yalet

In an ideal world, if the plugin was network activated, blog admins would have a limited configuration screen for role mapping, and the network admin would have the global allow/deny authorization settings.

Yes, and this “feature” is actively bad; core WordPress does not behave this way. You can be logged into a multisite instance and visit a blog without having a role on the site. Also, for the non-public blog case mentioned, this is a security risk. Any user who can log into the multisite instance will be able to see the non-public blog. In core WordPress, you need at least the Subscriber role to do this.

Thanks, I was able to use the filter and an init action to get the behavior I wanted.

I appreciate the quick turnaround.

Hmm, the problem is that the only regexes that match all of our subdomains on WordPress would also match everything in our entire domain or be functionally equivalent to having several hundred service entries, so that’s not going to work for us.

What I’m really looking for is a way for the plugin to make the service parameter

https://<DOMAIN_CURRENT_SITE&gt;?site=<SITE_REQUESTED_LOGIN>

and then when they return from CAS, after validating the ticket they get redirected to <SITE_REQUESTED_LOGIN>, which is where they wanted to go.

If you run into this issue, can’t get to the Reset Options page, and have access to wp-cli:

wp eval 'A_Reset_Form::reset_action();'

That appears to manually run the action that submitting the form does. Worked for me anyway.