Hi, has anyone managed to make this work on WP 5.4+? I’ve multiple “Headers already sent” errors.

I’m using Apache as web-server on Ubuntu 16.04 LTS:

As of version 1.15 of simplesamlphp, they changed namespace so the plugin code (simplesamlphp-authentication.php) should be changed in two places, namely
‘new SimpleSAML_Auth_Simple’
should be replaces with
‘new SimpleSAML\Auth\Simple’

Unless this is done, the /var/log/syslog may be flooded with php-warnings like this:

‘simplesamlphp[32955]: 4 [TR58b9ddc7] The class or interface ‘SimpleSAML_Auth_Simple’ is now using namespaces, please use ‘SimpleSAML\Auth\Simple’.

When a value is set for “Administrator Entitlement URI”, it is only taken into account at account creation time.
If the entitlement changes later, the role is not being updated.
This is counter intuitive, and also poses a slight security risk.
When we rely on eduPersonEntitlement for assigning roles, we should also update the role when the attribute changes.

When using the eduPersonEntitlement SAML attribute to set the Administrator Entitlement URI, only a fixed value is accepted.
In some scenarios only a part of the value is fixed, for instance scoped values where you would only want to use the first part of a URN.

As an improvement, it should be possible to accept regular expressions as well.
In order to maintain compatibility, and to avoid introducing an extra “regex or string match” configuration option, this could be done by checking if the value is surrounded by slashes. Pseudo code:

if value = somestring => fixed string match
if value = /somestring.*otherpart/ => regex match

This module still works with WP 4.5.1 when people login via wp-login.php, but it gets caught by the reauth parameter if people try to login vi /wp-admin/. I borrowed the code from the http_authentication plugin to remove the reauth parameter, and put an updated version at https://github.com/scottylogan/wp-simplesamlphp-authentication

Here’s just the patch:

diff --git a/simplesamlphp-authentication.php b/simplesamlphp-authentication.php
index a864db3..61681c0 100644
--- a/simplesamlphp-authentication.php
+++ b/simplesamlphp-authentication.php
@@ -53,6 +53,7 @@ if ($simplesaml_configured) {
/*
Plugin hooks into authentication system
*/
+add_filter('login_url', array('SimpleSAMLAuthenticator', 'bypass_reauth'));
add_filter('authenticate', array('SimpleSAMLAuthenticator', 'authenticate'), 10, 2);
add_action('wp_logout', array('SimpleSAMLAuthenticator', 'logout'));
add_action('lost_password', array('SimpleSAMLAuthenticator', 'disable_function'));
@@ -136,7 +137,21 @@ if ($slo) {
if(!class_exists('SimpleSAMLAuthenticator')) {

class SimpleSAMLAuthenticator {
-
+
+ /*
+ * "Borrowed" from https://www.ads-software.com/plugins/http-auth
+ *
+ * Remove the reauth=1 parameter from the login URL, if applicable. This allows
+ * us to transparently bypass the mucking about with cookies that happens in
+ * wp-login.php immediately after wp_signon when a user e.g. navigates directly
+ * to wp-admin.
+ */
+ function bypass_reauth($login_url) {
+ $login_url = remove_query_arg('reauth', $login_url);
+
+ return $login_url;
+ }
+
function authenticate($user, $username) {
if(is_a($user, 'WP_User')) { return $user; }

https://www.ads-software.com/plugins/simplesamlphp-authentication/

I’m having an issue where new users in Salesforce are coming into WordPress correctly, but their role is being left blank. I’m manually changing their role to subscriber once they’ve come in as a user.

In WordPress, the “New User Default Role” is set at Subscriber, so I’m thinking it must be something I need to update either in Salesforce or with this plugin. Does anyone else have this issue? Is there a solution?

https://www.ads-software.com/plugins/simplesamlphp-authentication/

This is actually a feature of WordPress, but it prevents different accounts with the same e-mail to log in.
See https://wordpress.stackexchange.com/questions/144185/allow-duplicate-email-address-for-different-users

The most important reason looks to be the “forgot password” feature.

However, when using federated auth, this is not needed.
Hence, the duplicate mail check is not needed in this scenario.

