Topics Map > WordPress
Topics Map > Application Hosting > Shibboleth (NetID) Login
Web Hosting - WordPress NetID Login via Shibboleth
This document provides a basic guideline for integrating NetID login via Shibboleth into a custom instance of WordPress.
By default, DoIT Web Hosting provides NetID login integration services and your site should already be NetID Login capable. Web Hosting - Using NetID or Wisconsin Federated login
1. Starting on your equivalent Test environment Web Hosting - Test Site Utilization
-- Install a trusted SAML/Shibboleth Single Sign plugin via https://wordpress.org/plugins/ or another trusted source.
-- Do not use the defunct UW Communications plugin. It is not compatible with modern versions of PHP and has other issues.
-- Using miniOrange? See: Registering Metadata for a WordPress Site using miniOrange
2. Follow the instructions on the install of the plugin.
NOTE: Many plugins will attempt to set the appropriate directives in WordPress’s .htaccess file automatically. If not, you will need to manually add the entry for Shibboleth and exemption from the default rewrite rules, which can interfere with Shibboleth if not in place.
At the beginning of the .htaccess file:
# Shibboleth quick-exit from rewrite rules
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/Shibboleth.sso($|/)
RewriteRule . - [L]
# Require Lazy Session
AuthType shibboleth
ShibDisable Off
ShibRequestSetting applicationId yourdomain.wisc.edu
ShibDisable Off
ShibRequestSetting applicationId yourdomain.wisc.edu
ShibRequestSetting requireSession 0
3. Some of the common settings the plugins will require:
General:
Login URL: https://yourdomain.wisc.edu/Shibboleth.sso/Login
Logout URL: https://yourdomain.wisc.edu/Shibboleth.sso/Logout
Users:
Username: uid
Nickname: uid
Displayname: uid
Email: eppn
NOTES:
- uid and eppn are Shibboleth attributes that are delivered by default. If you require custom attributes like email, firstname, lastname, etc. you will need to submit an Identity data integration request
- If you select the managed option, you cannot manually change them. An example of when you may not want a field managed is an email address. eppn is an email address in the form of netid@wisc.edu but is not necessarily the preferred email address of the user.
AuthType shibboleth
ShibRequestSetting requireSession 1
Require valid-user
ShibUseHeaders On
ShibRequestSetting requireSession 1
Require valid-user
ShibUseHeaders On