| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:saml_wordpress [2025/04/27 09:53] – kainhofer | en:2.0:single_sign_on:saml_wordpress [2026/09/04 17:05] (current) – [Setting up the Client (SP) in Admidio] kainhofer |
|---|
| Throughout the document we will assume you have both Admidio and Wordpress already set up properly at https://admidio.local/ and https://wordpress.local/. Please modify these URLs to your actual installation. | Throughout the document we will assume you have both Admidio and Wordpress already set up properly at https://admidio.local/ and https://wordpress.local/. Please modify these URLs to your actual installation. |
| | |
| As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]] | As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to Wordpress. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]]. |
| {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} |
| |
| Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. | Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**. |
| The page preferences https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. | |
| |
| ===== TL;DR; - Quick Overview ===== | The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. |
| |
| Setting up a client (SAML "Service Provider" - short SP) to use Admidio's user accounts for logging in consists of two steps. If both the IdP (Admidio in our case) and the SP (Wordpress in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either. | ===== Quick Overview ===== |
| | |
| | Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Wordpress in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward. |
| |
| * At the **Service Provider (SP)** - Wordpress in our case - **install the extension** to support SAML login. | * At the **Service Provider (SP)** - Wordpress in our case - **install the extension** to support SAML login. |
| * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. | * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. |
| * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. | * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. |
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients as visual identifier, but has no technical use) |
| * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. | * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. |
| * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. | * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. |
| === Setting up encryption === | === Setting up encryption === |
| |
| If encryption is desired for all SAML messages sent by Admidio to Wordpress, or if Wordpress should sign all its SAML requests, then Wordpress needs a private/public key pair to decrypt or sign messages. These need to be entered into the Wordpress SAML config in PEM format and can be generated by openssl's command line tools, or in Admidio's key administration. Simply create a new Key for Wordpress (RSA 2048 bits). The certificate can be copied directly from the key's edit page, but the private key is not available in Admidio's GUI for security reason. Instead, it can be downloaded (secured with a password!) from the list of keys in Admidio: | If encryption is desired for all SAML messages sent by Admidio to Wordpress, or if Wordpress should sign all its SAML requests, then Wordpress needs a private/public key pair to decrypt or sign messages. These need to be entered into the Wordpress SAML config in PEM format and can be generated by openssl's command line tools, by sites like https://www.samltool.com/self_signed_certs.php or in Admidio's key administration. Simply create a new Key for Wordpress (RSA 2048 bits). The certificate can be copied directly from the key's edit page, but the private key is not available in Admidio's GUI for security reason. Instead, it can be downloaded (secured with a password!) from the list of keys in Admidio: |
| |
| {{ :en:2.0:sso:sso_saml_02-03a_nc_saml_keysetup1.png?direct&400 |}} | {{ :en:2.0:sso:sso_saml_02-03a_nc_saml_keysetup1.png?direct&400 |}} |
| |
| |
| Now, return to Admidio's SSO preferences page, go to the "Single-Sign-On Client Administration" (the button right above the "Save" button), and create a new client. | Now, return to Admidio's SSO preferences page, go to the "Single-Sign-On Clients" area (the button in the preferences section), and create a new client. |
| {{ :en:2.0:sso:sso_saml_03-00_admidio_saml_preferences.png?direct&400 |}} | {{ :en:2.0:sso:sso_saml_03-00_admidio_saml_preferences.png?direct&400 |}} |
| |
| |
| Paste the metadata URL copied from Wordpress into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Nextcloud and pre-fill the following fields correctly. Only the Client Name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. | Paste the metadata URL copied from Wordpress into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Wordpress and pre-fill the following fields correctly. Only the client name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. |
| {{ :en:2.0:sso:sso_saml_wp_07_saml_client.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_wp_07_saml_client.png?direct&600 |}} |
| | {{ :en:2.0:sso:sso_saml_wp_07_saml_client2.png?direct&600 |}} |
| |
| |
