Skip to content

Commit 1c55298

Browse files
jamesmorrisonjamesmorrison
committed
Initial public release.
0 parents  commit 1c55298

File tree

11 files changed

+813
-0
lines changed

11 files changed

+813
-0
lines changed

‎.editorconfig‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
insert_final_newline = true
7+
trim_trailing_whitespace = true
8+
indent_style = tab
9+
10+
[{*.json,*.yml,.babelrc,.bowerrc,.browserslistrc,.postcssrc}]
11+
indent_style = space
12+
indent_size = 2
13+
14+
[*.txt,wp-config-sample.php]
15+
end_of_line = crlf

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/vendor

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file, per [the Keep a Changelog standard](http://keepachangelog.com/), and will adhere to [Semantic Versioning](http://semver.org/).
4+
5+
## [0.1.0] - 2023-02-27
6+
- Initial private release! 🎉

‎CREDITS.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Credits
2+
3+
The following acknowledges the Maintainers for this repository, those who have Contributed to this repository (via bug reports, code, design, ideas, project management, translation, testing, etc.), and any Libraries utilized.
4+
5+
## Maintainers
6+
7+
The following individuals are responsible for curating the list of issues, responding to pull requests, and ensuring regular releases happen:
8+
9+
[James Morrison (@jamesmorrison)](https://github.com/jamesmorrison)
10+
11+
## Contributors
12+
13+
Thank you to all the people who have already contributed to this repository via bug reports, code, design, ideas, project management, translation, testing, etc.
14+
15+
## Libraries
16+
17+
The following software libraries are utilized in this repository:
18+
- N/A

‎LICENSE.md‎

Lines changed: 339 additions & 0 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Cloudflare Access SSO for WordPress
2+
3+
Cloudflare Access SSO (Single Sign On) is a plugin to facilitate auto-login to WordPress. The plugin relies on authorisation by Cloudflare, so it's important that you follow this setup guide carefully to ensure your site remains secure. For further guidance, refer to [Cloudflare Documentation: Add Site to Cloudflare](https://developers.cloudflare.com/fundamentals/get-started/setup/add-site/).
4+
5+
> Note: If you don't currently use Cloudflare and don't plan to, this plugin probably isn't suitable for your site.
6+
7+
### Cloudflare Access Setup
8+
9+
In order to use Cloudflare Access for SSO, you must create an application that covers `wp-login.php` on the site you wish to protect. No other URLs are required to be protected for this to function, but for better security you may wish to include others. Note that (as of 27th February, 2023) it is not possible to define more than one path in a single application; for now multiple applications are required if you additionally wish to protect `/wp-admin`.
10+
11+
Follow this guide to create a [Cloudflare Access Application: Self Hosted Applications](https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-apps/)
12+
13+
### Plugin Configuration
14+
15+
Two constants are required to be set in `wp-config.php` (note: a settings page will be added in a future release):
16+
17+
`CF_ACCESS_TEAM_NAME` The Cloudflare Access Team Name
18+
To get the Team Name:
19+
- Open the Zero Trust Dashboard (see above)
20+
- Navigate to "Settings" in the left sidebar menu, then click "General Settings"
21+
- Edit the Team domain - the editable component is the Team Name (ignore `.cloudflareaccess.com` that follows)
22+
- e.g. if the value once saved is `mysite.cloudflareaccess.com`, the Team Name is `mysite`.
23+
24+
Example for `wp-config.php`: `define( 'CF_ACCESS_TEAM_NAME', 'mysite' );`
25+
26+
`CF_ACCESS_AUD` The Application Audience (AUD) Tag for the Cloudflare Access application
27+
To get the Application Audience (AUD) Tag
28+
- Open the Zero Trust Dashboard (see above)
29+
- Navigate to Access => Applications
30+
- Select the Application, then click "Configure" in the overlaid modal
31+
- On the application page, navigate to the "Overview" tab
32+
- Copy the "Application Audience (AUD) Tag" value
33+
34+
Example for `wp-config.php`: `define( 'CF_ACCESS_AUD', '12345-67890-12345-67890-12345-67890' );`
35+
36+
> Note: If you have multiple Cloudflare Access Applications, ensure the AUD covers `wp-login.php` - if it doesn't, SSO will not function correctly.
37+
38+
Optionally, two additional constants can also be set:
39+
40+
`CF_ACCESS_ATTEMPTS` The number of attempts to login via Cloudflare Access.
41+
42+
Default: (int) `3` if not set.
43+
44+
`CF_ACCESS_LEEWAY` The number of seconds leeway allowed in the authorisation headers.
45+
46+
Default (int) `60` if not set.
47+
48+
> **Note:** Where the application is not configured correctly (authorisation header is not set, or the team name / AUD are incorrect), SSO is silently disabled. You can check the cookies section of inspector tools to confirm whether the cookie has been set.
49+
50+
### Disclaimer
51+
This plugin is not affiliated with nor developed by Cloudflare. All trademarks, service marks and company names are the property of their respective owners.

‎SECURITY.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
- The latest version released (irrespective of the release date)
6+
- Any release in the past three months
7+
8+
## Reporting a Vulnerability
9+
10+
To report a suspected security vulnerability, please email **[plugins@morrison.uk](mailto:plugins@morrison.uk)** with a description of the issue, the steps taken to reproduce the issue, the affected version(s) and if known, potential migitation options for the issue.
11+
12+
You will receive a response within 48 hours. If the issue is confirmed, a patch will be released as soon as possible depending on complexity but typically within a few days. Your discretion whilst this issue is investigated is appreciated.

