4>\n\n
\n
IdP Metadata Import (Optional)<\/h4>\n\n
SAML Attribute Namespace URIs<\/h4>\n\n
http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/emailaddress<\/code>) as identifiers within SAML assertions. These are XML namespace strings used for attribute identification and are not HTTP requests to external services.<\/p>\n\n\n\n
securepie-sso-saml<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install the plugin through the WordPress plugins screen.<\/li>\n\n
What is SAML SSO?<\/h3><\/dt>\n
Which Identity Providers are supported?<\/h3><\/dt>\n
Where do I find my IdP's SAML settings?<\/h3><\/dt>\n
Can I still log in with WordPress credentials?<\/h3><\/dt>\n
wp-login.php?normal=1<\/code>.<\/p><\/dd>\nDoes this plugin create WordPress users automatically?<\/h3><\/dt>\n
What security measures are in place?<\/h3><\/dt>\n
Does this plugin require Composer or external libraries?<\/h3><\/dt>\n
dom<\/code>, openssl<\/code>, zlib<\/code>) and has zero external dependencies.<\/p><\/dd>\nDoes this plugin support enterprise SSO and federated login?<\/h3><\/dt>\n
How is this different from OAuth or OIDC login plugins?<\/h3><\/dt>\n
How do I set up SAML SSO with Azure AD on WordPress?<\/h3><\/dt>\n
How do I set up SAML SSO with Okta on WordPress?<\/h3><\/dt>\n
Does SecurePie SSO support WordPress MultiSite?<\/h3><\/dt>\n
1.0.11<\/h4>\n\n
\n
1.0.10<\/h4>\n\n
\n
1.0.9<\/h4>\n\n
\n
1.0.8<\/h4>\n\n
\n
1.0.7 \u2014 Security Release<\/h4>\n\n
\n
1.0.6<\/h4>\n\n
\n
1.0.5<\/h4>\n\n
\n
1.0.4<\/h4>\n\n
\n
securepie_current_plan<\/code> WP option (empty by default, so unpaid users see buy\/upgrade buttons as before)<\/li>\n<\/ul>\n\n1.0.3<\/h4>\n\n
\n
1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n