I’ve tried removed the check in wp-includes/wp-user.php (around line 1953) and that seems to work. Don’t think that much will break.
Will see if this can be fixed, but since this is in core, I’m not sure.

https://www.ads-software.com/plugins/simplesamlphp-authentication/

Has anyone gotten this to work with WordPress 4.0?

https://www.ads-software.com/plugins/simplesamlphp-authentication/

Hello,

I see that the current version of simpleSAMLphp just put the user in two role : Admin or subscriber based on a “flag” in EduPersonEntillement” attribute.
Does anyone as modified the code to allow
– user of “Member Of” attributes that is a mapping of AD security group (and or use of OU)
– support for multi-group (so allow users to belong to different security group and only catch the one that is relevant for role mapping)

Thx.

https://www.ads-software.com/plugins/simplesamlphp-authentication/

It seems to me, that some troubles come up, when needed to relogin.
After relogin, it shows the WordPress login page.
Someone has earlier told, its a problem with the value reauth=1, and that this can be changed in wp-login.php
For me following change for the requireAuth line around 148:
$as->requireAuth();
to
$as->requireAuth(array('ReturnTo' => wp_login_url(wp_make_link_relative($_REQUEST["redirect_to"]), false)));
Seems to do the job.
By suggesting the the adress, reauth will not be set.
It also seems, that the return always went back to the admin front page, it seems to be a safety procedure that does not accept full path redirect_to adress. By using wp_make_link_relative it is relative, and acceptet..

https://www.ads-software.com/plugins/simplesamlphp-authentication/

I would suggest following changes:
– Make it possible to change eduPersonEntitlement (for us using Active Directory, it would be named memberOf)
– Make it possible to list multiple groups that gives administrator rights

Here is my suggestion:

Add after line 336

<tr>
		<th><label for="person_entitlement">Person Entitlement variable</label></th>
		<td><input type="text" name="person_entitlement" id="person_entitlement_inp" value="<?php echo $options['person_entitlement']; ?>" size="40" />
		<span class="setting-description">The default is eduPersonEntitlement for administrator search.</span>
	</tr>

	<tr valign="top">
		<th scope="row">Administrator Entitlement</th>
		<td>
		<label for="new_user"><input name="multi_admin" type="checkbox" id="multi_admin_inp" value="1" <?php checked('1', $options['multi_admin']); ?> />Accept multiple Administrator Entitlement seperated with semicolon</label>
		<span class="setting-description">(Only one of them will be needed.)</span>
		</td>
	</tr>

Add to new lines around line 285:

'person_entitlement' => 'eduPersonEntitlement',
		'multi_admin' => FALSE,

Change line 215-218 to:

if ($simplesaml_authentication_opt['admin_entitlement'] != '' &&
						$attributes[$simplesaml_authentication_opt['person_entitlement']] &&
						(($simplesaml_authentication_opt['multi_admin']==FALSE && in_array($simplesaml_authentication_opt['admin_entitlement'], $attributes[$simplesaml_authentication_opt['person_entitlement']])) OR
						($simplesaml_authentication_opt['multi_admin']==TRUE && (0 < count(array_intersect(explode(';',$simplesaml_authentication_opt['admin_entitlement']), $attributes[$simplesaml_authentication_opt['person_entitlement']])))))) {

https://www.ads-software.com/plugins/simplesamlphp-authentication/

I would like to be able to have a “login” button for the simpleSAML users, and a login button for our non-network users to use WordPress’ normal login/registration capabilities. Is this possible?

https://www.ads-software.com/plugins/simplesamlphp-authentication/

In order to get login to work for existing users (this wasn’t installed on a new wordpress site) I had to comment out the following code. Any ideas on why the sanitization is failing? The user ID in wordpress is klandon. It was being passed KLandon.

