Title: SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress Author: secureparrot Published: 12 ਮਈ 2026 Last modified: 20 ਮਈ 2026 --- ਪਲੱਗਇਨਾਂ ਖੋਜੋ ![](https://ps.w.org/securepie-sso-saml/assets/banner-772x250.png?rev=3530386) ![](https://ps.w.org/securepie-sso-saml/assets/icon-256x256.png?rev=3530386) # SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress [secureparrot](https://profiles.wordpress.org/secureparrot/) ਵੱਲੋਂ [ਡਾਊਨਲੋਡ ਕਰੋ](https://downloads.wordpress.org/plugin/securepie-sso-saml.1.0.11.zip) * [ਵੇਰਵਾ](https://pan.wordpress.org/plugins/securepie-sso-saml/#description) * [ਸਮੀਖਿਆਵਾਂ](https://pan.wordpress.org/plugins/securepie-sso-saml/#reviews) * [ਸਥਾਪਤੀਕਰਨ](https://pan.wordpress.org/plugins/securepie-sso-saml/#installation) * [ਵਿਕਾਸ](https://pan.wordpress.org/plugins/securepie-sso-saml/#developers) [ਸਹਿਯੋਗ](https://wordpress.org/support/plugin/securepie-sso-saml/) ## ਵੇਰਵਾ **SecurePie SSO SAML** is a SAML 2.0 Single Sign-On (SSO) plugin for WordPress that provides enterprise SSO login, SAML login, and federated login via any SAML 2.0 Identity Provider — including Azure AD (Entra ID), Okta, Google Workspace, OneLogin, ADFS, Auth0, PingFederate, and Keycloak. Whether you need SAML SSO for an intranet, an enterprise SSO portal for customers, or federated authentication for your team, this plugin turns your WordPress site into a SAML Service Provider with zero external dependencies. SecurePie SSO SAML allows you to configure your WordPress site as a SAML 2.0 Service Provider (SP), enabling Single Sign-On with any SAML 2.0 compliant Identity Provider( IdP) such as Azure AD, Okta, Google Workspace, OneLogin, ADFS, and more. This is a **zero-dependency** plugin — it uses only PHP’s built-in `dom`, `openssl`, and `zlib` extensions. No Composer, no external libraries, no conflicts with other plugins. #### Features * **Full SAML 2.0 SSO** — AuthnRequest generation, Response validation, user provisioning * **SP Metadata Endpoint** — Auto-generated metadata XML for easy IdP configuration * **IdP Metadata Parsing** — Import IdP settings from a metadata URL or XML file * **XML Digital Signature Verification** — RSA-SHA256 and RSA-SHA1 support * **Security Hardened** — XXE prevention, signature wrapping attack protection, replay prevention, audience validation * **Attribute Mapping** — Map SAML attributes to WordPress user fields (username, email, first name, last name, display name) * **Role Mapping** — Assign WordPress roles based on IdP group/role attributes * **Auto User Provisioning** — Automatically create WordPress users on first SSO login * **SSO Login Button** — Customizable SSO button on the WordPress login page * **Force SAML Login** — Optionally redirect all login attempts through the IdP * **Single Logout (SLO)** — Send LogoutRequest to the IdP when users log out of WordPress * **Test Configuration** — Validate your SSO setup and see returned attributes before going live * **HTTP-Redirect and HTTP-POST Bindings** — Support for both SAML binding types * **Clean Admin Interface** — Professional tabbed settings page with copy-to-clipboard functionality #### Use Cases * **Enterprise SSO** — Centralize WordPress login through your corporate Identity Provider so employees use one set of credentials. * **SAML Login for Customer Portals** — Let B2B customers sign in to your WordPress site using their own SAML SSO identity. * **Federated Login Across Sites** — Use a single SAML IdP to federate authentication across multiple WordPress installs. * **SSO Authentication for Membership Sites** — Replace WordPress’s default signin flow with SAML SSO login from Azure AD, Okta, or Google Workspace. * **Intranet Single Sign-On** — Add WordPress to your existing SSO ecosystem alongside other SAML 2.0 enabled apps. #### Supported Identity Providers * Microsoft Azure Active Directory (Entra ID) * Okta * Google Workspace * OneLogin * Salesforce * Auth0 * PingFederate * Shibboleth * ADFS (Active Directory Federation Services) * Keycloak * Any SAML 2.0 compliant IdP #### Setting up SAML SSO with Azure AD (Entra ID) Connecting WordPress to Azure AD / Entra ID for SAML SSO with SecurePie takes about ten minutes: 1. In the WordPress admin, open **SecurePie SSO Service Provider** and copy the ** SP Entity ID** and **ACS URL**. 2. In Azure, create a new **Enterprise Application** of type “Non-gallery application” and open its **Single sign-on SAML** blade. 