/ Plugin Category

/ User Management & Authentication

/ User Registration & Login

/ WP SAML Auth

WP SAML Auth

By Pantheon Systems

User Management & Authentication / User Registration & Login

WP SAML Auth Review - In-Depth Analysis

SAML authentication for WordPress using OneLogin or SimpleSAMLphp.

Performance Overview

WPS Score

6.89/10

User Rating

4.5/5 (based on 8+ reviews)

Active Installations

7,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin provides SAML authentication for WordPress, leveraging the OneLogin SAML library or the optionally installed SimpleSAMLphp. It serves as a bridge between WordPress and the chosen authentication library.

Users can log in via SAML through a button added to the standard WordPress login view. When clicked, users are redirected to the identity provider for authentication. Once authenticated, they return to WordPress and are signed in. New users can be automatically created if desired.

The plugin includes configuration options to customize its behavior, such as forcing all authentication through the SAML identity provider. It supports both SimpleSAMLphp v1.x and v2.x, with automatic detection of the autoloader.

Comparing to Alternatives

WP SAML Auth is a free plugin that provides SAML authentication for WordPress, competing with other popular SAML plugins like OneLogin SAML SSO and miniOrange SAML Single Sign On.

Top alternatives

Strengths

Completely free with no paid tier.
Supports integration with Azure AD and Microsoft 365.
Offers developer-friendly filters for customization.
Lightweight and straightforward functionality.

Weaknesses

Lacks comprehensive documentation, making setup challenging.
No official support or premium version available.
Missing some user-friendly features like default role assignment in settings.
Initial configuration can be confusing for new users.

User Sentiment Analysis

User feedback highlights both the plugin's effectiveness and areas where it falls short, particularly regarding ease of setup and documentation.

Positive highlights

"Pretty excellent, well done." – H. Adam Lenz
"Does exactly what I need." – kikkervis
"Works great with Azure AD / Microsoft 365." – pbdk
"Great plugin, that works really well... does the same job as other paid plugins." – slingshotdesign
"Switching from miniOrange" – themachine01

Common complaints

Difficult to configure due to missing instructions.
Warning messages about missing library files after activation.
No option to define default user role in settings.
Lack of documentation makes integration with providers like Okta challenging.

Weaknesses

Steep learning curve for new users.
No dedicated support channels.
Limited features compared to paid alternatives.

Who Should Use This?

Best for

Developers and technically proficient users who need a free, lightweight SAML authentication solution and are comfortable troubleshooting and configuring manually.

Not ideal for

Users seeking an easy, out-of-the-box setup experience or those who require dedicated support and advanced features found in premium SAML plugins.

Pricing & Value

Free version includes

The free version includes full SAML authentication functionality without restrictions, making it a cost-effective choice for users who can manage setup independently.

Final Verdict

WP SAML Auth is a solid free option for adding SAML authentication to WordPress, especially for users with technical expertise who can navigate its setup challenges.

While it lacks extensive documentation and premium support, it delivers core functionality comparable to paid alternatives, making it a valuable tool for those on a budget.

Other Notable Features

Here are a few other notable features of this free WP SAML Auth plugin.

SAML authentication

WordPress authentication

OneLogin SAML

SimpleSAMLphp

FAQ

If you’d like to make sure the user’s display name, first name, and last name are updated in WordPress when they log back in, you can use the following code snippet:

/**  * Update user attributes after a user has logged in via SAML.  */ add_action( 'wp_saml_auth_existing_user_authenticated', function( $existing_user, $attributes ) {     $user_args = array(         'ID' => $existing_user->ID,     );     foreach ( array( 'display_name', 'first_name', 'last_name' ) as $type ) {         $attribute          = \WP_SAML_Auth::get_option( "{$type}_attribute" );         $user_args[ $type ] = ! empty( $attributes[ $attribute ][0] ) ? $attributes[ $attribute ][0] : '';     }     wp_update_user( $user_args ); }, 10, 2 );

The wp_saml_auth_existing_user_authenticated action fires after the user has successfully authenticated with the SAML IdP. The code snippet then uses a pattern similar to WP SAML Auth to fetch display name, first name, and last name from the SAML response. Lastly, the code snippet updates the existing WordPress user object.

Because SimpleSAMLphp uses PHP sessions to manage user authentication, it will work unreliably or not at all on a server configuration with multiple web nodes. This is because PHP’s default session handler uses the filesystem, and each web node has a different filesystem. Fortunately, there’s a way around this.

First, install and activate the WP Native PHP Sessions plugin, which registers a database-based PHP session handler for WordPress to use.

Next, modify SimpleSAMLphp’s www/_include.php file to require wp-load.php. If you installed SimpleSAMLphp within the wp-saml-auth directory, you’d edit wp-saml-auth/simplesamlphp/www/_include.php to include:

<?php require_once dirname( dirname( dirname( dirname( dirname( dirname( __FILE__ ) ) ) ) ) ) . '/wp-load.php';

Note: the declaration does need to be at the top of _include.php, to ensure WordPress (and thus the session handling) is loaded before SimpleSAMLphp.

There is no third step. Because SimpleSAMLphp loads WordPress, which has WP Native PHP Sessions active, SimpleSAMLphp and WP SAML Auth will be able to communicate to one another on a multi web node environment.

If you’d like to make sure the user’s display name, first name, and last name are updated in WordPress when they log back in, you can use the following code snippet:

/**  * Update user attributes after a user has logged in via SAML.  */ add_action( 'wp_saml_auth_existing_user_authenticated', function( $existing_user, $attributes ) {     $user_args = array(         'ID' => $existing_user->ID,     );     foreach ( array( 'display_name', 'first_name', 'last_name' ) as $type ) {         $attribute          = \WP_SAML_Auth::get_option( "{$type}_attribute" );         $user_args[ $type ] = ! empty( $attributes[ $attribute ][0] ) ? $attributes[ $attribute ][0] : '';     }     wp_update_user( $user_args ); }, 10, 2 );