//if ($username != substr(sanitize_user($username, TRUE), 0, 60)) {
//$error = sprintf(__(‘<p>ERROR

//We got back the following identifier from the login process:

%s

//Unfortunately that is not suitable as a username.
//Please contact the blog administrator and ask to reconfigure the
//simpleSAMLphp plugin!</p>’), $username, get_option(‘admin_email’));
//$errors[‘registerfail’] = $error;
//print($error);
//exit();
//}

https://www.ads-software.com/plugins/simplesamlphp-authentication/

Hi:
I’ve tried to install simplesaml-authentication with 3.5.1 on a MU site. I see all config is saved to first blog but any other blog doesn’t get its config.
My aim was to have the entire nework simplesaml’ed so replaced all ocurrences of get_option for get_site_option and update_option for update_site_option on the plugin source.
So far the plugin is working for me and I was wondering if this is a solution for anyone.

Comments?

https://www.ads-software.com/plugins/simplesamlphp-authentication/

We have a client who has a need to use SAML on their site. Wondering if you could contact me directly and see if we can get a quote from you to make site modifications and install SAML? For lack of a better way and to expedite things you can reach me at:

priscilla at tinyfrog dot com

I will send details from there.
Thanks.

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Everyone,

I have updated the code to address these issues:

• After passing SAML, you will be redirected to the proper page – instead of the WP login.
• Users that are added are given the subscriber role

Here is the snippet of code with the updates:

function authenticate(&$username, &$password) {
			global $simplesaml_authentication_opt, $simplesaml_configured, $as;

			if (!$simplesaml_configured) {
				die("simplesaml-authentication plugin not configured");
			}
			// Reset values from input ($_POST and $_COOKIE)
			$username = $password = '';

			$as->requireAuth();

			$attributes = $as->getAttributes();

			/*
			 * Only allow usernames that are not affected by sanitize_user(), and that are not
			 * longer than 60 characters (which is the 'user_login' database field length).
			 * Otherwise an account would be created but with a sanitized username, which might
			 * clash with an already existing account.
			 * See sanitize_user() in wp-includes/formatting.php.
			 */
			if(empty($simplesaml_authentication_opt['username_attribute'])) {
				$username = $attributes['uid'][0];
			} else {
				$username = $attributes[$simplesaml_authentication_opt['username_attribute']][0];
			}

			if ($username != substr(sanitize_user($username, TRUE), 0, 60)) {
				$error = sprintf(__('<p><strong>ERROR</strong><br /><br />
				We got back the following identifier from the login process:<pre>%s</pre>
				Unfortunately that is not suitable as a username.<br />
				Please contact the <a href="mailto:%s">blog administrator</a> and ask to reconfigure the
				simpleSAMLphp plugin!</p>'), $username, get_option('admin_email'));
				$errors['registerfail'] = $error;
				print($error);
				exit();
			}

			$password = md5(SimpleSAMLAuthentication::passwordRoot());

			if (!function_exists('get_user_by')) {
				die("Could not load user data");
			}

			$user = get_user_by('login', $username);

			if ($user) { // user already exists - try to log them in															

				$user = wp_authenticate($username, $password);
				wp_set_current_user($user->ID); //Here is where we update the global user variables
				wp_set_auth_cookie($user->ID);
				do_action('wp_login',$userdata->ID);

				if (isset($_REQUEST['redirect_to'])){
					wp_redirect($_REQUEST['redirect_to']);
				} else {
					wp_redirect(get_bloginfo('url'));
				}

				exit;

			} else {
				// First time logging in
				if ($simplesaml_authentication_opt['new_user'] == 1) {
					// Auto-registration is enabled
					// User is not in the WordPress database
					// They passed SimpleSAML and so are authorised
					// Add them to the database

					// User must have an e-mail address to register
					$user_email = '';
					$email_attribute = empty($simplesaml_authentication_opt['email_attribute']) ? 'mail' : $simplesaml_authentication_opt['email_attribute'];

					if($attributes[$email_attribute][0]) {
						// Try to get email address from attribute
						$user_email = $attributes[$email_attribute][0];
					} else {
						// Otherwise use default email suffix
						if ($simplesaml_authentication_opt['email_suffix'] != '') {
							$user_email = $username . '@' . $simplesaml_authentication_opt['email_suffix'];
						}
					}

