# WordPress

> Protect WordPress admin access with Ironchip over SAML using the WP SAML Auth or miniOrange plugins: metadata, certificate and testing.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/wordpress/

Ironchip integrates with WordPress over SAML to protect the admin panel. Two plugins are available: **WP SAML Auth** and **miniOrange**. Choose one and follow its section.

## Requirements

- Access to the Ironchip admin console.
- Access to WordPress with administrator permissions.

## With the WP SAML Auth plugin

With this plugin, WordPress acts as the service provider (SP) and Ironchip as the identity provider (IdP).

### Configure WordPress (SP)

With the plugin already installed, first generate the metadata you will give to the application you will create in Ironchip.

1. In the WordPress left menu, go to **Settings** > **WP SAML Auth**.
2. Go to the **Service Provider Settings** section and copy the **Entity ID** and **Assertion Consumer Service** values.
3. Generate the metadata with an online tool, for example [samltool.com](https://www.samltool.com/).
4. Upload the generated metadata to a public server and copy the link. This guide uses pastebin.com.

### Configure Ironchip

1. In the Ironchip admin console, create a **SAML** application.
2. In **Metadata URL**, paste the link to the WordPress metadata.
3. Before clicking **Next**, download the Ironchip metadata with **Download metadata file**.

### Configure the identity provider in WordPress (IdP)

1. Go back to WordPress, to the same **Settings** > **WP SAML Auth** section, and configure **Identity Provider Settings** with the metadata file you just downloaded.
2. For the certificate, copy the certificate from the Ironchip metadata and format it with a tool such as [samltool.com's Format X.509 Certificate](https://www.samltool.com/format_x509cert.php). The result starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`.
3. Copy the formatted content and create a certificate file with a `.crt` extension. Save it in a WordPress folder.
4. Copy the path of that certificate into **x509 Certificate Path**.
5. Set the `user_login` attribute to this value so the communication works: `urn:oid:0.9.2342.19200300.100.1.1`.

## With the miniOrange plugin

### Configure WordPress

1. Install the miniOrange plugin. When it finishes, the plugin appears in the right column so you can configure it.
2. In the first tab, the plugin asks you to configure the IdP. You can do it manually or automatically. To get the metadata, create a **SAML** application in Ironchip.

   [Image: New application button in the Ironchip admin console]

   [Image: New SAML application form with the Metadata URL field and the Download metadata file button]

3. Download the Ironchip metadata with **Download metadata file** and import it into WordPress.

### Configure Ironchip

1. Add the plugin metadata to the Ironchip application. To do so, open the plugin metadata file and copy its content.
2. Upload that content to a web service that lets you share text publicly. This guide uses pastebin.com.
3. Copy the resulting URL and add it as the **Metadata URL** in the Ironchip SAML application.

## Verify the integration

Before you test, give the user you will sign in with access to the Ironchip application. The steps are in [Add users to the service](https://docs.ironchip.com/en/identidad/protocolos/saml/#grant-access-to-users-and-groups).

- **WP SAML Auth**: sign out of WordPress and start a new sign-in with SAML. WordPress redirects you to Ironchip to authenticate and then returns you to the admin panel.
- **miniOrange**: go back to **Service Provider Setup** in WordPress and click **Test Configuration** to test sign-in with Ironchip.

## Troubleshooting

| Problem                               | Likely cause                                                  | Solution                                                                                                                                                    |
| ------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| WordPress rejects the certificate     | The certificate has no format or header                       | Format it with [samltool.com](https://www.samltool.com/format_x509cert.php), check that it starts with `-----BEGIN CERTIFICATE-----`, and save it as `.crt` |
| WordPress does not recognize the user | The `user_login` attribute does not match what Ironchip sends | Use `urn:oid:0.9.2342.19200300.100.1.1`, the username that Ironchip sends (see the [SAML attributes](https://docs.ironchip.com/en/identidad/protocolos/saml/))                       |
| Ironchip cannot read the metadata     | The metadata URL is not public                                | Check that the URL opens without signing in and returns only the XML                                                                                        |