SSO between two WordPress sites | Single Sign On for Multiple WordPress sites

Overview

Guide to set up Single Sign On between two WordPress sites. To configure SSO between two WordPress sites, we’ll first assume one WordPress site as the main source of user authentication (Identity Provider), and the rest of the sites as the Service Providers(SP) into which users log in after successful authentication. In such a setting, SSO between two WP sites can be set up by using SAML for WordPress Service Provider and SAML for WordPress Identity Provider plugins.

Our SAML SP Single Sign On (SSO) plugin for WordPress gives you the ability to use your WordPress (WP) site as SAML SP (Service Provider) and you can configure other WordPress (WP) sites as an SAML IDP (Identity Provider) with miniOrange SAML IDP plugin for WordPress.

IDP Initiated SSO: When a user initiates SSO from the Identity Provider (WP Site A) to access the Service Provider (WP Site B), they won't need to re-enter their credentials. Instead, they'll log into the Service Provider (WP Site B) using their Identity Provider (WP Site A) credentials thus successlly achieving IDP Initiated SSO.
SP Initiated SSO: When a user tries to access the Service Provider (WP Site B) while not logged in, they will be sent to the Identity Provider's (WP Site A) login page commencing SP Initiated SSO. After successfully authenticating on the Identity Provider, the user will be returned and logged into the Service Provider (WP Site B).

Note: If you have an external Identity Provider and multiple WP sites which need to share credentials, you can configure all your WordPress sites as the Service Providers using our plugin. We also provide a solution for SSO between subsites of a Multisite network. Please Contact Us for more information.

Pre-requisites : Download And Installation

In this setup, WP Site A serves as the repository for storing users i.e. it will act as the IDP where the miniOrange SAML IDP plugin for WordPress will be installed.
While WP Site B is where users will log in using their credentials from Site A where SAML SSO Plugin for WordPress will be installed.

Note: To set up SSO for multiple WP sites Metadata from both sites i.e. WP Site A (IDP) and WP Site B (SP) is required which can be found in the plugins installed on the respective sites.

Configuration Steps

Let’s assume WP site A is our main source of authentication where the users are stored. So this WP site will be configured as the IDP where the SAML IDP plugin will be installed. Subsequently, WP Site B will be configured as the SP in which users can seamlessly SSO login using WP Site A, thus successfully setting up SSO for two or multiple WP sites.

Step 1: Configure WordPress Site A

Navigate to the WordPress Site B.
Install and activate the SAML SP Single Sign-On (SSO) login plugin on your WordPress site which is acting as a Service Provider.

Upload Metadata - SSO between two WordPress sites

In the miniOrange SAML SP SSO plugin, navigate to the Service Provider Metadata tab. Here, you can find the SP metadata such as SP Entity ID and ACS (AssertionConsumerService) URL which are required to configure the Identity Provider.
Navigate to the WordPress Site A.

Free
Premium

Navigate to the WordPress site.
Install and activate the miniOrange SAML IDP plugin for WordPress on your WordPress site which is acting as Identity Provider.
Go to the miniOrange SAML IDP plugin for WordPress, navigate to the Service Provider tab.
Enter the values corresponding to the information from the Service Provider. Refer to the table below.

Service Provider Name	Name of your Service Provider.
SP Entity ID or Issuer	Copy and paste the SP-EntityID from the Service Provider
ACS URL	Copy and paste the ACS URL from the Service Provider.
NameID Format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Assertion Signed	Checked

Configure setting - SSO between two WordPress sites

Click on the Save button to save your configurations.
Go to the IDP Metadata tab. Here you can find information for configuring the Service Provider.
You can also download the metadata XML file, by clicking on the download link.

download metadata - SSO between two WordPress sites

Navigate to the WordPress site.
Install and activate the miniOrange SAML IDP plugin for WordPress on your WordPress site which is acting as Identity Provider.
Go to the miniOrange SAML IDP plugin for WordPress navigate to the Service Provider tab.
Enter the values corresponding to the information from the Service Provider. Refer to the table below.