					$user_info = array();
					$user_info['user_login'] = $username;
					$user_info['user_pass'] = $password;
					$user_info['user_email'] = $user_email;

					if(empty($simplesaml_authentication_opt['firstname_attribute'])) {
						$user_info['first_name'] = $attributes['givenName'][0];
					} else {
						$user_info['first_name'] = $attributes[$simplesaml_authentication_opt['firstname_attribute']][0];
					}

					if(empty($simplesaml_authentication_opt['lastname_attribute'])) {
						$user_info['last_name'] = $attributes['sn'][0];
					} else {
						$user_info['last_name'] = $attributes[$simplesaml_authentication_opt['lastname_attribute']][0];
					}

					// Set user role based on eduPersonEntitlement
					if ($simplesaml_authentication_opt['admin_entitlement'] != '' &&
						$attributes['eduPersonEntitlement'] &&
						in_array($simplesaml_authentication_opt['admin_entitlement'],
						$attributes['eduPersonEntitlement'])) {
						$user_info['role'] = "administrator";
					} else {
						$user_info['role'] = "subscriber";
					}

					$wp_uid = wp_insert_user($user_info);

					// the user should have been crated so lets confirm this
					$user = get_user_by('login', $username);

					if ($user) { // user already exists - try to log them in
						$user = wp_authenticate($username, $password);
						wp_set_current_user($user->ID); //Here is where we update the global user variables
						wp_set_auth_cookie($user->ID);
						do_action('wp_login',$userdata->ID);

						if (isset($_REQUEST['redirect_to'])){
							wp_redirect($_REQUEST['redirect_to']);
						} else {
							wp_redirect(get_bloginfo('url'));
						}

						exit;
					}

				} else {
					$error = sprintf(__('<p><strong>ERROR</strong>: %s is not registered with this blog.
						Please contact the <a href="mailto:%s">blog administrator</a> to create a new
						account!</p>'), $username, get_option('admin_email'));
					$errors['registerfail'] = $error;
					print($error);
					print('<p><a href="/wp-login.php?action=logout">Log out</a> of SimpleSAML.</p>');
					exit();
				}
			}
		}

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Hi,

I am using WP 3.5 MU and my IdP logs me fine, but I get redirected to wp-login.php and I am not able to log in through WP. Shouldn’t I be logged in once I went through my authentication process?

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

I am using this plugin, and it works perfects, but I have a issue when a user sign out because wordpress says no user present, I meang wordpress delete all session but the user tries to sign in the sts federation says the user is login so the 2 user can not log in because the old session is actived, Any idea?

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Hey there – how do I submit a patch? I fixed the issue where pre-SAML users couldn’t log in afterward. This is admittedly an edge case, but it could help people implementing simple sign-on who had existing users before with the same user names as their SAML user names. Of course, if the names didn’t match, then it’s useless. Maybe an optional function.

Also trying to fix the reauth issue in a smart way (going to /wp-admin drops me on wp-login.php with reauth set). Would like to contribute that…that seems generally useful.

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

The weird thing is that this happened randomly. Maybe it’s a cache thing:

Fatal error: Cannot redeclare is_user_logged_in() (previously declared in /home/example/domains/example.mysite.com/public_html/wordpress/wp-includes/pluggable.php:726) in /home/example/domains/example.mysite.com/public_html/wordpress/wp-content/plugins/simplesamlphp-authentication/simplesamlphp-authentication.php on line 66 Call Stack: 0.0000 337988 1. {main}() /home/example/domains/example.mysite.com/public_html/wordpress/wp-admin/plugins.php:0 0.0830 4188880 2. plugin_sandbox_scrape() /home/example/domains/example.mysite.com/public_html/wordpress/wp-admin/plugins.php:149 0.0831 4191480 3. include(‘/home/example/domains/example.mysite.com/public_html/wordpress/wp-content/plugins/simplesamlphp-authentication/simplesamlphp-authentication.php’) /home/example/domains/example.mysite.com/public_html/wordpress/wp-admin/plugins.php:147

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Hi there. Great plugin. I installed my first wordpress site on CentOS6 and had SAML integrated, all in under 20 minutes ??

