David

Also looks like this is technically supported by RSS 2.0.1 (Example 4: Encoding angle brackets in text within a CDATA section)
https://www.rssboard.org/rss-encoding-examples

My pleasure @itruemper, glad to hear it helped!

No problem @pacman_d, happy to help! If this solution worked for you, it would be great if you could star it in GitHub. I’ll try to keep up to date with other enhancements going forward.

Hi @pacman_d, let me clarify what we ended up doing.

The SAML 2.0 plugin does not support restricting the entire site, only wp-admin. To restrict the site, we used another plugin, Restricted Site Access. This plugin, however, needed to be modified to allow (or whitelist) the SAML 2.0 URLs without being authenticated. The SAML plugin handles logins, so obviously need to hit this before being authenticated, otherwise you just get bounced back and forth.

I added those 2 plugins to github if you want to take a look at our configuration. I wish this was around when I started and hope it saves you a bunch of time!

https://github.com/dritsema/wordpress

For authsources.php above, the foreach loop is not necessary and only works for the last site added since $config is overwritten each iteration. The following can be used instead. Also, removed direct SQL queries.

$blog_id = (string)get_current_blog_id();
$wp_opt = get_blog_option($blog_id, 'saml_authentication_options');

$blog_entityid = NULL;
$blog_details = get_blog_details($blog_id);
if ( !empty( $blog_details ) ) {
	$blog_entityid = $blog_details->siteurl . $blog_details->path . "wp-content/plugins/saml-20-single-sign-on/saml/www/module.php/saml/sp/metadata.php/" . $blog_id;
}

$config = array(

	// This is a authentication source which handles admin authentication.
	'admin' => array(
		// The default is to use core:AdminPassword, but it can be replaced with
		// any authentication source.

		'core:AdminPassword',
	),

	// An authentication source which can authenticate against both SAML 2.0
	// and Shibboleth 1.3 IdPs.

	$blog_id => array(
		'saml:SP',
		'NameIDPolicy' => $wp_opt['nameidpolicy'],
		// The entity ID of this SP.
		// Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.
		'entityID' => $blog_entityid,
		'sign.authnrequest' => TRUE,
		'sign.logout' => TRUE,
		'redirect.sign' => TRUE,
		// The entity ID of the IdP this should SP should contact.
		// Can be NULL/unset, in which case the user will be shown a list of available IdPs.
		'idp' => $wp_opt['idp']
	)
);

// Cert and Key may not exist

if( file_exists( constant('SAMLAUTH_CONF') . '/certs/' . $blog_id . '/' . $blog_id . '.cer') )
{
	$config[$blog_id]['certificate'] = constant('SAMLAUTH_CONF') . '/certs/' . $blog_id . '/' . $blog_id . '.cer';
}

if( file_exists( constant('SAMLAUTH_CONF') . '/certs/' . $blog_id . '/' . $blog_id . '.key') )
{
	$config[$blog_id]['privatekey'] = constant('SAMLAUTH_CONF') . '/certs/' . $blog_id . '/' . $blog_id . '.key';
}

SAML code changed and working. Thanks for the hand.

if( $role !== false )
    {
      $user_opts = array(
        'user_login' => $login ,
        'user_pass'  => $this->user_password($login,$this->secretsauce) ,
        'user_email' => $email ,
        'first_name' => $first_name ,
        'last_name'  => $last_name ,
        'display_name' => $display_name ,
        'role'       => $role
        );
      $user_id = wp_insert_user($user_opts);

      if( !is_wp_error($user_id) ) {
      	$blog_id = get_current_blog_id();
      	add_user_to_blog($blog_id, $user_id, $role);
      }

      $this->simulate_signon($login);
    }
    else
    {
      die('The website administrator has not given you permission to log in.');
    }

Thanks @mattyrob. If this is indeed a hack then I will update the SAML plugin and add that function you mentioned. I’m definitely in favor of changing the source of the issue. Will let you know once I have an update.

Take a look at classes/class-s2-core.php. I added the user_register hook to the multisite piece and it seemed to work:

if ( $this->s2_mu ) {
	add_action('user_register', array(&$this, 'register_post')); // need this
	add_action('wpmu_activate_user', array(&$s2class_multisite, 'wpmu_add_user'));
	add_action('add_user_to_blog', array(&$s2class_multisite, 'wpmu_add_user'), 10);
	add_action('remove_user_from_blog', array(&$s2class_multisite, 'wpmu_remove_user'), 10);
} else {
	add_action('register_form', array(&$this, 'register_form'));
	add_action('user_register', array(&$this, 'register_post'));
}

Yes thats what I expected as well. The SAML plugin does use the wp_insert_user call as per the snippet below. And Subscribe2 handles the ‘user_register’ hook? Not sure what we could be missing.

if( $role !== false )
    {
      $user_opts = array(
        'user_login' => $login ,
        'user_pass'  => $this->user_password($login,$this->secretsauce) ,
        'user_email' => $email ,
        'first_name' => $first_name ,
        'last_name'  => $last_name ,
        'display_name' => $display_name ,
        'role'       => $role
        );
      wp_insert_user($user_opts);
      $this->simulate_signon($login);
    }
    else
    {
      die('The website administrator has not given you permission to log in.');
    }

Thanks @mattyrob.

Thanks for the tip. Auto subscribe is the better option so users can opt out. Does that work with a single category though? We only want to auto-subscribe users to an “announcements” category and leave the rest unselected. The others they can just opt in and out on their own.

Ah so if I’m understanding this correctly, a compulsory category would email all registered users which means they’re subscribed anyway, to that one category. Then technically we wouldn’t need to auto subscribe them. So its actually the compulsory category we need but the auto subscribe that we don’t. Is that right?

Yep both options I mentioned above are under the Registered Users tab.

Subscribe new users registering with your blog: Automatically
Auto-subscribe includes any excluded categories: No
Registration Form option is checked by default: Yes
Auto-subscribe users to receive email as: HTML – Full

The plugin actually does support this but if you’re looking for customization you will need some basic knowledge of PHP. Take a look at templates here https://www.ads-software.com/plugins/list-category-posts/other_notes/

You should be able to use a template to accomplish this. By default the items are an unordered list inside a foreach() loop. Instead you could write your own template which iterates through 3 records at a time, in separate divs, and float your div tags left. Make sure to apply the CSS method clear: both; after 3 to start a new line.