PortalWeave SSO connects a site to administrator-configured OAuth 2.0 and OpenID Connect identity providers. Authorization Code with S256 PKCE is the default. Public clients can use PKCE without a client secret.

Configure multiple providers, attribute mappings and group/email-domain role policies with visual editors or advanced JSON.
Register users at first login or allow only existing accounts. Account linking requires explicit configuration and a verified, unique email.
Keep administrator SSO disabled by default; enable it per provider with a verified account claim.
Display login buttons using the login widget, [portalweave_sso_login] shortcode, WordPress login screen or WooCommerce login form.
Preview custom WordPress sign-in button styles and provider/custom icons independently of website buttons.
Restrict posts, pages, categories and media using login, role or group rules.
Visualize retained authentication activity over 7, 30 or 90 days, page through retained audit logs and export CSV reports. Debug logging, client IP collection and optional modules are administrator controlled.
Enable SCIM Users/Groups, JWT sign-in, temporary guest accounts, moderation, mapped pictures, attribute redirects or a short shared-subdomain handoff.
Use site/network settings, WP-CLI and eight optional administrator-only WordPress abilities.

All bundled functionality is available without a developer account, license key, paid upgrade or trial expiry. Optional module switches are configuration controls. Guest-account expiry is a site access policy, not a limit on plugin functionality. Identity providers may impose their own account, subscription or usage requirements.

SSO requires HTTPS and PHP OpenSSL. Client credentials and tokens are encrypted using this installation’s WordPress salts; keep those salts stable. Native abilities require WordPress 6.9+. External MCP clients also require the separately installed WordPress MCP Adapter. This plugin does not call an AI model service.

This is an independent plugin. Provider names describe integrations and do not imply endorsement or affiliation.

External services

The plugin has no developer-hosted authentication, tracking, licensing or update service. It sends no telemetry to its author and downloads no remote executable code. All plugin JavaScript and CSS are distributed locally.

Report a bug opens the GitHub issue tracker only when selected. No configuration or logs are attached automatically. GitHub receives the browser request and any information you submit. Privacy, terms.

Each service below is an optional identity provider used to sign users in and obtain the configured profile/group claims for local account and access decisions. No provider is contacted until an administrator configures it and its authentication flow runs. Preset setup and bundled logos work locally.

For every configured identity service below, sign-in sends the browser to its authorization endpoint with the client identifier, scopes, callback URL, random state/nonce and PKCE challenge. WordPress sends the returned authorization code, PKCE verifier and configured client authentication to that service’s token endpoint; it sends an access token when requesting profile or group data. Public signing-key requests send no user token. Explicit refresh sends the refresh token and client authentication. Configured logout sends the browser to that service with client ID, callback, state and an ID-token hint when available. An explicitly enabled legacy Password grant sends the entered username/password to that provider over HTTPS without retaining the password; the legacy Implicit grant returns tokens through the browser callback. These transfers happen only for the configured login, validation, refresh or logout operation. Tokens are never included in audit or support exports.

Preset service policy references:

Microsoft Entra ID / Azure AD, Azure AD B2C and Office 365: Microsoft hosts the configured tenant’s sign-in/token/key endpoints; Microsoft Graph can supply profile/group data. The identity transfers above apply to the selected tenant and B2C policy. Privacy, product terms.
Amazon Cognito: AWS hosts the configured regional user pool and authorization domain. The identity transfers above go to that pool’s endpoints, including any configured custom domain. Privacy, customer agreement, service terms.
Google identity services: privacy, API terms, user data policy.
Okta: privacy, agreements.
Auth0: privacy, legal resources.
Salesforce: privacy, customer agreements.
OneLogin: privacy, legal resources.
Discord: privacy, developer terms.
ClassLink: privacy, contact. Obtain the applicable school/organization license and service agreement from ClassLink.
Keycloak, authentik and custom providers: the administrator chooses the deployment, endpoint and applicable operator terms/privacy policy. Selecting a self-hosted preset does not contact the software project’s developer.

Optional mapped pictures and custom provider or WordPress sign-in icons are browser requests to the selected image hosts when displayed, including login pages and administrator previews. Hosts receive the visitor’s IP address and ordinary browser request information; sign-in icons use a no-referrer policy. Uploaded icons use the site’s media delivery service. Support email sends the administrator’s message through the site’s mail service to the chosen recipient only on explicit submission (or an explicit support-ability send request); redacted configuration is attached only when requested. Booking, forum and demo links open only when selected. The site operator must disclose these actual image, mail, support and link destinations and their policies.

Optional SCIM accepts incoming authenticated provisioning requests from the administrator’s chosen client and returns account/group data; it does not select or contact a vendor. Optional shared-subdomain SSO sends selected identity claims in a signed, unencrypted one-minute cookie to explicitly trusted sites, without OAuth tokens. Optional abilities return authorized configuration, diagnostics and audit data through the separately installed MCP Adapter to the chosen client; this plugin does not call an AI service. Disclose the actual provisioning, trusted-site and MCP/client operators’ terms and privacy policies before enabling them.

The external-services document is included in the ZIP. Its maintained source is available here. Site operators must publish the policies applicable to their configured providers. One Identity policy pages may restrict automated retrieval; confirm the applicable OneLogin agreement with your account contact. ClassLink’s privacy notice refers to school/organization license and service-level agreements supplied by ClassLink, rather than a universal public service contract.

Privacy and data retention

The plugin stores local identity links, mapped profile fields, group memberships and encrypted tokens. Authentication auditing can be disabled. When enabled, it retains username, email, provider, status, time and navigation path for the configured retention period (90 days by default). IP recording is a separate opt-in and defaults off. Debug records expire after seven days; local support drafts expire after one day. Scheduled cleanup requires working WordPress cron.

Login/logout state cookies last up to ten minutes. Optional JWT sign-in uses a five-minute challenge cookie; optional shared-subdomain sign-in uses a signed one-minute cookie containing selected identity attributes, not OAuth tokens. WordPress manages its normal login cookies.

Suggested privacy-policy text is available in the WordPress privacy tools. Personal-data exports include audit and linked profile information but exclude credentials. Erasure anonymizes audit data, removes local provider links/tokens/groups and known plugin-mapped custom fields, and revokes sessions. It preserves the WordPress account, roles, content, moderation/provisioning blocks and private files. Other multisite sites and external providers manage their own retained data. Later sign-in/provisioning may supply profile data again.

Deactivation preserves data. Uninstall preserves settings unless the administrator enables data removal. Even with removal enabled, WordPress accounts, content, public mapped profile values, private-media files and their recovery metadata are retained. Review docs/privacy.md and include the private vault in server backups. The plugin does not claim to provide or guarantee legal compliance.