Description
This plugin allows signing in users via JSON Web Token (JWT) in WordPress. It is used to allow users from another website/service/etc. to securely use their credentials for the WordPress site.
Sample use case: There is an existing user database (e.g. in an intranet environment) and the users should be able to login to an external site that is powered by wordpress, without having to remember another password. This mechanism is also called Single Sign On (SSO).
Please note that the user information and role mappings are updated each time the user logs in via SSO. If you do not want to sync the roles from your existing system to wordpress, you can disable the functionality via the settings page.
JWT Server
You will need to implement an endpoint on your website/app that has access to the logged
in user (via login form or Kerberos-like authentication etc). That endpoint needs to create
and sign a JWT with the HS256 algorithm and the below described information in the payload.
It then has to redirect the user back to the WordPress site https://example.org/?auth=jwt&code={jwt}
where {jwt} is the signed JWT as string representation.
{
“iat”: 1516239022,
“iss”: “issuer_name”,
“user_info”: {
“user_login”: “johndoe”,
“user_name”: “John Doe”,
“first_name”: “John”,
“last_name”: “Doe”,
“user_email”: “johndoe@example.org”,
“user_roles”: [“role1”]
}
}