外掛標籤
開發者團隊
② 後台搜尋「Signclave – SSO for SAML and LDAP」→ 直接安裝（推薦）
原文外掛簡介
WordPress SAML Service Provider with optional LDAP fallback.
Source: https://github.com/Considbrs-Webdev/signclave-sso
Features:
– SAML SSO redirect on wp-login.php
– Signed assertion validation (XML signature + digest)
– Replay protection, signed RelayState, redirect allowlisting
– Optional LDAP authentication fallback
– Optional group-to-role mapping
– Security audit logging
Security
This plugin follows WordPress and OWASP-oriented practices:
SAML signatures verified only against the configured IdP X.509 certificate (pinned).
Strict SAML validation (audience, destination, issuer, InResponseTo) enabled by default.
Emergency local login requires a secret key (?password=1&signclave_sso_key=...), not a public flag.
Proxy HTTPS headers are ignored unless explicitly enabled.
Account linking by email is off by default.
LDAP bind passwords encrypted at rest (AES-256-GCM).
When LDAP is enabled and fully configured, SAML must verify the directory before provisioning a new WordPress user. Existing WordPress accounts can still sign in via SAML if LDAP is down.
With LDAP disabled or incomplete, SAML runs alone (JIT from IdP attributes; local accounts match by username).
No raw SQL; admin actions require manage_options and nonces.
Audit log redacts secrets; log directory denied via .htaccess.