However, it did make me think of what we have already discovered about SAML – it is designed for an outdated model – that web browsers are king. To prove the point I installed the official wordpress for Android app and sure enough, it talks via /xmlrpc.php to wordpress – which isn’t integrated with SAML ??

Officially I guess “we” are supposed to look towards “Delegated Authentication Based Single Sign-On” to solve this – which looks to me like simple handing your password over to SAML SPs – which is sorta what SAML was designed to avoid. Wonderful ??

Anyway, with that rant out of the way, I was wondering if anyone else was thinking along the lines of supporting mobile apps within a SAML environment, and how they handle it?

Thanks!

Jason

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Great plugin – up and running in no time and works like a charm ??

One misleading piece of info in the plugin settings though:

The check box for “user registration” says “Automatically register new users (Users will be registered with the role of Subscriber.)”

However, the default role is actually set to “Author” (BIG difference). This is seen in the plugin’s php file on line 197:

$user_info[‘role’] = “author”;

…so either the plugin code should be changed to “subscriber”, or the settings text needs to reflect that role is set to “Author”.

Thanks again for the great plugin!
Simon

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

I’m experiencing an issue that has required med to hack the ‘wp-login.php’ file to stop WordPress from requiring re-authentication upon redirection to the WordPress Admin Area (/wp-admin/).

Whenever I get logged in to my SAML2 IdP I return to the WordPress site, but instead of logging me in without requiring further username and password, I get to the WordPress login form and the only thing to do is to manually edit the location from https://server.example.com/wp-login.php?redirect_to=https%3A%2F%2Fserver.example.com%2Fwp-admin%2F&reauth=1 to https://server.example.com/wp-admin and it works …

What I did was to change this line (line #560 of wp-login.php):

$reauth = empty($_REQUEST['reauth']) ? false : true;

To:

$reauth = empty($_REQUEST['reauth']) ? false : false;

Now, the hack is simple, in the fact that I only need to turn off the reauth bit of the puzzle, basically by always leaving this set to ‘false’ and instead I rely on my simpleSAMLphp SP and IdP to require authentication which in turn is trusted by WordPress, leaving me with a smooth ride …

Could this somehow be corrected? I know https://rnd.feide.no has it working, but I’ve never actually heard from those guys, if they’ve done the same as I’ve done in terms of changing this single line in wp-login.php … -And, is this an issue for others as well?

Otherwise G R E A T plugin! Hugely important to me, thank you!

Best regards,

S?ren Gr?nning

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

I found this plugin to work well but it only adds the user connecting to one blog. I have updated the plugin so that when connecting to a WordPress Network it will add the user and then provision a new blog using the username as the identifier.

I’ve quickly removed some of the paths from my own install but the code I uses is as follows. Thought it might help with version 0.6 ??

register_activation_hook( __FILE__, 'set_simplesamlphp_settings' );
add_action('admin_menu', 'simplesaml_authentication_add_options_page');

$simplesaml_authentication_opt = get_site_option('simplesaml_authentication_options');

$simplesaml_configured = true;

// try to configure the simpleSAMLphp client
if ($simplesaml_authentication_opt['include_path'] == '') {
  $simplesaml_configured = false;
} else {
  $include_file = $simplesaml_authentication_opt['include_path']."/lib/_autoload.php";
  if (!include_once($include_file))
    $simplesaml_configured = false;
}

if ($simplesaml_configured) {
  if($simplesaml_authentication_opt['sp_auth'] == '')
    $sp_auth = 'default-sp';
  else
    $sp_auth = $simplesaml_authentication_opt['sp_auth'];
  $as = new SimpleSAML_Auth_Simple($sp_auth);
}

// for wp_create_user function on line 120
require_once (ABSPATH . WPINC . '/registration.php');

// plugin hooks into authentication system
add_action('wp_authenticate', array('SimpleSAMLAuthentication', 'authenticate'), 10, 2);
add_action('wp_logout', array('SimpleSAMLAuthentication', 'logout'));
add_action('lost_password', array('SimpleSAMLAuthentication', 'disable_function'));
add_action('retrieve_password', array('SimpleSAMLAuthentication', 'disable_function'));
add_action('password_reset', array('SimpleSAMLAuthentication', 'disable_function'));
add_filter('show_password_fields', array('SimpleSAMLAuthentication', 'show_password_fields'));

if (!class_exists('SimpleSAMLAuthentication')) {
  class SimpleSAMLAuthentication {

