DEV Community

Cover image for WordPress (WP) and Okta Single Sign-On
Itse Isaac Azi
Itse Isaac Azi

Posted on

WordPress (WP) and Okta Single Sign-On

#security #wordpress #tutorial #opensource

Prerequisite

  1. Okta Account
  2. Wordpress website

Click this link to watch the full setup on WordPress and Okta Single Sign-on

awesomescreenshot.com

WordPress does not independently authenticate users when Okta and WordPress use Single Sign-On (SSO). Instead, it uses Okta to verify a user's identity.

Consider it like this:
The program that the user wants to use is called WordPress.

The trusted identity provider (IdP) that confirms the identity of the user is Okta.

SAML 2.0 is the protocol that securely sends the authentication result from Okta to WordPress.

Before SSO

Without SSO, the login flow looks like this:

              The user
                │
        WordPress Login Page
                │
        Username + Password
                │
    WordPress checks credentials.
                │
            Database
                │
           Login Success
Enter fullscreen mode Exit fullscreen mode

Problems with this approach include:

  1. Users must remember separate passwords.
  2. Passwords are stored and managed by WordPress.
  3. MFA may not be consistently enforced.
  4. User accounts have to be managed separately in WordPress.

After SSO

With Okta SSO:



           User
            │
            ▼
     WordPress Website
            │
            ▼
     "Login with Okta"
            │
            ▼
           Okta
            │
    Username + Password
            │
            ▼
      MFA Challenge
            │
            ▼
     Identity Verified
            │
            ▼
     SAML Response Sent
            │
            ▼
         WordPress
            │
            ▼
       User Logged In
Enter fullscreen mode Exit fullscreen mode

Observe that the password is never checked by WordPress. It just acknowledges Okta's reliable response.

The Components
1. User

The employee, administrator, editor, or customer trying to log in.
Example:
John

John wants to access:
https://company.com/wp-admin

2. WordPress (Service Provider)

In SAML, WordPress acts as the Service Provider (SP).

Its job is to:

  1. Request authentication.
  2. Trust Okta's response.
  3. Create a local session.
  4. Assign the appropriate WordPress role.

WordPress does not verify the password.

3. Okta (Identity Provider)

Okta is the Identity Provider (IdP).

It:

  1. Stores user identities.
  2. Verifies passwords.
  3. Enforces MFA.
  4. Applies sign-in policies.
  5. Sends a signed SAML response back to WordPress.

4. SAML

SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication information.

WordPress sends a request like
Please authenticate this user.

Okta replies:
This user has been authenticated.

Email:
john@company.com

First Name:
John

Last Name:
Smith

Groups:
Administrators

The response is digitally signed so WordPress can verify it hasn't been altered.

A Real Login Walkthrough

Suppose:

WordPress site:

https://company.com

Okta organisation:

https://company.okta.com

The login sequence is

Step 1

John opens: https://company.com/wp-admin

WordPress sees no active session.

Step 2

Instead of showing the standard login form, WordPress redirects John to Okta.
company.okta.com

Step 3

Okta displays its login page.
Email:

Password

Top comments (0)