Shibboleth

From the Shibboleth Consortium: Shibboleth is a standards based, open source software package for web single sign-on across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

For more information on how to install the Native Shibboleth Service Provider on Linux, see this wiki article. For more information on how to install the Native Shibboleth Service Provider on other operating systems, see this wiki article. For more information on how to install Shibboleth on Nginx, see this GitHub repo. Note, we cannot provide support for installation, configuration, or troubleshooting of Shibboleth Service Provider issues.

Yes, the plugin provides a number of new actions and filters that can be used to extend the functionality of the plugin. Search shibboleth.php for occurrences of the function calls apply_filters and do_action to find them all. Then write a new plugin that makes use of the hooks. If your require additional hooks to allow for extending other parts of the plugin, please notify the plugin authors via the support forum. Before extending the plugin in this manner, please ensure that it is not actually more appropriate to add this logic to Shibboleth. It may make more sense to add a new attribute to your Shibboleth Identity Provider's attribute store (e.g. LDAP directory), or a new attribute definition to the Identity Provider's internal attribute resolver or the Shibboleth Service Provider's internal attribute extractor. In the end, the Shibboleth administrator will have to make that call as to what is most appropriate.

Yes, the plugin allows for all settings to be controlled via constants in wp-config.php. If set, the constant will override the value that exists in the WordPress options table. The available constants are detailed (with their available options) below: SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD Format: string Available options: 'standard' for the default "Environment Variables" option, 'redirect' for the "Redirected Environment Variables" option, and 'http' for the "HTTP Headers" option. Example: define('SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD', 'standard'); SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD_FALLBACK Format: boolean Available options: true to fallback to the standard "Environment Variables" options when the selected attribute access method does not return results or false to not fallback. Example: define('SHIBBOLETH_ATTRIBUTE_ACCESS_METHOD_FALLBACK', true); SHIBBOLETH_LOGIN_URL Format: string Available Options: none Example: define('SHIBBOLETH_LOGIN_URL', 'https://example.com/Shibboleth.sso/Login'); SHIBBOLETH_LOGOUT_URL Format: string Available Options: none Example: define('SHIBBOLETH_LOGOUT_URL', 'https://example.com/Shibboleth.sso/Logout'); SHIBBOLETH_PASSWORD_CHANGE_URL Format: string Available options: none Example: define('SHIBBOLETH_PASSWORD_CHANGE_URL', 'https://sso.example.com/account/update'); SHIBBOLETH_PASSWORD_RESET_URL Format: string Available options: none Example: define('SHIBBOLETH_PASSWORD_RESET_URL', 'https://sso.example.com/account/reset'); SHIBBOLETH_SPOOF_KEY Format: string Available options: none Example: define('SHIBBOLETH_SPOOF_KEY', 'abcdefghijklmnopqrstuvwxyz'); SHIBBOLETH_DEFAULT_TO_SHIB_LOGIN Format: boolean Available options: true to automatically default to Shibboleth login or false to not default to Shibboleth login. Example: define('SHIBBOLETH_DEFAULT_TO_SHIB_LOGIN', true); SHIBBOLETH_AUTO_LOGIN Format: boolean Available options: true to automatically login users with an existing Shibboleth session or false to not check for an existing Shibboleth session. Example: define('SHIBBOLETH_AUTO_LOGIN', true); SHIBBOLETH_BUTTON_TEXT Format: string Available options: none Example: define('SHIBBOLETH_BUTTON_TEXT', 'Login with Shibboleth'); SHIBBOLETH_DISABLE_LOCAL_AUTH Format: boolean Available options: true to prevent users logging in using WordPress local authentication or false allow WordPress local authentication AND Shibboleth authentication. Example: define('SHIBBOLETH_DISABLE_LOCAL_AUTH', true); SHIBBOLETH_HEADERS Format: array (>= PHP 5.6) Available options: none PHP 5.6 (and above) example: const SHIBBOLETH_HEADERS = array( 'username' => array( 'name' => 'eppn' ), 'first_name' => array( 'name' => 'givenName', 'managed' => 'on' ), 'last_name' => array( 'name' => 'sn', 'managed' => 'on' ), 'nickname' => array( 'name' => 'eppn', 'managed' => 'off' ), 'display_name' => array( 'name' => 'displayName', 'managed' => 'off' ), 'email' => array( 'name' => 'mail', 'managed' => 'on' ) ); PHP 7.0 (and above) example: define('SHIBBOLETH_HEADERS', array( 'username' => array( 'name' => 'eppn' ), 'first_name' => array( 'name' => 'givenName', 'managed' => 'on' ), 'last_name' => array( 'name' => 'sn', 'managed' => 'on' ), 'nickname' => array( 'name' => 'eppn', 'managed' => 'off' ), 'display_name' => array( 'name' => 'displayName', 'managed' => 'off' ), 'email' => array( 'name' => 'mail', 'managed' => 'on' ) ) ); SHIBBOLETH_CREATE_ACCOUNTS Format: boolean Available options: true to automatically create new users if they do not exist in the WordPress database or false to only allow existing users to authenticate. Example: define('SHIBBOLETH_CREATE_ACCOUNTS', true); SHIBBOLETH_AUTO_COMBINE_ACCOUNTS Format: string Available options: 'disallow' for the default "Prevent Automatic Account Merging" option, 'allow' for the "Allow Automatic Account Merging" option, and 'bypass' for the "Allow Automatic Account Merging (Bypass Username Management)" option. Example: define('SHIBBOLETH_AUTO_COMBINE_ACCOUNTS', 'disallow'); SHIBBOLETH_MANUALLY_COMBINE_ACCOUNTS Format: string Available options: 'disallow' for the default "Prevent Manual Account Merging" option, 'allow' for the "Allow Manual Account Merging" option, and 'bypass' for the "Allow Manual Account Merging (Bypass Username Management)" option. Example: define('SHIBBOLETH_MANUALLY_COMBINE_ACCOUNTS', 'disallow'); SHIBBOLETH_ROLES Format: array (>= PHP 5.6) Available options: none PHP 5.6 (and above) example: const SHIBBOLETH_ROLES = array( 'administrator' => array( 'header' => 'entitlement', 'value' => 'urn:mace:example.edu:entitlement:wordpress:admin' ), 'author' => array( 'header' => 'affiliation', 'value' => 'faculty' ) ); PHP 7.0 (and above) example: define('SHIBBOLETH_ROLES', array( 'administrator' => array( 'header' => 'entitlement', 'value' => 'urn:mace:example.edu:entitlement:wordpress:admin' ), 'author' => array( 'header' => 'affiliation', 'value' => 'faculty' ) ) ); SHIBBOLETH_DEFAULT_ROLE Format: string Available options: All available WordPress roles. The defaults are 'administrator', 'subscriber', 'author', 'editor', and 'contributor'. Leave this constant empty '' to make the default no allowed access. Example: define('SHIBBOLETH_DEFAULT_ROLE', 'subscriber'); SHIBBOLETH_UPDATE_ROLES Format: boolean Available options: true to automatically use Shibboleth data to update user role mappings each time the user logs in or false to only update role mappings when a user is initally created. Example: define('SHIBBOLETH_UPDATE_ROLES', true); SHIBBOLETH_LOGGING Format: array (>= PHP 5.6) Available options: account_merge, account_create, auth, role_update PHP 5.6 (and above) example: const SHIBBOLETH_LOGGING = array( 'account_merge', 'account_create', 'auth', 'role_update' ); PHP 7.0 (and above) example: define('SHIBBOLETH_LOGGING', array( 'account_merge', 'account_create', 'auth', 'role_update' ) ); SHIBBOLETH_DISALLOW_FILE_MODS Format: boolean Available options: true to disable the Shibboleth plugin from attempting to add .htaccess directives or false to allow the Shibboleth plugin to add the necessary .htaccess directives. Example: define('SHIBBOLETH_DISALLOW_FILE_MODS', true);