Service Provider Name	Name of your Service Provider.
SP Entity ID or Issuer	Copy and paste the SP-EntityID from the Service Provider.
ACS URL	Copy and paste the ACS URL from the Service Provider.
Select Binding type(optional)	Select Use HTTP-Redirect Binding for SLO
Single Logout URL(optional)	Enter Single Logout URL given in Service Provider.
X.509 Certificate(optional)	Enter X.509 Certificate.
NameID Format\	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Response Signed	Checked if you want to sign the SAML Response
Assertion Signed	Checked if you want to sign the SAML Response
Encrypted Assertion	Checked if you want to encrypt the SAML Assertion\

Click on the Save button to save your configurations.

Attribute Mapping (optional) :

Go to the Attribute/Role mapping tab and navigate to the Attribute mapping section.
When the user performs SSO, the NameID value is sent to the Service Provider. This value is
unique for every user.

attribute mapping - SSO between two WordPress sites

Click on the Save button to save your configuration.

User Attributes (optional) :

Go to the Attribute/Role mapping tab and navigate to User Attributes.
These are user attributes that can be sent to Service Provider
(such as first_name and last_name).
You can add multiple attributes by click on "+" button.

user attribute - SSO between two WordPress sites

Click on the Save button to save your configurations.

Custom Attributes (optional) :

Go to the Attribute/Role mapping tab and navigate to Custom Attributes.
These are extra static attributes that can be sent to Service Provider.
You can add multiple attributes by click on "+" button.

custom attribute - SSO between two WordPress sites

Click on the Save button to save your configurations.

Role Mapping (optional) :

Go to the Attribute/Role mapping tab and navigate to Role Mapping section.
User groups are the collection of users having similar access roles and capabilities.
To map the Roles in WordPress as user group, please enable this option.
You can specify the attribute under which the groups will be passed to the Service Provider.

role mapping - SSO between two WordPress sites

Click on the Save button to save your configurations.
Go to the IDP Metadata tab. Here you can find information for configuring the Service Provider.
You can also download the metadata XML file, by clicking on the download link.

You have successfully configured WordPress site A as IDP.

Note: If you intend to set up Attribute Mapping, Role Mapping, and other configurations on the Identity Provider's end, you can find detailed instructions in the provided setup guide.

Step 2: Configure WordPress as SP (Service Provider)

Free
Standard
Premium

In the miniOrange SAML SSO plugin for WordPress, go to the IDP Configuration tab. There are two ways to configure the SSO Plugin for WordPress:

A. By uploading IDP metadata:

Click on the Upload IDP Metadata tab.
Enter the Identity Provider Name.
Choose one of the following options:
- Format: Upload Metadata file then click the Upload button.
- Format: Enter metadata URL then click the Fetch Metadata button.

SAML SSO for WordPress | Login-upload metadata

B. Manual Configuration:

Enter the required Identity Provider details, including Identity Provider Name, IDP Entity ID or Issuer, SAML Login URL, and X.509 Certificate, as provided by your Identity Provider.
Click Save to save the configuration.
Click the Test Configuration button to verify the configuration and check the attributes and values received from the Identity Provider.

SAML SSO for WordPress | Test configuration

Step 3: Attribute Mapping

Note: To configure attribute mapping for multiple Identity Providers, follow the Attribute Mapping with Multiple IdPs guide. This feature is available in the Enterprise plan and above.

In the free plugin, NameID is used for the Username and Email attributes of the WordPress user.
When a user performs SSO, the NameID value sent by the Identity Provider is mapped to the Username and Email fields of the WordPress user.

SAML SSO for WordPress | Login-attribute mapping

To configure WordPress as your Service Provider (SP) in the SAML SSO plugin, navigate to the IDP Configuration tab. You can configure the plugin using either of the following methods:

A. By uploading IDP metadata:

Click on the Upload IDP metadata button.
Enter the Identity Provider Name.
Choose one of the following options:
- Upload the metadata file then click the Upload button.
- Enter the metadata URL then click the Fetch Metadata button.

SAML SSO for WordPress | Upload IDP metadata

SAML SSO for WordPress | Enter Identity Provider Name

B. Manual Configuration:

Enter the Identity Provider details (Identity Provider Name, IDP Entity ID or Issuer, SAML Login URL, and X.509 Certificate) provided by your IdP, then click Save button.
Click Test Configuration to verify the attributes and values received from the Identity Provider (IdP).

