/ Plugin Category

/ User Management & Authentication

/ User Registration & Login

/ Shibboleth

Shibboleth

By michaelryanmcneill

User Management & Authentication / User Registration & Login

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Shibboleth Review - In-Depth Analysis

Integrate WordPress with Shibboleth for user authentication and account management.

Performance Overview

WPS Score

6.72/10

User Rating

4.3/5 (based on 7+ reviews)

Active Installations

3,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

6.1 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin is designed to support integrating your WordPress site into your existing identity management infrastructure using a Shibboleth Service Provider.

WordPress can be configured so that all standard login requests will be sent to your configured Shibboleth Identity Provider or Discovery Service. Upon successful authentication, a new WordPress account will be automatically provisioned for the user if one does not already exist. User attributes such as username, first name, last name, display name, nickname, and email address can be synchronized with your enterprise's system of record each time the user logs into WordPress.

Finally, the user's role within WordPress can be automatically set and continually updated based on any attribute Shibboleth provides. For example, you may decide to give users with an eduPersonAffiliation value of faculty the WordPress role of editor, while the eduPersonAffiliation value of student maps to the WordPress role contributor. Or you may choose to limit access to WordPress altogether using a special eduPersonEntitlement value.

Comparing to Alternatives

Shibboleth is a specialized plugin for SAML-based single sign-on, with several well-known alternatives available.

Top alternatives

Strengths

Simple to set up with clear functionality
Supports auto-login and managed user attributes
Works well in multisite WordPress setups
Has a long history of stable use in higher education
Responsive plugin authorship and support

Weaknesses

Known security vulnerabilities in older versions
No pro version with additional features
Limited user base compared to some alternatives
Requires some technical knowledge for setup

User Sentiment Analysis

With a strong majority of 5-star ratings and positive feedback, users appreciate the plugin's reliability and ease of use, though some technical knowledge is needed.

Positive highlights

"Works as intended" with simple setup and needed features - nilssiegle
"Been using this for years, never had any problems" - rslater_illinois
"This plugin just works" and good author interaction - jakeparis
"Simple and works in multisite setups" - diders

Common complaints

Weaknesses

Security vulnerabilities in older versions require attention
Setup can be challenging for users unfamiliar with Shibboleth
No advanced features beyond the free offering

Who Should Use This?

Best for

Organizations needing a reliable, open-source SAML SSO solution, especially in educational or multisite environments, with some technical expertise available for setup.

Not ideal for

Users seeking a plugin with extensive premium features or those uncomfortable managing security updates and technical configurations.

Pricing & Value

Free version includes

The free version includes core SAML SSO functionality, auto-login, user attribute management, and multisite support.

Final Verdict

Shibboleth is a dependable and well-regarded plugin for implementing SAML single sign-on in WordPress, praised for its simplicity and effectiveness by a loyal user base. Its free offering covers essential features needed by many organizations, particularly in education and multisite contexts.

However, users must be mindful of past security vulnerabilities and the lack of a premium version with additional features. Those comfortable with technical setup and maintenance will find it a solid choice, while others might consider alternatives with more support or advanced options.

Other Notable Features

Here are a few other notable features of this free Shibboleth plugin.

Authentication

SAML

Shibboleth

Screenshots

FAQ

From the Shibboleth Consortium:

Shibboleth is a standards based, open source software package for web single sign-on across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

Yes, the plugin allows for all settings to be controlled via constants in wp-config.php. If set, the constant will override the value that exists in the WordPress options table. The available constants are detailed (with their available options) below:

SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD
- Format: string
- Available options: 'standard' for the default “Environment Variables” option, 'redirect' for the “Redirected Environment Variables” option, and 'http' for the “HTTP Headers” option.
- Example: define('SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD', 'standard');
SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD_FALLBACK
- Format: boolean
- Available options: true to fallback to the standard “Environment Variables” options when the selected attribute access method does not return results or false to not fallback.
- Example: define('SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD_FALLBACK', true);
SHIBBOLETH_LOGIN_URL
- Format: string
- Available Options: none
- Example: define('SHIBBOLETH_LOGIN_URL', 'https://example.com/Shibboleth.sso/Login');
SHIBBOLETH_LOGOUT_URL
- Format: string
- Available Options: none
- Example: define('SHIBBOLETH_LOGOUT_URL', 'https://example.com/Shibboleth.sso/Logout');
SHIBBOLETH_PASSWORD_CHANGE_URL
- Format: string
- Available options: none
- Example: define('SHIBBOLETH_PASSWORD_CHANGE_URL', 'https://sso.example.com/account/update');
SHIBBOLETH_PASSWORD_RESET_URL
- Format: string
- Available options: none
- Example: define('SHIBBOLETH_PASSWORD_RESET_URL', 'https://sso.example.com/account/reset');
SHIBBOLETH_SPOOF_KEY
- Format: string
- Available options: none
- Example: define('SHIBBOLETH_SPOOF_KEY', 'abcdefghijklmnopqrstuvwxyz');
SHIBBOLETH_DEFAULT_TO_SHIB_LOGIN
- Format: boolean
- Available options: true to automatically default to Shibboleth login or false to not default to Shibboleth login.
- Example: define('SHIBBOLETH_DEFAULT_TO_SHIB_LOGIN', true);
SHIBBOLETH_AUTO_LOGIN
- Format: boolean
- Available options: true to automatically login users with an existing Shibboleth session or false to not check for an existing Shibboleth session.
- Example: define('SHIBBOLETH_AUTO_LOGIN', true);
SHIBBOLETH_BUTTON_TEXT
- Format: string
- Available options: none
- Example: define('SHIBBOLETH_BUTTON_TEXT', 'Login with Shibboleth');
SHIBBOLETH_DISABLE_LOCAL_AUTH
- Format: boolean
- Available options: true to prevent users logging in using WordPress local authentication or false allow WordPress local authentication AND Shibboleth authentication.
- Example: define('SHIBBOLETH_DISABLE_LOCAL_AUTH', true);
SHIBBOLETH_HEADERS
- Format: array (>= PHP 5.6)
- Available options: none
- PHP 5.6 (and above) example: const SHIBBOLETH_HEADERS = array( 'username' => array( 'name' => 'eppn' ), 'first_name' => array( 'name' => 'givenName', 'managed' => 'on' ), 'last_name' => array( 'name' => 'sn', 'managed' => 'on' ), 'nickname' => array( 'name' => 'eppn', 'managed' => 'off' ), 'display_name' => array( 'name' => 'displayName', 'managed' => 'off' ), 'email' => array( 'name' => 'mail', 'managed' => 'on' ) );
- PHP 7.0 (and above) example: define('SHIBBOLETH_HEADERS', array( 'username' => array( 'name' => 'eppn' ), 'first_name' => array( 'name' => 'givenName', 'managed' => 'on' ), 'last_name' => array( 'name' => 'sn', 'managed' => 'on' ), 'nickname' => array( 'name' => 'eppn', 'managed' => 'off' ), 'display_name' => array( 'name' => 'displayName', 'managed' => 'off' ), 'email' => array( 'name' => 'mail', 'managed' => 'on' ) ) );
SHIBBOLETH_CREATE_ACCOUNTS
- Format: boolean
- Available options: true to automatically create new users if they do not exist in the WordPress database or false to only allow existing users to authenticate.
- Example: define('SHIBBOLETH_CREATE_ACCOUNTS', true);
SHIBBOLETH_AUTO_COMBINE_ACCOUNTS
- Format: string
- Available options: 'disallow' for the default “Prevent Automatic Account Merging” option, 'allow' for the “Allow Automatic Account Merging” option, and 'bypass' for the “Allow Automatic Account Merging (Bypass Username Management)” option.
- Example: define('SHIBBOLETH_AUTO_COMBINE_ACCOUNTS', 'disallow');
SHIBBOLETH_MANUALLY_COMBINE_ACCOUNTS
- Format: string
- Available options: 'disallow' for the default “Prevent Manual Account Merging” option, 'allow' for the “Allow Manual Account Merging” option, and 'bypass' for the “Allow Manual Account Merging (Bypass Username Management)” option.
- Example: define('SHIBBOLETH_MANUALLY_COMBINE_ACCOUNTS', 'disallow');
SHIBBOLETH_ROLES
- Format: array (>= PHP 5.6)
- Available options: none
- PHP 5.6 (and above) example: const SHIBBOLETH_ROLES = array( 'administrator' => array( 'header' => 'entitlement', 'value' => 'urn:mace:example.edu:entitlement:wordpress:admin' ), 'author' => array( 'header' => 'affiliation', 'value' => 'faculty' ) );
- PHP 7.0 (and above) example: define('SHIBBOLETH_ROLES', array( 'administrator' => array( 'header' => 'entitlement', 'value' => 'urn:mace:example.edu:entitlement:wordpress:admin' ), 'author' => array( 'header' => 'affiliation', 'value' => 'faculty' ) ) );
SHIBBOLETH_DEFAULT_ROLE
- Format: string
- Available options: All available WordPress roles. The defaults are 'administrator', 'subscriber', 'author', 'editor', and 'contributor'. Leave this constant empty '' to make the default no allowed access.
- Example: define('SHIBBOLETH_DEFAULT_ROLE', 'subscriber');
SHIBBOLETH_UPDATE_ROLES
- Format: boolean
- Available options: true to automatically use Shibboleth data to update user role mappings each time the user logs in or false to only update role mappings when a user is initally created.
- Example: define('SHIBBOLETH_UPDATE_ROLES', true);
SHIBBOLETH_LOGGING
- Format: array (>= PHP 5.6)
- Available options: account_merge, account_create, auth, role_update
- PHP 5.6 (and above) example: const SHIBBOLETH_LOGGING = array( 'account_merge', 'account_create', 'auth', 'role_update' );
- PHP 7.0 (and above) example: define('SHIBBOLETH_LOGGING', array( 'account_merge', 'account_create', 'auth', 'role_update' ) );
SHIBBOLETH_DISALLOW_FILE_MODS
- Format: boolean
- Available options: true to disable the Shibboleth plugin from attempting to add .htaccess directives or false to allow the Shibboleth plugin to add the necessary .htaccess directives.
- Example: define('SHIBBOLETH_DISALLOW_FILE_MODS', true);