3. Paste the SP Entity ID into Azure’s **Identifier (Entity ID)** field and the ACS URL into the **Reply URL (Assertion Consumer Service URL)** field. 4. Under “SAML Signing Certificate”, download the **Federation Metadata XML** (or copy the Login URL and certificate). 5. Back in WordPress, open **Identity Provider Quick Setup** and either upload the metadata XML or paste the metadata URL. SecurePie auto-fills Entity ID, Login URL and X.509 Certificate. 6. Assign your Azure users / groups to the Enterprise Application, then run **Test Configuration** in WordPress to confirm attributes flow through correctly before enabling the SSO button on the login page. #### Setting up SAML SSO with Okta Okta-to-WordPress SAML SSO with SecurePie follows the same pattern: 1. In the WordPress admin, open **SecurePie SSO Service Provider** and copy the ** SP Entity ID**, **ACS URL** and **Single Logout URL**. 2. In the Okta admin, go to **Applications Create App Integration SAML 2.0**, give the app a name, and continue to step 2 of Okta’s wizard. 3. Paste the SP Entity ID into Okta’s **Audience URI (SP Entity ID)** field and the ACS URL into the **Single Sign-on URL** field. 4. Configure Okta’s attribute statements to send `email`, `firstName`, `lastName`, and optionally a `groups` claim for role mapping. 5. After saving, open the Okta **Sign On** tab, click **View SAML setup instructions**, and copy the **Identity Provider Single Sign-On URL**, **Identity Provider Issuer** and the **X.509 Certificate**. 6. Back in WordPress, paste these into **Identity Provider Setup** (or use Okta’s metadata URL). Run **Test Configuration** to verify the SAML assertion before going live. #### Requirements * PHP 7.4 or higher * PHP extensions: `dom`, `openssl`, `zlib` (enabled by default on most hosts) * WordPress 5.8 or higher ### External Services This plugin implements the SAML 2.0 protocol, which requires communication with an external Identity Provider (IdP) that is configured by the site administrator. No data is sent to any external service without the administrator explicitly configuring the connection. #### Identity Provider Communication When a user initiates SSO login, the plugin redirects the user’s browser to the Identity Provider’s SAML Login URL (configured by the administrator). The following data is sent as part of the standard SAML 2.0 AuthnRequest: * The Service Provider Entity ID (your site’s identifier) * The Assertion Consumer Service URL (your site’s callback URL) * A unique request ID for replay prevention The Identity Provider then authenticates the user and sends a SAML Response back to your site containing the user’s identity attributes (such as email, name, and group membership). This communication is entirely between your WordPress site and the IdP that you configure. No data is sent to SecurePie or any other third party. The terms of service and privacy policy for the Identity Provider depend on which provider you choose to configure (e.g., Microsoft Azure AD, Okta, Google Workspace). Please consult your Identity Provider’s documentation for their specific terms. #### IdP Metadata Import (Optional) The plugin can optionally fetch Identity Provider metadata from a URL provided by the administrator. This is a one-time server-to-server request to retrieve the IdP’s public configuration (Entity ID, Login URL, X.509 Certificate). No user data is sent during this request. #### SAML Attribute Namespace URIs The plugin references standard SAML attribute namespace URIs (e.g., `http://schemas. xmlsoap.org/ws/2005/05/identity/claims/emailaddress`) as identifiers within SAML assertions. These are XML namespace strings used for attribute identification and are not HTTP requests to external services. ## ਸਥਾਪਤੀਕਰਨ 1. Upload the `securepie-sso-saml` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Navigate to **SecurePie SSO** in the admin menu. 4. Copy the SP metadata URL from the **Service Provider** tab and register it with your Identity Provider. 5. Enter your IdP’s SAML details in the **Identity Provider Setup** tab (or use the metadata import feature). 6. Configure **Attribute Mapping** to match your IdP’s attribute names. 7. Use the **Test Configuration** tab to verify your SSO setup. 