From dfb296900d948b32c2fd921bc1370aa71ebc97f5 Mon Sep 17 00:00:00 2001 From: Andres Rosado Date: Wed, 21 Aug 2019 16:59:55 -0400 Subject: [PATCH 1/4] Adding the settings neccesary to limit account creation. --- inc/admin/namespace.php | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/inc/admin/namespace.php b/inc/admin/namespace.php index ef87c4fe..0db7c912 100644 --- a/inc/admin/namespace.php +++ b/inc/admin/namespace.php @@ -128,12 +128,13 @@ function config_admin_notice() { */ function get_sso_settings( $option = null ) { $options = [ - 'sso_enabled' => '', - 'sso_debug' => 0, - 'sso_sp_base' => is_sso_enabled_network_wide() ? get_home_url( get_network()->site_id, '/' ) : home_url( '/' ), - 'sso_role_management' => '', - 'sso_whitelisted_hosts' => '', - 'sso_idp_metadata' => '', + 'sso_enabled' => '', + 'sso_debug' => 0, + 'sso_sp_base' => is_sso_enabled_network_wide() ? get_home_url( get_network()->site_id, '/' ) : home_url( '/' ), + 'sso_role_management' => '', + 'sso_whitelisted_hosts' => '', + 'sso_idp_metadata' => '', + 'sso_create_if_not_exists' => 1, ]; // Network options is used instead if the plugin is activated network-wide @@ -213,6 +214,14 @@ function settings_fields() { } }, $settings_section, 'sso_settings' ); + register_setting( $settings_section, 'sso_create_if_not_exists', 'absint' ); + add_settings_field( 'sso_create_if_not_exists', __( 'SSO Create user if it does not exists', 'wp-simple-saml' ), function () use ( $options ) { + $value = $options['sso_create_if_not_exists']; + ?> + > + Date: Wed, 21 Aug 2019 19:59:44 -0400 Subject: [PATCH 2/4] Applying the new setting. --- inc/namespace.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/namespace.php b/inc/namespace.php index c9d732a3..54f91c20 100644 --- a/inc/namespace.php +++ b/inc/namespace.php @@ -373,7 +373,7 @@ function get_or_create_wp_user( \OneLogin\Saml2\Auth $saml ) { } // No user yet ? lets create a new one. - if ( empty( $user ) ) { + if ( empty( $user ) && Admin\get_sso_settings( 'sso_create_if_not_exists' ) ) { $first_name = isset( $map['first_name'], $attributes[ $map['first_name'] ] ) && is_array( $attributes[ $map['first_name'] ] ) ? reset( $attributes[ $map['first_name'] ] ) : ''; $last_name = isset( $map['last_name'], $attributes[ $map['last_name'] ] ) && is_array( $attributes[ $map['last_name'] ] ) ? reset( $attributes[ $map['last_name'] ] ) : ''; From 4fb1d071ac7449e27035fc76d287107d5bce5ecf Mon Sep 17 00:00:00 2001 From: Andres Rosado Date: Wed, 21 Aug 2019 20:05:29 -0400 Subject: [PATCH 3/4] Updating the README with the new setting. --- README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c0468fee..178b1e9a 100644 --- a/README.md +++ b/README.md @@ -51,13 +51,15 @@ Depending on whether the plugin is network-activated or not, you will need to go - `SSO Status` is how the plugin integrates with WordPress login process, available options are `Disable`, `Display login link` which only provides a link in the login form, `Force redirect` which overrides the login form altogether and directly goes to SSO login page. - `SSO Base URL` (optional) -is the home URL of the WordPress site that serves as the delegate ( main service provider ) to which SAML responses will be posted, usually this is the main site of the network, and is the same value for `siteurl` option, eg `https://my.site/` +is the home URL of the WordPress site that serves as the delegate ( main service provider ) to which SAML responses will be posted, usually this is the main site of the network, and is the same value for `siteurl` option, eg `https://my.site/`. - `SSO IdP Metadata` (required, if not filtered) Copy of the SSO IdP metadata XML file, which can also be passed via either `wpsimplesaml_idp_metadata_xml_path` for a path to the XML file, or `wpsimplesaml_idp_metadata_xml` for the contents of the XML, or `wpsimplesaml_idp_metadata` for the configuration array. +- `SSO Create user if it does not exists` +Controls if new accounts will be created if they don't exist already. - `SSO delegation whitelisted hosts` -List of hosts to whitelist during delegation of SAML responses, ie: secondary domains that needs to use SSO as well from the same IdP. Local sites are allowed by default. +List of hosts to whitelist during delegation of SAML responses, ie: secondary domains that needs to use SSO as well from the same IdP. Local sites are allowed by default. - `SSO Role Management` -Enables developers to assign different roles to users based on SAML Responses, disabled by default, and is controlled via a few filters, +Enables developers to assign different roles to users based on SAML Responses, disabled by default, and is controlled via a few filters. - `SSO Debug via Cookies` Allows developers to use a special cookie named `sso_debug` to override the `SSO Status` option during testing. Possible value of the cookie are `force` and `link`, which are self-explanatory. - `SSO Config validation` From 9dc7c3c51e215fc4527944b3b1567ca39e0eb959 Mon Sep 17 00:00:00 2001 From: Andres Rosado Date: Wed, 21 Aug 2019 20:13:54 -0400 Subject: [PATCH 4/4] Improving coding standards. --- inc/admin/namespace.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/admin/namespace.php b/inc/admin/namespace.php index 0db7c912..cee6ae00 100644 --- a/inc/admin/namespace.php +++ b/inc/admin/namespace.php @@ -216,7 +216,7 @@ function settings_fields() { register_setting( $settings_section, 'sso_create_if_not_exists', 'absint' ); add_settings_field( 'sso_create_if_not_exists', __( 'SSO Create user if it does not exists', 'wp-simple-saml' ), function () use ( $options ) { - $value = $options['sso_create_if_not_exists']; + $value = $options['sso_create_if_not_exists']; ?> >