Step 3: Attribute Mapping

NOTE: If you click on the Test Configuration button in the IDP Configuration tab and authenticate with your IDP, you can see a list of attributes sent by the IDP in the Attribute/Role mapping tab. This information can be used to provide the above mapping.

Note: To configure attribute mapping for multiple identity providers, follow the setup guide here. This feature is available in the Enterprise plan.

The Attribute Mapping feature lets you map user attributes received from the Identity Provider (IdP) during SSO to the corresponding user attributes in WordPress.

In the Standard version of the SAML SSO plugin for WordPress, navigate to the Attribute/Role Mapping tab.
Under the Attribute Mapping sub tab, configure the required fields in the Map Basic Attributes section.

In the SAML SSO plugin for WordPress, go to the IDP Configuration tab of the plugin. There are two ways to configure the SSO Plugin for WordPress:

A. By uploading IDP metadata:

Click on Upload IDP metadata button.
Enter the Identity Provider Name.
Choose one of the following options:
- Upload a metadata file then click the Upload button.
- Enter the metadata URL then click the Fetch Metadata button.
In the Premium plugin, you can enable auto-sync for the metadata URL which will auto-update the plugin configuration as per the IDP metadata after a set interval of time.

B. Manual Configuration:

Provide the required settings (i.e. Identity Provider Name, IDP Entity ID or Issuer, SAML Login URL, X.509 Certificate) as provided by your Identity Provider and click on the Save button.
Click on Test Configuration to check the attributes and values sent by IDP.

Test configuration - SAML SSO for WordPress

Note: In the Premium Plugin, you can configure the SAML Logout URL to achieve Single Logout on your WordPress site.

Step 3: Attribute Mapping

Note: To configure attribute mapping for multiple identity providers, follow the setup guide here. This feature is available in the Enterprise plan.

The Attribute Mapping feature allows you to map the user attributes sent by the IDP during SSO to the user attributes at WordPress.

In the SAML Plugin for WordPress, navigate to the Attribute/Role Mapping tab.
Under the Attribute Mapping sub tab, configure the required fields in the Map Basic Attributes section.

SAML SSO for WordPress | Map basic attributes

Custom Attribute Mapping: This feature allows you to map any attribute sent by the IDP to the usermeta table of WordPress. To create and map custom attributes, open the Map Custom Attributes section under the Attribute Mapping sub tab, enter the WordPress meta key name and select the corresponding attribute received from the IdP (use Test Configuration on the IDP Configuration tab to view available attributes), then click Save.

SAML SSO for WordPress | Custom attribute mapping

Step 4: Role Mapping

Note: To configure role mapping for multiple Identity Providers, follow the Role Mapping with Multiple IdPs guide. This feature is available in the Enterprise plan and above.

Navigate to the Attribute/Role Mapping tab and locate the Role Mapping section.
Select the required role from the Default Role dropdown and click Update to save your changes.

Note: The selected Default Role applies only to new users when they perform SSO. Existing WordPress users retain their current roles.

SAML SSO for WordPress | Login-role mapping

Step 4: Role Mapping

Note: To configure role mapping for multiple identity providers, follow the setup guide here. This feature is available in the Enterprise plan.

In the standard plugin, you can choose a default role which will be assigned to all the non-admin users when they perform SSO.

To configure Role Mapping, go to the Attribute/Role Mapping tab.
Navigate to the Role Mapping sub tab and scroll down to the Select Default User Role section.
Based on your requirements, enable Create New User with Role or Update Existing User with Role, and select the appropriate default role from the dropdown.
Click Save to apply the role mapping settings.

Step 4: Role Mapping

This feature allows you to assign and manage roles of the users when they perform SSO. Along with the default WordPress roles, this is compatible with any custom roles as well.

Note: To configure role mapping for multiple identity providers, follow the setup guide here. This feature is available in the Enterprise plan.

