wcs.samlauth
A SAML authentication plugin for Plone 6 that turns your Plone site into a Service Provider (SP).
Overview
wcs.samlauth is a SAML authentication plugin for Plone 6, enabling Plone sites to act as a Service Provider (SP) for SAML-based single sign-on. It simplifies SAML configuration using the high-level API of python3-saml, allowing administrators to integrate with identity providers like Azure AD and Keycloak without deep SAML expertise.
Key Features
- IDP Metadata Management — Fetch or upload Identity Provider metadata via a web interface.
- Multiple Plugin Support — Run multiple SAML plugins simultaneously on the same Plone site.
- Security Controls — Prevent redirect attacks with RelayState validation and allowed domain lists.
- User Data Synchronization — Automatically updates user email and full name from SAML assertions.
- Flexible Authentication — Supports SP-initiated login/logout and optional Plone user creation.
- Comprehensive Testing — Includes E2E tests with Keycloak and manual validation with Azure AD.
Philosophy
The plugin prioritizes ease of configuration, abstracting SAML complexities to make Plone integration straightforward while maintaining security and flexibility for diverse deployment scenarios.
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
