![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changeset 3762828
- Timestamp:
- 10/24/2026 07:05:18 AM (6 hours ago)
- Location:
- ah-jwt-auth
- Files:
-
- 2 edited
-
tags/2.5.0/readme.txt (modified) (6 diffs)
-
trunk/readme.txt (modified) (6 diffs)
Legend:
- Unmodified
- Added
- Removed
-
ah-jwt-auth/tags/2.5.0/readme.txt
r3762826 r3762828 10 10 License URI: https://www.gnu.org/licenses/gpl-3.0.html 11 11 12 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained 13 in a HTTP Header. 12 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header. 14 13 15 14 == Description == 16 15 17 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained 18 in a HTTP Header that is added by a reverse proxy that sits in front of your 19 WordPress deployment. 16 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header that is added by a reverse proxy that sits in front of your WordPress deployment. 20 17 21 Authentication and optionally role assignment is handled by claims contained in 22 the JWT. 18 Authentication and optionally role assignment is handled by claims contained in the JWT. 23 19 24 If configured, the plugin also validates the JWT `aud` and `iss` claims against 25 the expected application audience and JWT issuer values. 20 If configured, the plugin also validates the JWT `aud` and `iss` claims against the expected application audience and JWT issuer values. 26 21 27 22 Verification of the JWT is handled by either: 28 23 29 * a shared secret for HS256 (as per RFC 7518 this must be at least 256-bits in 30 size) 24 * a shared secret for HS256 (as per RFC 7518 this must be at least 256-bits in size) 31 25 * a PEM encoded public key for RS256 32 26 * retrieving a JSON Web Key Set (JWKS) from a configured URL (also for RS256) 33 27 34 During the login process if the user does not exist an account will be created 35 with a matching role from the JWT, unless automatic user creation has been 36 disabled in the plugin settings. 28 During the login process if the user does not exist an account will be created with a matching role from the JWT, unless automatic user creation has been disabled in the plugin settings. 37 29 38 If the JWT did not contain a role claim then user is created with the role set 39 in the plugin settings (by default this is the subscriber role). 30 If the JWT did not contain a role claim then user is created with the role set in the plugin settings (by default this is the subscriber role). 40 31 41 Automatic user creation is enabled by default for backwards compatibility. It 42 can be disabled when user provisioning should remain manual. 32 Automatic user creation is enabled by default for backwards compatibility. It can be disabled when user provisioning should remain manual. 43 33 44 34 == Frequently Asked Questions == … … 46 36 = What header is the JWT retrieved from? = 47 37 48 By default the plugin looks for the JWT in the `Authorization` header as 49 follows: 38 By default the plugin looks for the JWT in the `Authorization` header as follows: 50 39 51 40 Authorization: Bearer <JWT Here> 52 41 53 However the token may be retrieved from a configurable HTTP header, for example 54 to integrate with Cloudflare Access, which was the original target for this 55 plugin, you would configure the use of the `Cf-Access-Jwt-Assertion` header. 42 However the token may be retrieved from a configurable HTTP header, for example to integrate with Cloudflare Access, which was the original target for this plugin, you would configure the use of the `Cf-Access-Jwt-Assertion` header. 56 43 57 44 = What claims should the JWT contain? = … … 68 55 } 69 56 70 The `aud` and `iss` claims are only required when a JWT Audience and/or Issuer 71 value has been configured in the plugin settings, however as they are standard 72 JWT claims it is recommended to set these options to verify those claims exist 73 and are valid. 57 The `aud` and `iss` claims are only required when a JWT Audience and/or Issuer value has been configured in the plugin settings, however as they are standard JWT claims it is recommended to set these options to verify those claims exist and are valid. 74 58 75 59 = What signature algorithms are supported to verify the JWT? = … … 79 63 = What happens to my data if I deactivate or delete the plugin? = 80 64 81 Deactivating the plugin leaves its settings in place, so reactivating it picks 82 up where you left off. 65 Deactivating the plugin leaves its settings in place, so reactivating it picks up where you left off. 83 66 84 Deleting the plugin removes all of its settings, including the JWT private 85 secret, from every site in a multisite network. User accounts the plugin 86 created from JWTs are kept, as they belong to the site. 67 Deleting the plugin removes all of its settings, including the JWT private secret, from every site in a multisite network. User accounts the plugin created from JWTs are kept, as they belong to the site. 87 68 88 69 == Screenshots == 89 70 90 1. This example shows a configuration with a WordPress install behind 91 Cloudflare Access for SSO via JWT 71 1. This example shows a configuration with a WordPress install behind Cloudflare Access for SSO via JWT 92 72 93 73 == Changelog == … … 107 87 = 2.2.0 = 108 88 * Spelling fixes and hardening 109 * Add option to enforce JWT auth (ie "fail-closed") rather than falling 110 through to WordPress authentication. 89 * Add option to enforce JWT auth (ie "fail-closed") rather than falling through to WordPress authentication. 111 90 112 91 = 2.1.0 = … … 114 93 115 94 = 2.0.0 = 116 * **Breaking Change:** Any secrets that are less than 256-bits (32-characters) 117 in length will fail JWT HS256 verification 95 * **Breaking Change:** Any secrets that are less than 256-bits (32-characters) in length will fail JWT HS256 verification 118 96 119 97 = 1.6.0 = -
