內容簡介
BePlus Login Sync 讓可信的 WordPress 網站之間無需使用 Multisite 和共享密碼即可進行用戶身份驗證。此外掛適合管理多個獨立 WordPress 安裝的機構、網站擁有者和管理員，提供清晰的跨站登錄信任模型。
【主要功能】
• 提供者和消費者模式
• 提供者發現與信任連接儲存
• 明確的角色映射
• 支援單一登錄（SSO）
• 日誌記錄與診斷資訊
• 可選的登出同步功能
外掛標籤
開發者團隊
原文外掛簡介
BePlus Login Sync helps trusted WordPress sites authenticate users between each other without Multisite and without sharing passwords.
It is designed for agencies, site owners, and administrators who manage multiple independent WordPress installs and want a clear trust model for cross-site login.
This plugin is a good fit when you want to:
let users sign in from one trusted WordPress site to another
keep each site independent instead of using Multisite
map provider roles to local roles explicitly
control which consumer sites are trusted
review redacted diagnostics when something fails
This plugin is not a good fit when you need:
password synchronization
raw capability mirroring
third-party app OAuth support
cloud-hosted identity brokering
WordPress Multisite as the main architecture
Key features in version 1.0.0:
provider and consumer mode, or both on the same site
provider discovery with metadata, public key, and JWKS endpoints
RS256 token issuance and offline signature validation
consumer connection discovery and trusted provider storage
explicit role mapping per trusted provider connection
profile synchronization for approved core identity fields only
provider-side Allowed Sites management with enable, disable, edit, delete, and icon support
admin toolbar launchers for enabled trusted provider connections
optional logout synchronization for SSO-created sessions
redacted diagnostics logging for connection, token, login, logout, and trust events
How it works:
Configure one site as a provider.
Configure another site as a consumer.
Discover the provider from the consumer and save the trusted connection.
Start SSO, validate the signed token, create or update the local user, and apply the mapped local role.
Security highlights:
no password synchronization
no shared-secret JWT signing
no raw capability synchronization
no automatic trust for arbitrary sites
private keys remain local to the provider
redirects are validated before cross-site navigation
diagnostics are redacted to avoid storing sensitive secrets
This release completes the initial production-readiness roadmap for BePlus Login Sync and is intended for staged rollout on trusted WordPress environments.
Troubleshooting
Provider discovery fails
Check that the provider site is reachable from the consumer, permalinks are enabled, and the provider discovery endpoints are available. Also confirm security plugins, page cache, or server rules are not blocking REST requests.
SSO returns an invalid state or token error
Start a fresh SSO flow from the consumer and retry. These errors usually indicate an expired login attempt, a tampered callback, or a mismatch between the trusted provider configuration and the signed response.
The provider blocks the login request
Review Allowed Sites on the provider and confirm the consumer site is trusted and enabled. If the consumer is new, a provider administrator may need to approve the first login flow.
Logout synchronization does not happen
Confirm logout synchronization is enabled, the session was created through Login Sync, and the provider connection has a valid trusted logout endpoint.
A role looks wrong after login
Review the consumer Role Mapping screen and test again. The plugin does not mirror provider capabilities automatically, so unmapped roles will follow the fallback behavior.
