內容簡介
IvoryGate 外掛允許使用者透過 Microsoft IIS Windows 認證登入現有的 WordPress 帳戶，適用於受控的 Windows 和 IIS 環境，如內部網路。此外掛不會儲存 Windows 密碼，並提供安全的單一登入（SSO）功能。
【主要功能】
• 精確的 Windows 身份與 WordPress 使用者 ID 對應
• 不自動創建使用者或更改角色
• 需要 HTTPS 以啟用自動 SSO
• 安全的 WordPress 認證 Cookies
• 不信任來自客戶端的身份值
外掛標籤
開發者團隊
原文外掛簡介
IvoryGate signs users in to existing WordPress accounts using an identity authenticated by Microsoft IIS Windows Authentication.
The plugin is designed for controlled Windows and IIS environments such as intranets. It does not implement Kerberos or NTLM itself and never receives or stores a Windows password. IIS performs Windows Authentication and provides the trusted server identity.
Key properties:
Exact, case-sensitive mapping from a Windows identity to an existing WordPress user ID.
No automatic user creation, role changes, or password changes.
HTTPS is required for automatic SSO.
Secure WordPress authentication cookies are created with the official WordPress API.
When SSO is enabled, WordPress password login and application passwords are disabled.
Unknown, missing, duplicated, or invalid mappings fail closed.
Optional logging contains fixed event codes only and does not include identities, cookies, passwords, or request data.
Existing WordPress sessions are not switched to another account.
Important requirements
IvoryGate requires:
Microsoft IIS with Windows Authentication using Negotiate, NTLM, or Kerberos.
A server configuration in which IIS securely sets REMOTE_USER, AUTH_USER, and AUTH_TYPE.
HTTPS for the request, WordPress Address, and Site Address.
Existing WordPress user accounts to map to.
A single-site WordPress installation. WordPress Multisite is not supported.
IIS may reject a request with HTTP 401 before WordPress or IvoryGate runs. In that case, the browser may show its own Windows credentials dialog. A WordPress plugin cannot replace that dialog or reliably detect private or incognito browsing mode.
IvoryGate does not trust identity values from HTTP_REMOTE_USER, X-Forwarded-User, Authorization, cookies, or other client-controlled headers.
Lockout protection
Before enabling SSO, retain administrative access to the server files.
To restore native WordPress login during recovery, add the following before WordPress loads:
define( ‘IVORYGATE_DISABLE_SSO’, true );
You can also disable the plugin by renaming its directory from the server file system. The plugin intentionally retains its settings when deactivated or uninstalled.
Privacy
IvoryGate does not transmit data to external services. Configuration is stored in the local WordPress options table. It contains explicit Windows identity strings and WordPress user IDs entered by an administrator.
Optional diagnostic logging writes only fixed event codes to the operating system log through PHP syslog. It does not log identities, passwords, cookies, tokens, exception messages, or request data.