‎cloudflare-access-sso.php‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<?php
2+
/**
3+
* Coudflare Access SSO
4+
*
5+
* @package CloudflareAccessSSO
6+
* @link https://github.com/jamesmorrison/cloudflare-access-sso
7+
* @author James Morrison
8+
* @copyright James Morrison 2023
9+
* @license GPL v2 or later
10+
*
11+
* Plugin Name: Cloudflare Access SSO
12+
* Description: Facilitates automatic login to WordPress when domain is protected with Cloudflare Access
13+
* Version: 0.1.0
14+
* Plugin URI: https://github.com/jamesmorrison/cloudflare-access-sso
15+
* Author: James Morrison
16+
* Author URI: https://jamesmorrison.uk/
17+
* Text Domain: cloudflare-access-sso
18+
* Domain Path: /languages/
19+
*
20+
* This program is free software; you can redistribute it and/or modify
21+
* it under the terms of the GNU General Public License as published by
22+
* the Free Software Foundation; either version 2 of the License, or
23+
* (at your option) any later version.
24+
*
25+
* This program is distributed in the hope that it will be useful,
26+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
27+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
28+
* GNU General Public License for more details.
29+
**/
30+
31+
// Security check
32+
defined( 'ABSPATH' ) || exit;
33+
34+
// The Cloudflare Team Name is required.
35+
if ( ! defined( 'CF_ACCESS_TEAM_NAME' ) ) {
36+
error_log( 'Cloudflare Access SSO Error: CF_ACCESS_TEAM_NAME is not defined.' ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
37+
return;
38+
}
39+
40+
// The Cloudflare Application ID is required.
41+
if ( ! defined( 'CF_ACCESS_AUD' ) ) {
42+
error_log( 'Cloudflare Access SSO Error: CF_ACCESS_AUD is not defined.' ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
43+
return;
44+
}
45+
46+
// Default to not enforcing SSO (which redirects wp-login => wp-admin)
47+
if ( ! defined( 'CF_ACCESS_ENFORCE_SSO' ) ) {
48+
define( 'CF_ACCESS_ENFORCE_SSO', false );
49+
}
50+
51+
// Default to 3 attempts to complete authentication
52+
if ( ! defined( 'CF_ACCESS_ATTEMPTS' ) ) {
53+
define( 'CF_ACCESS_ATTEMPTS', 3 );
54+
}
55+
56+
// Default to 60 second leeway
57+
if ( ! defined( 'CF_ACCESS_LEEWAY' ) ) {
58+
define( 'CF_ACCESS_LEEWAY', 60 );
59+
}
60+
61+
62+
// Useful global constants.
63+
define( 'CLOUDFLARE_ACCESS_SSO_PLUGIN_VERSION', '0.1.0' );
64+
define( 'CLOUDFLARE_ACCESS_SSO_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
65+
define( 'CLOUDFLARE_ACCESS_SSO_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
66+
define( 'CLOUDFLARE_ACCESS_SSO_PLUGIN_INC', CLOUDFLARE_ACCESS_SSO_PLUGIN_PATH . 'includes/' );
67+
68+
// Require Composer autoloader if it exists.
69+
if ( file_exists( CLOUDFLARE_ACCESS_SSO_PLUGIN_PATH . 'vendor/autoload.php' ) ) {
70+
require_once CLOUDFLARE_ACCESS_SSO_PLUGIN_PATH . 'vendor/autoload.php';
71+
}
72+
73+
// Include files.
74+
require_once CLOUDFLARE_ACCESS_SSO_PLUGIN_INC . '/core.php';
75+
76+
// Activation/Deactivation.
77+
register_activation_hook( __FILE__, '\CloudflareAccessSSO\Core\activate' );
78+
register_deactivation_hook( __FILE__, '\CloudflareAccessSSO\Core\deactivate' );
79+
80+
// Bootstrap.
81+
CloudflareAccessSSO\Core\setup();

‎composer.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"name": "jamesmorrison/cloudflare-access-sso",
3+
"description": "Facilitates SSO login to WordPress via Cloudflare Access.",
4+
"version": "0.1.0",
5+
"type": "wordpress-plugin",
6+
"homepage": "https://james.morrison.uk/plugins/cloudflare-access-sso/",
7+
"readme": "./readme.md",
8+
"license": "GPL-2.0-or-later",
9+
"authors": [
10+
{
11+
"name": "James Morrison",
12+
"homepage": "https://james.morrison.uk",
13+
"role": "Developer"
14+
}
15+
],
16+
"support": {
17+
"source": "https://github.com/jamesmorrison/cloudflare-access-sso",
18+
"issues": "https://github.com/jamesmorrison/cloudflare-access-sso/issues",
19+
"docs": "https://github.com/jamesmorrison/cloudflare-access-sso/#readme"
20+
},
21+
"require": {
22+
"php": ">=8.0",
23+
"firebase/php-jwt": "^6.4"
24+
},
25+
"autoload": {
26+
"psr-4": {
27+
"CloudflareAccessSSO\\": "includes/classes/"
28+
}
29+
}
30+
}

0 commit comments

Comments
 (0)