8. Enable the SSO button on the login page from the **Redirection & SSO** tab. ## ਅਕਸਰ ਪੁੱਛੇ ਜਾਂਦੇ ਸਵਾਲ ### What is SAML SSO? SAML (Security Assertion Markup Language) Single Sign-On allows users to log in to WordPress using their existing organizational credentials from an Identity Provider like Azure AD, Okta, or Google Workspace. ### Which Identity Providers are supported? SecurePie SSO SAML works with any SAML 2.0 compliant Identity Provider. ### Where do I find my IdP’s SAML settings? Your Identity Provider’s admin console will provide the Entity ID, Login URL, Logout URL, and X.509 Certificate needed for configuration. You can also import these from the IdP’s metadata URL. ### Can I still log in with WordPress credentials? Yes. Even with Force SAML Login enabled, you can access the standard WordPress login at `wp-login.php?normal=1`. ### Does this plugin create WordPress users automatically? Yes. When a user authenticates via SAML for the first time, the plugin creates a WordPress user account with the configured default role and mapped attributes. ### What security measures are in place? The plugin validates XML digital signatures (RSA-SHA256/SHA1), prevents XXE attacks, guards against signature wrapping attacks, validates audience restrictions, checks assertion timestamps with clock skew tolerance, and uses single-use transients for replay prevention. ### Does this plugin require Composer or external libraries? No. SecurePie SSO SAML is built entirely with PHP’s built-in extensions (`dom`, ` openssl`, `zlib`) and has zero external dependencies. ### Does this plugin support enterprise SSO and federated login? Yes. SecurePie SSO SAML is built for enterprise SSO and federated login scenarios. It implements the SAML 2.0 Web Browser SSO profile, which is the industry standard for federated authentication used by Azure AD, Okta, OneLogin, Google Workspace, and other enterprise Identity Providers. ### How is this different from OAuth or OIDC login plugins? This plugin implements SAML 2.0 only — the protocol most enterprise Identity Providers use for SSO. If your IdP only supports OAuth 2.0 or OpenID Connect (OIDC), you will need a different plugin. SAML is the standard for enterprise federation; OAuth/OIDC is more common for consumer login. ### How do I set up SAML SSO with Azure AD on WordPress? Copy the SP Entity ID and ACS URL from the **Service Provider** tab, paste them into a new Azure AD / Entra ID Enterprise Application (SAML), and download Azure’s Federation Metadata XML. Upload the XML in **Identity Provider Quick Setup** — SecurePie auto-fills the Entity ID, Login URL and X.509 Certificate. Run **Test Configuration** to confirm the attributes are flowing, then enable the SSO button on the WordPress login page. ### How do I set up SAML SSO with Okta on WordPress? In Okta, create a new **SAML 2.0 App Integration**, then paste the SP Entity ID into Okta’s “Audience URI” field and the ACS URL into “Single Sign-on URL”. Configure attribute statements for email, firstName, lastName, and groups. After saving, copy Okta’s IdP Issuer, IdP Single Sign-On URL and X.509 Certificate (or use the metadata URL) into the **Identity Provider Setup** tab in WordPress. Verify with **Test Configuration**. ### Does SecurePie SSO support WordPress MultiSite? Yes for per-site activation. Each subsite in a MultiSite install can be configured as its own SAML Service Provider with its own IdP. If you need a single SAML configuration shared across the network (network-level activation, cross-site SSO federation, or domain-based IdP routing), upgrade to SecurePie SSO Premium — those federation features are not included in the free plugin. ## ਸਮੀਖਿਆਵਾਂ There are no reviews for this plugin. ## ਯੋਗਦਾਨੀ ਤੇ ਵਿਕਾਸਕਾਰ “SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress” is open source software. The following people have contributed to this plugin. ਯੋਗਦਾਨੀ * [ secureparrot ](https://profiles.wordpress.org/secureparrot/) [“SecurePie SSO SAML — Single Sign-On, SAML Login & Enterprise SSO for WordPress” ਦਾ ਆਪਣੀ ਭਾਸ਼ਾ ਵਿੱਚ ਅਨੁਵਾਦ ਕਰੋ।](https://translate.wordpress.org/projects/wp-plugins/securepie-sso-saml) ### ਵਿਕਾਸ ਕਾਰਜ ਵਿੱਚ ਰੁਚੀ ਰੱਖਦੇ ਹੋ? [Browse the code](https://plugins.trac.wordpress.org/browser/securepie-sso-saml/), check out the [SVN repository](https://plugins.svn.wordpress.org/securepie-sso-saml/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/securepie-sso-saml/) by [RSS](https://plugins.trac.wordpress.org/log/securepie-sso-saml/?limit=100&mode=stop_on_copy&format=rss). ## ਤਬਦੀਲੀ-ਚਿੱਠਾ #### 1.0.11 * Compat: Declared compatibility with WordPress 7.0 (no functional changes — verified against the WP 7.0 