Anyone Using Another Identity Provider?
One of my plans is to ditch WordPress wp-login.php and go with another identity provider. I'm probably going with Firebase/Google Identity Platform and connecting with miniOrange Firebase Authenticator.
Has anyone else tried this and did you have any issues or problems? Migrating my community members is something I want to ensure I get done smoothly.
William, can you explain why you would want to do this?
Insta Net ✅ Security is my primary concern. Every day, my sites are slammed with bots and hackers trying to weasel their way past my login security. I use Cloudflare WAF rules to block the majority of them, but some still get to my site to try. Some of my plugins have occasionally had vulnerabilities that allow role escalation of subscriber accounts, etc.
I'd prefer to let them fight against Google's servers before they ever get to mine.
There is another case, also. One of my clients deals with HIPAA protected information. We're going to embed a Jotform input entry on a page and also a Looker Studio report on another page.
For HIPAA, we need to gate entry to these pages for only authenticated users. A page password is to general or vague. Using a Google identity provider with a BAA helps avoid a compliance issue.
The miniOrange Firebase plugin has a shortcode so we can put an authentication gate in front of these pages.
William Beem thanks for the breakdown.. always learning 🙂
William Beem and what about FluentAuth? Would that help with some site security against common bots/hackers..?
Insta Net ✅ FluentAuth is a good tool, but it still has the same problem that I want to remove - attackers get to my server & site before being repelled. I don't want bad actors that close to my site.
Now this doesn't mean it's impossible for someone to breach my security, but it eliminates a large percentage of attacks, particularly combined with the Cloudflare WAF rules.
Nuke 'em at the edge and don't waste your server cycles needlessly.
Following! Thank you for bringing this topic to the table.
Jorge de los Reyes I bring the meat. Who's bringing the drinks?
I'm using 'Login with Google' by rtcamp
https://wordpress.org/plugins/login-with-google/
Diego Maradona Thanks. I thought about it, but not everyone wants to sign in with Google. The Google identity Provider will accept various options, including email/password. That's important for me to transition existing users rather than tell them they must use Google to authenticate.
William Beem Nextend? What do you think?
https://wordpress.org/plugins/nextend-facebook-connect/
Diego Maradona It's a step, but the wp-login page is still there. For my needs, I don't want it there at all. I'll create a new sign-in page and nuke the wp-login as best I can.
I'm using Auth0 with a generic OpenID Connect plugin across a number of different websites, one of which is FluentCommunity. We do this as we manage an external database of users that we wanted to give access to multiple websites using the same login credentials. It all works easily enough! It matches user profiles between Auth0 and Wordpress based on their email address, and there is an option to auto-create WordPress users if they don't exist already during their first attempt at signing into FluentCommunity from our Auth0 login page. The only annoying thing I haven't spent any real time trying to fix yet, is that periodically a user will see the FC "Your session has expired. Please log in again" message and when they click refresh/login they're automatically logged in as the Auth0 logged in state is longer than the WordPress/FC logged in stage. As this isn't really an issue for users, I haven't gotten around to addressing it.
I've heard good things about miniOrange products. I would probably be using them if I could afford to, but as that wasn't in the budget, I had to find a free option instead. So far so good though!
Stuart McKelvie I'm also hoping to use the same credentials on my personal websites. That either requires a multi-tenant approach, which is something I'm trying to work out with the developer of Integrate Firebase. He currently doesn't support multi-tenant accounts, but he's willing to make some changes.
I looked briefly at Auth0, but something made me follow this approach. Probably the HIPAA issue since Google will pass out BAA's like candy to any level plan.
Following
I'm discussing the multi-tenant issues with Dale Nguyen, the developer of Integrate Firebase Pro, and also having another conversion with the miniOrange team. Both meetings on Friday. If I learn anything useful, I'll report back here.
I got an email from Dale Nguyen at techcater.com. He's already updated Integrate Firebase Pro to include multitenancy. We were scheduled to have a call tomorrow, but he had a trip to Asia that came up, so the call will wait. I was going to ask about pricing for more sites than his usual 1-3 sites.
For testing. he suggested that I get his Monthly plan to try it out and that's what I'll do this weekend. If anyone else was thinking about multitenancy to have multiple sites in one project, this is worth a look.
William Beem Hei
We are preparing to launch oauthpress.com, with unlimited clients, unlimited sites, and, is already integrated with FluentCRM too. and the best part... is free you can join the waitlist here: https://oauthpress.com (the beta will be released somewhere next week)
Denis - Emanuel Sandu Microsoft, Yahoo, LinkedIn?
Diego Maradona if someone request it, it doesn't take more than haft an hour to add it. But from what I saw, nobody is using those that much. So we focused on Google and more important, on login eithr own OAutServer you can create