    // password used by the plugin
    function passwordRoot() {
      return 'Authenticated through SimpleSAML';
    }    

    /*
     We call simpleSAMLphp to authenticate the user at the appropriate time
     If the user has not logged in previously, we create an account for them
    */
    function authenticate(&$username, &$password) {
      global $simplesaml_authentication_opt, $simplesaml_configured, $as;

      if (!$simplesaml_configured)
        die("simplesaml-authentication plugin not configured");

      // Reset values from input ($_POST and $_COOKIE)
      $username = $password = '';		

      $as->requireAuth();

      $attributes = $as->getAttributes();
      $username = $attributes['cn'][0];
      $password = md5(SimpleSAMLAuthentication::passwordRoot());

      if (!function_exists('get_userdatabylogin'))
        die("Could not load user data");
      $user = get_userdatabylogin($username);

      if ($user) {
        // user already exists
		//we will update the password in the user account just in case we have screwed it up and changed it!
  	    $user_info = array();
		$user_info['ID'] = $user->ID;
		$user_info['user_pass'] = $password;
		wp_update_user( $user_info ) ;
        return true;
      } else {
        // first time logging in
        if ($simplesaml_authentication_opt['new_user'] == 1) {
          // auto-registration is enabled

          // User is not in the WordPress database
          // they passed SimpleSAML and so are authorized
          // add them to the database
          // User must have an email address to register
          if($attributes['mail']) {
            // Try to get email address from attributes
            $user_email = $attributes['mail'][0];
          } else {
            // Otherwise use default email suffix
            if ($simplesaml_authentication_opt['email_suffix'] != '')
              $user_email = $username . '@' . $simplesaml_authentication_opt['email_suffix'];
          }
		  //correctly read other attributs
          $user_info = array();
          $user_info['user_login'] = $username;
          $user_info['user_pass'] = $password;
          $user_info['user_email'] = $user_email;

          if($attributes['givenName'])
            $user_info['first_name'] = $attributes['givenName'][0];
          if($attributes['sn'])
            $user_info['last_name'] = $attributes['sn'][0];

          // Set user role based on eduPersonEntitlement
          if($simplesaml_authentication_opt['admin_entitlement'] != '' &&
	      $attributes['eduPersonEntitlement'] &&
             in_array($simplesaml_authentication_opt['admin_entitlement'],
                $attributes['eduPersonEntitlement'])) {
            $user_info['eduPersonEntitlement'] = "administrator";
          } else {
            $user_info['eduPersonEntitlement'] = "author";
          }
		  //now create the users primary blog for them
		  $blog_title = strtolower(preg_replace('/[^a-zA-Z0-9 ]/','',$username));
          $wp_uid = wp_insert_user($user_info);
		  $result = wpmu_create_blog('blogs.glew.org.uk','/' .$blog_title,$blog_title,$wp_uid,array(),'1');
		  //remove user from main blog!
		  remove_user_from_blog($wp_uid, '1', '');
		  //write options for authentication plugin
		  if (function_exists('add_options_page')) {
			    add_options_page('simpleSAMLphp Authentication', 'simpleSAMLphp Authentication', 8, basename(__FILE__), 'simplesaml_authentication_options_page');
		  }
		  // Setup Default Options Array
 	      global $wpdb;
		  $optionarray_update = array(
			   'new_user' => TRUE,
			   'redirect_url' => '',
			   'email_suffix' => 'example.com',
			   'sp_auth' => 'default-sp',
			   'include_path' => $simplesaml_authentication_opt['include_path'],
			   'admin_entitlement' => '',
			   );
   		  add_site_option($result, 'simplesaml_authentication_options', $optionarray_update);
		}
        else {
          $error = sprintf(__('<p><strong>ERROR</strong>: %s is not registered with this blog. Please contact the <a href="mailto:%s">blog administrator</a> to create a new account!</p>'), $username, get_option('admin_email'));
          $errors['registerfail'] = $error;
          print($error);
          print('<p><a href="/wp-login.php?action=logout">Log out</a> of SimpleSAML.</p>');
          exit();
        }
      }
    }