Navigate to the Role Mapping sub-tab under the Attribute/Role Mapping tab.
From the IDP Group/Role Attribute dropdown, select the attribute that contains the user’s group or role information (for example, NameID).
In each role field, enter the matching IDP group values. Separate multiple values with a semicolon (;).

Example: If you want a user whose Group/Role attribute value is WP-Editors to be assigned the Editor role in WordPress, enter WP-Editors in the Editor field.

Under Select Action if Role Mapping Fails, you can choose what happens when a user’s group or role value is not mapped to any role:
Create New User with Role: You can select a default role for new users (for example, Subscriber). If this toggle is disabled, new users will not be created.
Update Existing User with Role: You can select a default role to be assigned as the role of existing users.

SAML SSO for WordPress | Select action if role mapping fails

Apply all role mapping settings to WP admin users: You can apply all the above role mapping settings to the WordPress admin users.
Then, click on the Save.

Step 5: SSO Settings

Navigate to the Redirection & SSO Links tab of the plugin to configure the SSO Settings.

1. Use a Single Sign-On Button

Enable the Add a Single Sign-On button on the WordPress Login Page toggle from the Option 1: Use a Single Sign-On button section to add a Single Sign-On button onto the WordPress login page.

SAML SSO for WordPress | Login-SSO button

2. SSO Links

In the free plugin, you can enable SP-initiated SSO by adding an SSO link to a button or hyperlink on your WordPress site.

Scroll down to the Option 2: SSO Links section.
- Initiate SSO with the default redirect behavior: Copy the first SSO link provided in the plugin and add it to a button or hyperlink on your website. When users click the link, they are redirected to the Identity Provider (IdP) for authentication and then returned to your WordPress site.
  https://your-wordpress-site.com/?option=saml_user_login
- Redirect users to a specific page after authentication: Copy the second SSO link provided in the plugin and add it to a button or hyperlink. This link includes the redirect_to parameter, which allows you to specify the page users should visit after successful authentication.
  https://your-wordpress-site.com/?option=saml_user_login&redirect_to=page_url

SAML SSO for WordPress | Login-SSO links

Note: Replace your-wordpress-site.com with your WordPress site URL and page_url with the URL of the page where users should be redirected after successful authentication.

Step 5: SSO Settings

In the Standard version of the plugin, you can configure SP-initiated SSO using the available options under SSO Redirection Settings. To access these options, navigate to the Redirection & SSO Links tab.

SAML SSO for WordPress | SSO redirection settings

1. Auto-Redirection from Site

If this option is enabled, any unauthenticated user trying to access your site will be redirected to the IDP login page. After successful authentication, they will be redirected back to the same page on your site that they were trying to access.

Navigate to the Redirection & SSO Links tab and go to SSO Redirection Settings.
Under Auto Redirection from Site, configure the following options:
- Enable Auto Redirect from Site: if you want unauthenticated users to be automatically redirected to your configured IdP for login whenever they try to access your site.
- Enable access to RSS Feeds: if you want to allow users to access your site's RSS feeds.
- Force authentication with your IdP on each login attempt: if you want users to authenticate with your configured IDP on each login attempt.

SAML SSO for WordPress | Auto redirection from site

2. Auto-Redirection from WordPress Login Page

If this option is enabled, any unauthenticated user trying to access the default WordPress login page will be redirected to the IDP login page for authentication. After successful authentication, they will be redirected back to the WordPress site.

Navigate to the Redirection & SSO Links tab and go to SSO Redirection Settings.
Under Auto Redirection from WordPress Login Page section, enable the Redirect to Default IdP from WordPress Login Page option.

SAML SSO for WordPress | Auto redirection from WordPress login

Note: Please enable Backdoor Login and note down the backdoor URL. This will allow you to access the WordPress login page in case you get locked out due to IDP-related issues.

3. Domain Mapping

Domain Mapping allows you to redirect users to the appropriate Identity Provider (IdP) based on their email domain, simplifying SSO login for organizations with multiple domains.

Note: This feature is not available in the current version of the plugin. Please upgrade to the Enterprise or higher version of the plugin to use this feature.

4. Redirection after SSO Settings

These settings allow you to configure where users are redirected after successful SSO login or logout.

