/ Plugin Category

/ User Management & Authentication

/ User Registration & Login

/ WP SAML Auth

WP SAML Auth

By Pantheon Systems

User Management & Authentication / User Registration & Login

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

WP SAML Auth Review - In-Depth Analysis

SAML authentication for WordPress using OneLogin or SimpleSAMLphp.

Performance Overview

WPS Score

6.78/10

User Rating

4.5/5 (based on 8+ reviews)

Active Installations

7,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin provides SAML authentication for WordPress, leveraging the OneLogin SAML library or the optionally installed SimpleSAMLphp. It serves as a bridge between WordPress and the chosen authentication library.

Users can log in via SAML through a button added to the standard WordPress login view. When clicked, users are redirected to the identity provider for authentication. Once authenticated, they return to WordPress and are signed in. New users can be automatically created if desired.

The plugin includes configuration options to customize its behavior, such as forcing all authentication through the SAML identity provider. It supports both SimpleSAMLphp v1.x and v2.x, with automatic detection of the autoloader.

Comparing to Alternatives

WP SAML Auth is a solid choice among SAML authentication plugins, offering a free and effective solution with some developer-friendly features. It competes well with other popular plugins in the category.

Top alternatives

Strengths

Free and open source with no paid version required
Works well with major identity providers like Azure AD and Microsoft 365
Includes useful filters for developers to customize functionality
High user satisfaction with a 4.5-star average rating
Performs comparably to paid plugins in the same category

Weaknesses

Lacks comprehensive setup documentation, making configuration difficult for some users
No option to define default user roles in settings
Does not offer a pro version with additional features
Some users report missing library files and activation warnings during setup

User Sentiment Analysis

The plugin enjoys a strong positive reception with 87.5% of ratings at 5 stars, reflecting user satisfaction with its core functionality. However, a minority of users report setup difficulties.

Positive highlights

"Pretty excellent, well done." — H. Adam Lenz
"Does exactly what I need." — kikkervis
"Works great with Azure AD / Microsoft 365." — pbdk
"Great plugin, that works really well... I also really appreciate that this is free!" — slingshotdesign
"Switching from miniOrange" — themachine01

Common complaints

Difficult to configure due to missing instructions and library files, especially with Okta integration

Weaknesses

Steep learning curve for new users without detailed documentation
Some activation warnings related to missing files
Limited customization options in the settings interface

Who Should Use This?

Best for

Developers and site administrators comfortable with some technical setup who want a free, reliable SAML authentication plugin compatible with major identity providers.

Not ideal for

Users seeking an out-of-the-box solution with extensive documentation and guided setup, or those who prefer a plugin with a dedicated pro version and advanced features.

Pricing & Value

Free version includes

The free version includes full SAML authentication functionality compatible with popular identity providers and developer hooks for customization.

Final Verdict

WP SAML Auth stands out as a capable and free SAML authentication plugin with strong user approval and no known security vulnerabilities. It offers good value for technically inclined users who can navigate its limited documentation and setup challenges.

However, it may not be the best fit for those needing extensive support or a polished user experience out of the box. Alternatives with paid support and more comprehensive guides might better serve less technical users.

Other Notable Features

Here are a few other notable features of this free WP SAML Auth plugin.

SAML authentication

WordPress authentication

OneLogin SAML

SimpleSAMLphp

FAQ

If you’d like to make sure the user’s display name, first name, and last name are updated in WordPress when they log back in, you can use the following code snippet:

/**  * Update user attributes after a user has logged in via SAML.  */ add_action( 'wp_saml_auth_existing_user_authenticated', function( $existing_user, $attributes ) {     $user_args = array(         'ID' => $existing_user->ID,     );     foreach ( array( 'display_name', 'first_name', 'last_name' ) as $type ) {         $attribute          = \WP_SAML_Auth::get_option( "{$type}_attribute" );         $user_args[ $type ] = ! empty( $attributes[ $attribute ][0] ) ? $attributes[ $attribute ][0] : '';     }     wp_update_user( $user_args ); }, 10, 2 );

The wp_saml_auth_existing_user_authenticated action fires after the user has successfully authenticated with the SAML IdP. The code snippet then uses a pattern similar to WP SAML Auth to fetch display name, first name, and last name from the SAML response. Lastly, the code snippet updates the existing WordPress user object.

Because SimpleSAMLphp uses PHP sessions to manage user authentication, it will work unreliably or not at all on a server configuration with multiple web nodes. This is because PHP’s default session handler uses the filesystem, and each web node has a different filesystem. Fortunately, there’s a way around this.

First, install and activate the WP Native PHP Sessions plugin, which registers a database-based PHP session handler for WordPress to use.

Next, modify SimpleSAMLphp’s www/_include.php file to require wp-load.php. If you installed SimpleSAMLphp within the wp-saml-auth directory, you’d edit wp-saml-auth/simplesamlphp/www/_include.php to include:

<?php require_once dirname( dirname( dirname( dirname( dirname( dirname( __FILE__ ) ) ) ) ) ) . '/wp-load.php';

Note: the declaration does need to be at the top of _include.php, to ensure WordPress (and thus the session handling) is loaded before SimpleSAMLphp.

There is no third step. Because SimpleSAMLphp loads WordPress, which has WP Native PHP Sessions active, SimpleSAMLphp and WP SAML Auth will be able to communicate to one another on a multi web node environment.

If you’d like to make sure the user’s display name, first name, and last name are updated in WordPress when they log back in, you can use the following code snippet:

/**  * Update user attributes after a user has logged in via SAML.  */ add_action( 'wp_saml_auth_existing_user_authenticated', function( $existing_user, $attributes ) {     $user_args = array(         'ID' => $existing_user->ID,     );     foreach ( array( 'display_name', 'first_name', 'last_name' ) as $type ) {         $attribute          = \WP_SAML_Auth::get_option( "{$type}_attribute" );         $user_args[ $type ] = ! empty( $attributes[ $attribute ][0] ) ? $attributes[ $attribute ][0] : '';     }     wp_update_user( $user_args ); }, 10, 2 );