release notes: no block-editor / iframed-editor touchpoints, PHP 7.4 minimum already met, no deprecated function calls). #### 1.0.10 * SEO: Optimised the 5 indexable tag slots toward high-intent brand-name searches( Okta, Azure AD). * SEO: Expanded the short description to name OneLogin and ADFS alongside Azure AD, Okta and Google Workspace. * Docs: Added Azure AD (Entra ID) and Okta SAML SSO setup walkthroughs to the Description. * Docs: Three new FAQ entries — Azure AD setup, Okta setup, MultiSite support. * Docs: Added two new captioned screenshot entries (Test SSO Configuration results, Help & Support form). * No functional or SAML-protocol changes. #### 1.0.9 * New: Bundled “Need Help?” support panel with embedded contact form on the configuration page, accompanied by a custom headphones icon (replaces the dashicons SOS glyph). * New: “Try Live Demo” button in the plugin header for one-click access to the live demo and pricing page. * Change: Tightened free-tier scope. Attribute Mapping, Role Mapping, Group-to- Role Mapping and the Redirect & SSO settings are now Premium features; the free tier renders these sections as locked teasers with an Upgrade-to-Premium call- to-action. The SSO login button on wp-login.php uses the fixed text “SSO Login” in the free tier. * Change: Removed the “Configured Identity Providers” list and the “Add More Identity Providers” teaser from the free tier — the free plan supports a single Identity Provider only. * Security: SHA-1 SAML signatures and digests are permanently rejected in the free tier. IdP-initiated SSO and email-based account linking are hard-disabled in the free tier (admin toggles removed; direct writes to wp_options have no effect). * Fix: “Test SSO Configuration” button no longer falls through to a real login that would invalidate the admin’s existing session. The test flow is now tracked via a server-side request-ID marker that survives the cross-site SameSite=Lax ACS POST returning from the IdP. * UX: Right-side persistent help and contact panel on the configuration page. Service Provider tab values stay inside the card on narrower viewports (responsive flex- wrap + min-width fixes). Settings-saved notice renders with a light-green background and auto-dismisses after five seconds. * Cleanup: Dropped register_setting() calls and sanitiser callbacks for the locked options so admin tweaks via the Settings API are not possible. #### 1.0.8 * Free plan now includes 100 lifetime SAML SSO logins per install. Once consumed, further SAML logins are paused and the admin is directed to upgrade. WordPress password login continues to work normally — administrators are never locked out. * Added a Free plan card to the pricing tab with live usage progress (green / yellow/ red). * Identity Provider tab shows a warning banner at 80% of the free allowance and a red banner once the cap is reached. * Rewrote Standard / Premium / Enterprise feature descriptions and unified the call-to-action button to “Upgrade Now” linking to https://securepie.com/wordpress/ sso/pricing. * Pricing aligned with the broader SAML SSO market: Standard $175 / Premium $225/ Enterprise $275 (per year). #### 1.0.7 — Security Release This release addresses one critical and several high-severity findings from an independent security audit. All sites are strongly encouraged to update. * (Critical) Hardened SAML Response parsing against XML Signature Wrapping (XSW) attacks. All NameID, attribute, and condition reads are now bound to the signature- verified Assertion node. Responses containing more than one Assertion element are rejected. * (High) Email-based account linking is now opt-in (off by default). Admin accounts are never auto-linked by email — a previously-bound NameID is required. * (High) The Default Role dropdown no longer offers Administrator or Super Admin, and the sanitize callback rejects these values defensively. * (High) Assertions without a NotOnOrAfter are now rejected. Replay-cache TTL is keyed to the assertion’s actual expiry plus a 5-minute skew, bounded to 24 hours. * (High) IdP-initiated SSO (empty InResponseTo) is now opt-in (off by default). * (High) Identity Provider metadata import now enforces https://, rejects loopback/ private/link-local IP addresses, caps the response at 1 MiB, and verifies the Content-Type. * (Medium) SHA-1 signatures are now opt-in (off by default). The plugin defaults to SHA-256/384/512. * (Medium) Signature verification