	//do hook for activating a blog
	function set_simplesamlphp_settings() {
		  // Setup Default Options Array
 	      global $wpdb;
		  global $blog_id;
		  $optionarray_update = array(
			   'new_user' => TRUE,
			   'redirect_url' => '',
			   'email_suffix' => 'example.com',
			   'sp_auth' => 'default-sp',
			   'include_path' => '<path to your simplesamlphp installation for service provider>',
			   'admin_entitlement' => '',
			   );
   		  add_blog_option($blog_id, 'simplesaml_authentication_options', $optionarray_update);
	}

    function logout() {
      global $simplesaml_authentication_opt, $simplesaml_configured, $as;
      if (!$simplesaml_configured)
        die("simplesaml-authentication not configured");

      $as->logout(get_settings('siteurl'));
    }

    /*
     Don't show password fields on user profile page.
    */
    function show_password_fields($show_password_fields) {
      return false;
    }

    function disable_function() {
      die('Disabled');
    }

  }
 }

//----------------------------------------------------------------------------
//		ADMIN OPTION PAGE FUNCTIONS
//----------------------------------------------------------------------------

function simplesaml_authentication_add_options_page() {
  if (function_exists('add_options_page')) {
    add_options_page('simpleSAMLphp Authentication', 'simpleSAMLphp Authentication', 8, basename(__FILE__), 'simplesaml_authentication_options_page');
  }
} 

function simplesaml_authentication_options_page() {
  global $wpdb;

  // Setup Default Options Array
  $optionarray_def = array(
			   'new_user' => TRUE,
			   'redirect_url' => '',
			   'email_suffix' => 'example.com',
			   'sp_auth' => 'default-sp',
			   'include_path' => '<path to your simplesamlphp installation for service provider',
			   'admin_entitlement' => '',
			   );

  if (isset($_POST['submit']) ) {
    // Options Array Update
    $optionarray_update = array (
				 'new_user' => $_POST['new_user'],
				 'redirect_url' => $_POST['redirect_url'],
				 'email_suffix' => $_POST['email_suffix'],
				 'include_path' => $_POST['include_path'],
				 'sp_auth' => $_POST['sp_auth'],
				 'admin_entitlement' => $_POST['admin_entitlement'],
				 );

    update_site_option('simplesaml_authentication_options', $optionarray_update);
  }

  // Get Options
  $optionarray_def = get_site_option('simplesaml_authentication_options');

  ?>
	<div class="wrap">
	<h2>simpleSAMLphp Authentication Options</h2>
    <?php 

	    global $current_blog;
		$blog_path = substr($current_blog->path,0,-1);
    	if(is_super_admin()) {
	?>

	<form method="post" action="<?php echo $blog_path . $_SERVER['PHP_SELF'] .  '?page=' . basename(__FILE__); ?>&updated=true">
	<fieldset class="options">

     <h3>User registration options</h3>

	<table class="form-table">
	   <tr valign="top">
		<th scope="row">User registration</th>
		<td><label for="new_user">
		<input name="new_user" type="checkbox" id="new_user_inp" value="1" <?php checked('1', $optionarray_def['new_user']); ?> />
Automatically register new users</label>
		<span class="setting-description">(Users will be registered with the role of Subscriber.)</span></td>
		</tr>
		<tr>
		<th><label for="email_suffix"> Default email domain</label></th>
		<td>
	   	<input type="text" name="email_suffix" id="email_suffix_inp" value="<?php echo $optionarray_def['email_suffix']; ?>" size="35" />
		<span class="setting-description">If an email address is not availble from the <acronym title="Identity Provider">IdP</acronym> <strong>username@domain</strong> will be used.</td>
</tr>
		<tr>
		<th> <label for="admin_entitlement">Administrator Entitlement URI</label></th>
		<td>
		<input type="text" name="admin_entitlement" id="admin_entitlement_inp" value="<?php echo $optionarray_def['admin_entitlement']; ?>" size="40" />
		<span class="setting-description">An <a href="https://rnd.feide.no/node/1022">eduPersonEntitlement</a> URI to be mapped to the Administrator role.</span>
		</td>
		</tr>
	</table>