Navigate to the Redirection & SSO Links tab and go to SSO Redirection Settings.
Under Login Relay State URL, enter a valid URL if you want users to be redirected to a specific page after successful SSO. If left blank, users will be redirected to the same page from which SSO was initiated.
Click Save to apply the settings.

SAML SSO for WordPress | Redirection after SSO settings

Note: The Allow 3rd Party URLs in Relay States feature is not available in the current version of the plugin. Please upgrade to the PREMIUM or higher version to use this feature.

SSO Links and Button

The SSO links allow users to initiate Single Sign-On (SSO) directly from your website. You can place these links on relevant pages or buttons so users can easily sign in through the configured Identity Provider (IdP). You can also specify a redirect URL to send users to a particular page after successful authentication.

1. SSO Links

Under the Redirection & SSO Links tab, navigate to the SSO Links and Button tab.
In the SSO Links section, copy the SSO URL for the configured IDP.
You can add this link to your site to allow users to initiate SSO.

Note: If you want to redirect users to a specific page after authentication, use the provided SSO link format with the redirect URL parameter.

2. Add SSO Login Button on WordPress Login Page

In the SSO Links and Button tab, scroll down to the Add SSO Login Button on WP Login Page section.
Enable Add a Single Sign on button on the WordPress login page to display the SSO login button on the default WordPress login page.

Note: The Hide/Disable WordPress Default Login Form and Customize Login Button features are not available in the current version of the plugin. Please upgrade to the Enterprise or higher version to use these features.

SAML SSO for WordPress | Add SSO login button on WordPress login page

3. Shortcode & Widget Settings

You can add the SSO login button to your site using a widget or shortcode.

Under the Redirection & SSO Links tab, go to the SSO Links and Button sub tab.
In the Shortcode & Widget Settings section, you can configure following settings:

a. Add using a SSO widget:

To add the SSO login button using a widget, go to Appearance > Widgets from the WordPress panel on the left side.
Add the miniOrange SAML Login widget to your preferred location.

b. Add using a shortcode: To add the SSO login button using a shortcode, copy the IDP-specific shortcode provided in this section and add it to your required page.

You can customize the login text, greeting text, and logout text in the Customize Shortcode & Widget Text section.
Click Save to apply the changes.

SAML SSO for WordPress | Shortcode and widget settings

Step 5: Redirection & SSO Settings

The Redirection & SSO Links tab allows you to configure user redirection before and after SSO, manage SSO login/logout links and buttons, and set up SP-initiated SSO using the available SSO Redirection Settings in the Premium version of the plugin.

1. SSO Redirection Settings

a. Auto-Redirection from site: If this option is enabled, any unauthenticated user trying to access your site will be redirected to the selected login page. After successful authentication, they will be redirected back to the same page on your site that they were trying to access.

Go to the Redirection & SSO Links tab of the plugin and navigate to SSO Redirection Settings.
Enable Auto Redirect from Site: Select one of the following options:
- Redirect to default IDP if user not logged in: Unauthenticated users will be redirected to your configured IDP login page.
- Redirect to WordPress login page if user not logged in: Unauthenticated users will be redirected to the WordPress login page.
- Redirect to public page if user not logged in: Unauthenticated users will be redirected to a public page of your site. Enter the page URL in the Public Page URL field and click Save.

Note: This feature is available only in the Enterprise and higher plans. Please upgrade your plugin to access and use this feature.

2. Enable access to RSS Feeds: Enabling this feature allows users to access the RSS feed URL of your WordPress site even when the Auto-Redirect feature is enabled.

3. Force authentication with your IdP on each login attempt: Enabling this option forces users to enter their IdP credentials every time they attempt to log in, even if they are already logged in to the IdP. Depending on your IdP, additional configuration may be required to enforce this behavior.

b. Auto-Redirection from WordPress Login Page: If this option is enabled, users trying to access the WordPress login page will be redirected to your configured IDP login page for authentication.

Redirect to Default IdP from WordPress Login Page: Enable this option to redirect users visiting any of the following URLs to the Default IdP for authentication.

