Signclave – SSO for SAML and LDAP

WordPress SAML Service Provider with optional LDAP fallback.

Source: https://github.com/Considbrs-Webdev/signclave-sso

Features:
– SAML SSO redirect on wp-login.php
– Signed assertion validation (XML signature + digest)
– Replay protection, signed RelayState, redirect allowlisting
– Optional LDAP authentication fallback
– Optional group-to-role mapping
– Security audit logging

Security

This plugin follows WordPress and OWASP-oriented practices:

• SAML signatures verified only against the configured IdP X.509 certificate (pinned).
• Strict SAML validation (audience, destination, issuer, InResponseTo) enabled by default.
• Emergency local login requires a secret key (?password=1&signclave_sso_key=...), not a public flag.
• Proxy HTTPS headers are ignored unless explicitly enabled.
• Account linking by email is off by default.
• LDAP bind passwords encrypted at rest (AES-256-GCM).
• When LDAP is enabled and fully configured, SAML must verify the directory before provisioning a new WordPress user. Existing WordPress accounts can still sign in via SAML if LDAP is down.
• With LDAP disabled or incomplete, SAML runs alone (JIT from IdP attributes; local accounts match by username).
• No raw SQL; admin actions require manage_options and nonces.
• Audit log redacts secrets; log directory denied via .htaccess.