    <h3>simpleSAMLphp options</h3>
    <p><em>Note:</em> Once you fill in these options, WordPress authentication will happen through <a href="https://rnd.feide.no/simplesamlphp">simpleSAMLphp</a>, even if you misconfigure it. To avoid being locked out of WordPress, use a second browser to check your settings before you end this session as Administrator. If you get an error in the other browser, correct your settings here. If you can not resolve the issue, disable this plug-in.</p>
  	<table class="form-table">
	   <tr valign="top">
		<th scope="row"><label for="include_path">Path to simpleSAMLphp</label></th>
		<td><input type="text" name="include_path" id="include_path_inp" value="<?php echo $optionarray_def['include_path']; ?>" size="35" />
		<span class="setting-description">simpleSAMLphp suggested location is <tt>/var/simplesamlphp</tt>.</span>
		</td>
		</tr>

	   <tr valign="top">
	   <th scope="row"><label for="sp_auth">Authentication source ID</label></th>
	   <td><input type="text" name="sp_auth" id="sp_auth_inp" value="<?php echo $optionarray_def['sp_auth']; ?>" size="35" />
		<span class="setting-description">simpleSAMLphp default is "default-sp".</span>
             </td>
	     </tr>
	</table>
	</fieldset>
	<p />
	<div class="submit">
		<input type="submit" name="submit" value="<?php _e('Update Options') ?> &raquo;" />
	</div>
	</form>
    <?php } else { ?>
    <div>Sorry, but you cannot edit these settings</div>
    <? } ?>
<?php
}
?>

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

This plugin sort of works, I get forwarded to IdP for authentication, but on return to wordpress, I get the login page with “ERROR: The username field is empty.”

Simplesamlphp 1.8 and wordpress 3.2.1

Anybody have any luck getting around this error?

This isn’t exactly about the plugin itself.

We have a WP network setup and if I enable the plugin for the whole network it activates on the root site as well. Which is what we want.
The problem is, that the Network Admin user is a WP internal user. The only way to log in as tha admin user is through the WP native login. To do that, the simpleSAMLphp Authentication plugin has to be disabled.

My question is this: Can a user authenticated through the simpleSAMLphp Authentication plugin be set as a Network Admin?

Regards.

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Having this problem and can’t figure it out! I have upgraded our MU 2.8.6 installation to 3.1 via the manual upgrade. I go to our main site and activate the simpleSAMLphp plugin, go to settings, reset everything, it’s all good.

Then I go to one of our sub-sites, activate the plugin, go to the settings, reset everything, click save and it bounced back to the simpleSAML settings page of the root blog (not the sub-site). When I go back to the simpleSAML settings of the sub-site, the settings are back to default.

Any ideas? I’ve even tried older versions of the plugin and no luck.

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Hi!

I am trying to get the simpleSAMLphp Authentication plugin 0.4.0 working with WordPress 3.0.5 (network mode). SimpleSAMLphp is configured do use our LDAP server directly.
There are a few snags I’ve hit.
After a default install and brief setup of the plugin, I get this error:

PHP Warning:  Parameter 1 to SimpleSAMLAuthentication::authenticate() expected to be a reference, value given in /.../wordpress_3.0.5/wp-includes/plugin.php on line 166, referer: https://site.wordpress.FQDN

After changing
function authenticate(&$username, &$password) {
to
function authenticate($username, $password) {

Then, clicking “Log In” takes me to a simpleSAMLphp login, and I get successfully authenticated by LDAP and then it fails, because there is no returnTo link offered to simpleSAMLphp.

Is there anyone, that has successfully made this plugin to work ?

Regards.

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/

Hi,

please explain how to “configure an eduPersonEntitlement that will be mapped to the Administrator role” – thank you very much!

Yag Po Khyi

https://www.ads-software.com/extend/plugins/simplesamlphp-authentication/