Note: Enabling Backdoor Login creates a security risk. Anyone who knows the Backdoor URL can log in to your website using WordPress credentials. Please do not share this URL.

Enable Backdoor Login: Enabling this option allows you to log in to your WordPress site using your WordPress credentials if you get locked out of your IdP. This provides an alternative login method to regain access to your website.

c. Domain Mapping

Note: This feature is available only in the Enterprise or higher plan. Please upgrade your plugin to access and use this feature.

Domain Mapping allows you to redirect users to the appropriate Identity Provider (IdP) based on their email domain, simplifying SSO login for organizations with multiple domains.

d. Redirection after SSO Settings

Under Redirection after SSO Settings, you can configure where users are redirected after login and logout through SSO using the following options:

Allow 3rd Party URLs in Relay States: if you want to use URLs from outside your site as the redirection URLs.
Login Relay State URL: enter the URL where users should be redirected after SSO. If left blank, users will be redirected to the same page from where the SSO was initiated.
Logout Relay State URL: enter the URL where SSO users should be redirected after logout. If left blank, users will be redirected to the same page from where the logout was initiated.
Click on the Save button.

2. SSO Links and Button

a. SSO Links:

Under SSO Links, copy the SSO URL.
Add the copied link to your HTML pages where you want users to initiate SSO.
If you want to redirect users to a specific page after authentication, copy the second SSO link.

Note: Replace page_url in the copied link with the URL of the page where users should be redirected after authentication.

b. Add SSO Login Button on WP Login Page: This option allows you to add a SSO login button on the WordPress login page and customize its appearance.

Under Add SSO Login Button on WP Login Page, enable the Add a Single Sign on button on the WordPress login page toggle.

Note: The Hide/Disable WordPress Default Login Form toggle hides the default WordPress login form on the login page. This feature is available in the Enterprise or higher plans.
Use this button as ShortCode: if you want to use the SSO login button as a shortcode.
Use this button as Widget: if you want to use the SSO login button as a widget.
Under Customize Login Button, you can configure the following settings:
- Shape: Under this you can select the button shapes like; Round, Rounded Edges, Square, or Long Button with Text.
- Theme: you can set the Button Color, Button Text, Font Color, and Font Size.
- Size of Icons: you can set the Width, Height, and Curve of the button by entering a value or use the - and + buttons to adjust it.
Under Position of Login Button on WordPress Login Page, you can select Above WP Login Form or Below WP Login Form to position the SSO button in respect to WordPress login button.
You can preview the button under the Preview section to see how it will appear on the login page.
Click on the Save to apply the settings.

Note: To restore the default button settings, click Reset Login Button Settings.

c. Shortcode & Widget Settings: This option allows you to add the SSO login button anywhere on your site using either Widget or Shortcode.

Add the SSO Widget:

Go to Appearance > Widgets from the WordPress panel on the left side.
Select the miniOrange SAML Login widget, drag and drop it to your preferred location, and save.
This will add the login links of your configured IDP.

Note: Your WordPress theme must support widgets to use this option. If it does not, the plugin will display a message asking you to switch to a theme that supports widgets or contact your theme developer.

Add the SSO Button using a Shortcode:

Use the IDP Specific shortcode shown in this section to display a login button for a specific IdP as per your page type.

Customize Shortcode & Widget Text:

In the Login text field, enter the text for the login button (for example, Login with SSO).
In the Greeting text field, enter the greeting shown to logged-in users (for example, Hello,), and select the user detail to display next to it from the dropdown (for example, Username).
In the Logout text field, enter the text for the logout link (for example, Logout).
Click on Save to apply the settings.

FAQs

More FAQs ➔

How to Use WordPress as a SAML IDP for External Applications

WordPress can be used as a SAML Identity Provider (IdP) for external applications by installing the SAML IDP (Identity Provider) – Login with Website Users plugin and configuring it by sharing metadata like SSO URL, Entity ID, and certificate with the external Service Provider (SP). You can then map user attributes and roles to allow SSO login from WordPress into apps like AWS, Zoom, Tableau, or any SAML-compatible platform.

Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again

Contents

SSO between two WordPress sites | Single Sign On for Multiple WordPress sites

Overview