ah-jwt-auth/trunk/readme.txt
r3762826 r3762828 10 10 License URI: https://www.gnu.org/licenses/gpl-3.0.html 11 11 12 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained 13 in a HTTP Header. 12 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header. 14 13 15 14 == Description == 16 15 17 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained 18 in a HTTP Header that is added by a reverse proxy that sits in front of your 19 WordPress deployment. 16 This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header that is added by a reverse proxy that sits in front of your WordPress deployment. 20 17 21 Authentication and optionally role assignment is handled by claims contained in 22 the JWT. 18 Authentication and optionally role assignment is handled by claims contained in the JWT. 23 19 24 If configured, the plugin also validates the JWT `aud` and `iss` claims against 25 the expected application audience and JWT issuer values. 20 If configured, the plugin also validates the JWT `aud` and `iss` claims against the expected application audience and JWT issuer values. 26 21 27 22 Verification of the JWT is handled by either: 28 23 29 * a shared secret for HS256 (as per RFC 7518 this must be at least 256-bits in 30 size) 24 * a shared secret for HS256 (as per RFC 7518 this must be at least 256-bits in size) 31 25 * a PEM encoded public key for RS256 32 26 * retrieving a JSON Web Key Set (JWKS) from a configured URL (also for RS256) 33 27 34 During the login process if the user does not exist an account will be created 35 with a matching role from the JWT, unless automatic user creation has been 36 disabled in the plugin settings. 28 During the login process if the user does not exist an account will be created with a matching role from the JWT, unless automatic user creation has been disabled in the plugin settings. 37 29 38 If the JWT did not contain a role claim then user is created with the role set 39 in the plugin settings (by default this is the subscriber role). 30 If the JWT did not contain a role claim then user is created with the role set in the plugin settings (by default this is the subscriber role). 40 31 41 Automatic user creation is enabled by default for backwards compatibility. It 42 can be disabled when user provisioning should remain manual. 32 Automatic user creation is enabled by default for backwards compatibility. It can be disabled when user provisioning should remain manual. 43 33 44 34 == Frequently Asked Questions == … … 46 36 = What header is the JWT retrieved from? = 47 37 48 By default the plugin looks for the JWT in the `Authorization` header as 49 follows: 38 By default the plugin looks for the JWT in the `Authorization` header as follows: 50 39 51 40 Authorization: Bearer <JWT Here> 52 41 53 However the token may be retrieved from a configurable HTTP header, for example 54 to integrate with Cloudflare Access, which was the original target for this 55 plugin, you would configure the use of the `Cf-Access-Jwt-Assertion` header. 42 However the token may be retrieved from a configurable HTTP header, for example to integrate with Cloudflare Access, which was the original target for this plugin, you would configure the use of the `Cf-Access-Jwt-Assertion` header. 56 43 57 44 = What claims should the JWT contain? = … … 68 55 } 69 56 70 The `aud` and `iss` claims are only required when a JWT Audience and/or Issuer 71 value has been configured in the plugin settings, however as they are standard 72 JWT claims it is recommended to set these options to verify those claims exist 73 and are valid. 57 The `aud` and `iss` claims are only required when a JWT Audience and/or Issuer value has been configured in the plugin settings, however as they are standard JWT claims it is recommended to set these options to verify those claims exist and are valid. 74 58 75 59 = What signature algorithms are supported to verify the JWT? = … … 79 63 = What happens to my data if I deactivate or delete the plugin? = 80 64 81 Deactivating the plugin leaves its settings in place, so reactivating it picks 82 up where you left off. 65 Deactivating the plugin leaves its settings in place, so reactivating it picks up where you left off. 83 66 84 Deleting the plugin removes all of its settings, including the JWT private 85 secret, from every site in a multisite network. User accounts the plugin 86 created from JWTs are kept, as they belong to the site. 67 Deleting the plugin removes all of its settings, including the JWT private secret, from every site in a multisite network. User accounts the plugin created from JWTs are kept, as they belong to the site. 87 68 88 69 == Screenshots == 89 70 90 1. This example shows a configuration with a WordPress install behind 91 Cloudflare Access for SSO via JWT 71 1. This example shows a configuration with a WordPress install behind Cloudflare Access for SSO via JWT 92 72 93 73 == Changelog == … … 107 87 = 2.2.0 = 108 88 * Spelling fixes and hardening 109 * Add option to enforce JWT auth (ie "fail-closed") rather than falling 110 through to WordPress authentication. 89 * Add option to enforce JWT auth (ie "fail-closed") rather than falling through to WordPress authentication. 111 90 112 91 = 2.1.0 = … … 114 93 115 94 = 2.0.0 = 116 * **Breaking Change:** Any secrets that are less than 256-bits (32-characters) 117 in length will fail JWT HS256 verification 95 * **Breaking Change:** Any secrets that are less than 256-bits (32-characters) in length will fail JWT HS256 verification 118 96 119 97 = 1.6.0 =
Note:
See TracChangeset
for help on using the changeset viewer.
