SAML SSO Paid Memberships Pro Membership Level Based Content Access Control for WordPress

Imagine having to create new accounts for each and every site/application you visit and having to maintain the credentials for all of those. This is where Single Sign-On comes into play. SSO allows you to use a single set of login credentials (username and password) to log into several connected applications/websites, without having to explicitly log into every one of them. This especially comes in handy when you want to use different functionalities from different services, and offer various levels of these services to a variety of customers based on their membership levels.

Here, we will explore the work how SAML SSO for WordPress plugin and miniOrange Paid Memberships Pro Integrator comes into play with a site and Paid Memberships Pro plugin for WordPress (for memberships) to provide/restrict access to users on owner’s membership site based on the membership level assigned to them during SSO for WordPress on the basis of their group in IDP.

Scenario

You have a WordPress membership site with content accessible only to its members. You want to not only provide Single Sign-On for your site but also a simpler way for your members to access your members-only content based on the user membership levels assigned to them during SSO on the basis of their IDP group. You also want to restrict access to the site content from unauthorized users.

Requirements

1. Single Sign-On for a WordPress site: Single Sign-On into membership site for user authentication for WordPress and accessing content. Once the user SSOs into the site, he/she will be able to access content based on their membership level.
2. Group Mapping for Membership Assignment: Users will be assigned membership levels on the basis of the groups assigned to them in their IDP.

Components involved

1. SAML SSO for WordPress Plugin - The SAML SP plugin for WordPress is used to authenticate users into the WordPress membership site. It provides features such as Membership Mapping, Support for Multiple IDPs configuration, Single Sign-On for Paid Memberships Pro users and so on.



SAML Single Sign On – SAML SSO Login
By miniOrange
(142)
Single Sign On SSO for WordPress login with Azure, Azure B2C, Okta, ADFS, Keycloak, Salesforce, Ping, Onelogin, Gsuite, Shibboleth & many SAML IDPs [24/7 SUPPORT]
 Tested with 5.9.1
Get this plugin


2. miniOrange Paid Memberships Pro Integrator - Paid Memberships Pro Integrator is used to assign membership levels to the users based on their IDP groups.

Solution

The SAML SSO for WordPress Plugin enables secure authentication between WordPress and your IDP. It also provides Attribute and Role Mapping that allows mapping of user profiles from the Identity Provider (IDP) to WordPress (SP) and also provides the option to assign roles based on the user's group in the IDP.

When the user tries to access the WordPress site, the plugin generates a SAML request which is sent to the Identity Provider for which the user is automatically redirected to the IDP login page. Once the user logins into their IDP, a SAML response is generated by the IDP, authenticating the user into the WordPress site (SP) i.e. the user is redirected back to the WordPress site and logged into WordPress.

The Identity Provider contains pre-defined groups for each membership level in the Paid Memberships Pro site. During the process of authentication, the IDP sends the SAML response to WordPress which contains the attributes (including group information) of the user.

The miniOrange Paid Memberships Pro Integrator for WordPress plugin then reads the group information from the SAML Response and allows you to map your users to particular Paid Memberships Pro membership levels when they perform the SSO.

Configuration with Multiple Identity Providers

Our SAML SSO for Multiple IDP plugin for WordPress also allows configuration with multiple IDPs, which means you can configure multiple IDPs for SSO as well as assign Paid Membership Levels based on the user's IDP or the groups in their respective IDPs.

For a better understanding of this case, let’s take an example of a membership assignment for users from two different Identity Providers - Azure and Okta. Let’s say the users who SSO from Azure should be assigned the membership level 1, whereas the SSO users from Okta should be assigned the standard membership level 2.

This can be achieved by configuring both Azure and Okta as the IDPs in the WP SAML SSO Multiple IDP Plugin. Once the IDPs are set up for SSO, the default membership levels can be configured for the users of both the IDPs separately using the Paid Memberships Pro Integrator for WordPress. i.e. in the integrator, you can specify the default membership level for Okta users and then a default membership level for Azure users.

1. User tries to access the WordPress Paid MembershipPro site.
2. User is redirected to the Identity Provider for authentication.
3. User enters credentials on the IDP login page.
4. After successful authentication, the user is redirected back to the WordPress site and is logged into the site.
5. Users would be provisioned access to only the information limited to their subscription.

Conclusion

Our solution with the SAML SSO for WordPress plugin ensures a seamless process to achieve synchronization with your Identity Provider to manage user membership levels, along with the additional advantage of convenient access for your users to your WordPress site.

Our SAML SSO plugin for WordPress supports further integrations with a number of add-ons to extend the functionality of your site.

If you have any custom requirements, please contact us at samlsupport@xecurify.com and we will help you achieve your use case.

Additional Resources

• Paid Memberships Pro Integration
• Membership Plugins for WordPress
• What is Single Sign-On (SSO)?
• What is SAML?
• Frequently Asked Questions (FAQs)