Disgrifiad

Sanch MultiDomain LDAP Auth for Active Directory provides enterprise-grade Single Sign-On (SSO) and access control for corporate WordPress intranets. Built for multi-forest environments, it allows users to authenticate seamlessly against multiple Domain Controllers while strictly enforcing path-based access policies and dynamic role propagation.

Key Features

Multi-Domain & Multi-DC Authentication: Connect and authenticate against multiple LDAP/LDAPS servers across different Active Directory domains/UPN suffixes.
Mandatory Intranet Login: The site is strictly private. All guests are automatically redirected to the login screen.
Blacklist Path-Based ACL: Once logged in, content is accessible to all staff by default. Easily restrict specific intranet sections, categories, and custom routes based on AD Group Membership (CN) or mapped WP Roles.
Strict Cascade Filtering: Restricting a category URL automatically hides all posts belonging to that category, even if the post’s permalink does not match the restricted URL path.
JIT Provisioning & Single Source of Truth: Automatic user creation on first successful AD bind, with strict role sync on every login.
LDAP Clone Protection: Detects and prevents authentication if multiple accounts match the same SAMAccountName across refined Base DNs.

Cwestiynau Cyffredin

Does this plugin require the PHP LDAP extension?: Yes, your web server must have the php-ldap PHP module enabled to initiate connections with your Active Directory Domain Controllers.
How does the Intranet Blacklist mode work?: First, all guests must log in. By default, all pages, categories, and posts are accessible to logged-in users. When you add a URL path or category to the plugin settings and map it to an AD Group, that path becomes restricted. Only users belonging to the mapped AD group will be able to view or edit it. If a category is restricted, all posts inside it inherit this restriction automatically.

Adolygiadau

There are no reviews for this plugin.

Contributors & Developers

“Sanch MultiDomain LDAP Auth for Active Directory” is open source software. The following people have contributed to this plugin.

sanchshevchuk

Translate “Sanch MultiDomain LDAP Auth for Active Directory” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Cofnod Newid

1.1.9

Feature: Added visual Drag/Move (Up/Down) buttons to the mapping table to easily prioritize roles (Top-to-Bottom processing).
UI/UX: Clarified the instructions for URL Protection, explaining that empty URL fields are valid for Role-only assignment.

1.1.8

Feature: Implemented Strict Cascading ACL logic. Restricting access to a Category URL now automatically denies access to all posts belonging to that category across the frontend, REST API, and admin list tables.
Performance: Optimized cascading checks by executing a direct bulk SQL query against $wpdb->term_relationships during transient generation.

1.1.7

Critical Bugfix: Resolved an infinite recursion loop (PHP Fatal Error: Allowed memory size exhausted) triggered by get_terms executing within its own cache generation filter. Added strict DB cycle guards to prevent infinite loops in malformed page trees.
Critical Bugfix: Prevented a fatal crash during AD user login by migrating from class-dependent WP_Application_Passwords::delete_all_application_passwords() to safe, direct core meta deletion delete_user_meta().
Feature: Overhauled the UI settings to use multi-line Textareas for URL mapping inputs.

1.1.4

Performance: Introduced high-speed persistent Transient Caching for taxonomy term resolution.
Security: Secured individual taxonomy endpoints (/wp-json/wp/v2/categories/{id}) via dynamic rest_prepare_{$tax} filters.
Feature: Applied Safe Re-parenting logic to Categories and Tags (get_terms filter).
Feature: Transitioned ACL to Intranet Blacklist Mode. The site enforces mandatory login for all guests.
Feature: Added full support for exact query string matching (e.g., /?cat=6).
Feature: Introduced an internal Logging Engine and an Admin Dashboard Terminal.
Feature: Implemented Recursive Nested Groups Resolution for deep AD hierarchies.
Security: Blocked authentication bypass via the standard WordPress “Lost Password” mechanism and Application Passwords.
Security: Mitigated Log Forging (CRLF Injection) and fixed indirect metadata leaks in get_pages.

1.1.0

Feature: Added Universal REST API Safe Reparenting hook.
Security: Implemented “Ghost Folders” for the admin page list to maintain site hierarchy.

1.0.0

Initial release.