Summary
This article discusses how to enable single sign-on (SSO) for your WHE-hosted WordPress website.
Several users of the Web Hosting Environment have enabled single sign-on (SSO), currently via OIDC or Shibboleth, to allow users to log into their WordPress website using the standard UMICH usernames and passwords. This replaces the WordPress login with the more familiar https://weblogin.umich.edu/ page.
Shibboleth and OIDC are the current methods.
Environment
- WordPress
- OIDC
- Shibboleth
Directions
- Log into your WordPress administrative interface.
- Navigate to Plugins → Add New.
- Search for the WordPress Native PHP Sessions plugin.
- Click "Install Now."
- Once it's downloaded, click "Activate."
- Search for the UMich OIDC Login plugin.
- Click "Install Now."
- Once it's downloaded, click "Activate."
- Navigate to the Settings → UMich OIDC Login Settings → OIDC page.
- Copy the Redirect URI field contents. It's probably something like https://fqdn/sitename/wp-admin/admin-ajax.php?action=openid-connect-authorize. You will provide this to the Identity Provider (IdP) in Step 18.
- Navigate to the provisioning site to provision the OIDC Service Client credentials.
- Click "Provision New OIDC Service Client."
- Enter the Site Identifier. This must be unique. We recommend an abbreviated version of your site name with either Dev or Prod as a suffix.
- Select your College or business division from the pull-down list.
- Select the MCommunity manager group from the pull-down list.
- Enter a valid shortcode in the Shortcode field.
- Select the MCommunity group for group-based authentication from the pull-down list.
- In the "Redirect URL(s)" field, enter the URL you copied in Step 10.
- Click "Submit."
- Click on the client ID in the results page for the new client you created. (If you have multiple client IDs look for the current date and time in the Created column.)
- Copy the OIDC Client ID and OIDC Secret and use them in your web application's configuration in order to configure your web application to authenticate visitors using OIDC in Step 23 and Step 24.
- Back on your WordPress site's UMich OIDC Login Settings page you visited in Step11, enter the Identity Provider URL:
https://shibboleth.umich.edu
- Enter the OIDC Client ID from the provisioning results in Step 21.
- Enter the OIDC Client Secret from the provisioning results in Step 21.
- Save your changes: Click "Save Changes."
- Navigate to the General tab (Settings → UMich OIDC Login → General).
- For the Post-Login Action field, choose "URL: Login Destination URL if set below, or page they were on when they logged in" from the pull-down list. It may already be selected.
- For the Post-Logout Action field, choose "Smart: Same page they logged out from if public, or logout URL if set below, or site home" from the pull-down list. It may already be selected.
- In the "Groups for Authorization" field, enter the "MCommunity groups for group-based authentication" you selected in Step 17.
- Save your changes: Click "Save Changes."
- In the "Use OIDC for WordPress Users" field, choose "OPTIONAL:...."
- Save your changes: Click "Save Changes."
- Test:
- In a new Incognito or Private window, visit the WordPress site's Admin page (.../wp-admin).
- Are you prompted for SSO credentials (either directly or via a "Login with SSO" button)?
- Can you actually log in?
- Does it take you to the correct page?
- Can you log out again?
- Does it take you to the correct page?
- Fix any problems before proceeding.
- Back on your WordPress site's UMich OIDC Login Settings page's General tab, in the "Use OIDC for WordPress Users," choose "YES:...."
- Save your changes: Click "Save Changes."
- Repeat the tests from Step 33.
- Fix any problems before proceeding.
- Log out of the administrative interface.
You have enabled SSO for your WHE-hosted WordPress website.