Single Sign On - WordPress with Azure AD

Connecting WordPress to Azure AD

The goal was to connect our WordPress-based enterprise website to Azure AD in order to realize a single sign-on and to have central control over the users and administrators of the website.

The initial situation

WordPress site with its own user management

WordPress, like most tools and online services, brings its own user management. This means that the company has to create every user and entitle them accordingly. When the user leaves the company, these accesses must also be considered, otherwise there will still be access to internal data of the company.

The task

Single Sign On with WordPress and Azure AD

The user should log on to his computer and get access to all applications and services shared with him without having to log in again anywhere.

The WordPress site must therefore be connected to Azure AD to take advantage of the possibilities of true identity management with Single Sign On.

The solution

Plugin for SSO with Azure AD

I will find what I am looking for, there are several solutions at the same time. After some research, my choice is WPO365 Basic. Admittedly, the Pro variant can do a lot more, but for now a single sign on with Azure Active Directory should suffice. The setup is well described, those who are reasonably savvy with Azure AD will soon enjoy a real single sign on.

The installation

Installing and configuring WPO365

Plugin Installation

In WordPress, search for WPO365 and install the “WordPress + Office 365 login” plugin.

Plugin configuration

The configuration is located under “WPO365” -> Single Sign-On and the following things must be configured:

Directory ID
The Directory ID can be found in the properties in the Azure Active Directory on the portal.azure.com Management page.

Application ID
To register your WordPress site with Microsoft, you need to perform a new application registration (link to the plugin’s website). Once you have registered your page, you will need to copy the Application ID and paste it here.

Redirect URI
Here the WordPress backend page is entered, important that of the slash at the end, such as: https://www.my-website.com/wp-admin/. This entry must exactly match one of the Reply URLs of the registered application in Azure Active Directory.

Pages Blacklist
Normally, nothing needs to be changed here unless you use

A customized login page
E-commerce plugins such as woo-commerce
Custom plugins with own API
Other applications that use the WordPress REST API

Authentication Scenario
Select Intranet to front and back WordPress, or Internet to protect only the backend with the plugin.

The conclusion

Benefits and Limitations of the Solution

The plugin is well described and does what it is supposed to do. It only provides Single Sign On with Azure, but that’s fine.

I can live well with the fact that I can’t assign group permissions and my users aren’t fully synchronized with all the data. If this is not enough, the Pro variant of the plugin is well advised.

More pictures

Single Sign On – WordPress with Azure AD

Connecting WordPress to Azure AD

WordPress site with its own user management

Single Sign On with WordPress and Azure AD

Plugin for SSO with Azure AD

Installing and configuring WPO365

Benefits and Limitations of the Solution

Author: Christian Schmidt

Related posts