now runs before any other validation, so unsigned XML content is never consulted before crypto verification. #### 1.0.6 * Plugin admin UI is now fully responsive — pricing grid, Identity Provider grid, attribute mapping rows and Update Required modal adapt cleanly to tablet and phone widths * Plugin admin now fills the full screen width on large monitors (removed the previous 1100px cap) * Wide tables (Help page, multi-IdP listing) scroll horizontally on narrow screens instead of overflowing the layout * No functional / SAML changes #### 1.0.5 * Added an “Update Required” modal on the plugin’s admin pages when a newer version is available on WordPress.org * The modal locks the plugin settings UI (Service Provider, IdP, Attribute Mapping, etc.) until the user updates, with a one-click link to WordPress’s standard plugin updater * SAML SSO login continues to work normally while the admin UI is locked — no risk of locking users out of WordPress * Uses WordPress’s existing update-check transient (no external API calls, no new permissions) #### 1.0.4 * Premium page: removed the Free tier and repriced — Single IdP ($199/yr), Premium( $299/yr), Enterprise ($399/yr) * Premium page: added “Current Plan” indicator driven by the `securepie_current_plan` WP option (empty by default, so unpaid users see buy/upgrade buttons as before) #### 1.0.3 * SEO metadata update: refreshed title, short description, tags, and use-case documentation * Added “Use Cases” section covering enterprise SSO, SAML login, federated login, and intranet SSO scenarios * Added FAQ entries on enterprise SSO / federated login and SAML vs OAuth/OIDC differences * No functional changes #### 1.0.2 * Added “Send us your query” support form on both the plugin Help page and the main Configuration page * Support form submissions are routed via the SecurePie support API, removing the dependency on the host’s wp_mail() configuration * Form sends diagnostic context (site URL, plugin/WP/PHP versions) to help SecurePie respond faster * No new permissions, dependencies, or external libraries — uses WordPress’s built- in HTTP API #### 1.0.1 * Improved metadata file upload with auto-parse on file selection * Added inline status messages for metadata parsing feedback * Fixed double-escaped HTML entities in Identity Provider tab * Added proper output escaping on all template ternary expressions * Enhanced SAML Response validation security * Fixed SSO button alignment on WordPress login page * Removed duplicate settings saved notice * Added HTTPS enforcement for Identity Provider URLs * Improved role mapping validation against registered WordPress roles * Better error handling for SLO response validation #### 1.0.0 * Initial release * Full SAML 2.0 Web Browser SSO Profile implementation * AuthnRequest generation with HTTP-Redirect and HTTP-POST bindings * SAML Response validation with XML digital signature verification * SP metadata endpoint for IdP registration * IdP metadata parsing from URL or XML file * Automatic user provisioning and profile updates * Attribute mapping for username, email, first name, last name, display name * Role mapping based on IdP group attributes * SSO button on WordPress login page * Force SAML login option with emergency bypass * Single Logout (SLO) support * Test configuration tool with detailed results display * Admin interface with 5 configuration tabs * Copy-to-clipboard for SP metadata values ## ਮੈਟਾ * Version **1.0.11** * Last updated **1 ਦਿਨ ਪਹਿਲਾਂ** * Active installations **10 ਤੋਂ ਘੱਟ** * WordPress version ** 5.8 ਜਾਂ ਇਸ ਤੋਂ ਉੱਚਾ ** * Tested up to **7.0** * PHP version ** 7.4 ਜਾਂ ਇਸ ਤੋਂ ਉੱਚਾ ** * Language * [English (US)](https://wordpress.org/plugins/securepie-sso-saml/) * Tags * [Azure AD](https://pan.wordpress.org/plugins/tags/azure-ad/)[okta](https://pan.wordpress.org/plugins/tags/okta/) [SAML](https://pan.wordpress.org/plugins/tags/saml/)[Single Sign-on](https://pan.wordpress.org/plugins/tags/single-sign-on/) [sso](https://pan.wordpress.org/plugins/tags/sso/) * [Advanced View](https://pan.wordpress.org/plugins/securepie-sso-saml/advanced/) ## ਦਰਜਾਬੰਦੀ No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/securepie-sso-saml/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/securepie-sso-saml/reviews/) ## ਯੋਗਦਾਨੀ * [ secureparrot ](https://profiles.wordpress.org/secureparrot/) ## ਸਹਿਯੋਗ ਕੁਝ ਕਹਿਣਾ ਹੈ? ਮਦਦ ਚਾਹੀਦੀ ਹੈ? [ਸਹਿਯੋਗ ਫੋਰਮ ਦੇਖੋ](https://wordpress.org/support/plugin/securepie-sso-saml/)