README

A WordPress SAML 2.0 authentication package for Klein College sites. Built as an Acorn service provider, it wraps wp-saml-auth with custom login page modifications, managed user provisioning, and bulk user import capabilities.

Features

• SAML 2.0 Single Sign-On via institutional Identity Provider
• Custom WordPress login page with IdP toggle
• Managed user accounts with SAML attribute mapping
• Bulk user import from CSV
• SP metadata endpoint at /sp/metadata

Requirements

• PHP 8.3+
• WordPress with Acorn 5.0+
• wp-saml-auth plugin

Installation

composer require kleinweb/saml-auth

The service provider is auto-discovered via Acorn. Configure in config/kleinweb-auth.php.

Configuration

X.509 certificates should be placed in .config/x509/:

• .config/x509/keys/<name>.key - Private key
• .config/x509/certs/<name>.crt - Certificate

Key config options in config/kleinweb-auth.php:

• allow_local_login - Enable/disable WordPress password login (default: true)
• auto_provision - Auto-create accounts for new IdP users (default: false)
• default_role - Role assigned to provisioned users

Development

just check    # Run all QA checks
just fix      # Apply formatters and fixers
just build    # Build frontend assets
just dev      # Watch mode

Tools

• https://www.samltool.com/

References

SAML Specifications

• Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0
• Glossary for the OASIS Security Assertion Markup Language (SAML) V2.0
• Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0
• Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0

SAML Attribute Naming Conventions

• SAML V2.0 X.500/LDAP Attribute Profile
• Attribute Naming - Shibboleth Concepts
• eduPerson Object Class Specification (20220208) v4.4.0
• eduPersonDisplayPronouns

Background

• https://www.rfc-editor.org/rfc/rfc2798.html
• https://www.rfc-editor.org/rfc/rfc4519.html
• https://www.rfc-editor.org/rfc/rfc4524.html