This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of November 2, 2026. Spotted a mistake? Tell us.
WordPress does not ship with single sign-on. Out of the box, every user has a local WordPress password, and an organization with a central identity provider ends up maintaining a second set of accounts.
The fix is a plugin. WordPress has SSO plugins for SAML, OAuth and CAS; this guide uses wp-cassify and a CAS server, because CAS is simple to configure and Casdoor serves it out of the box. The same idea applies to an OIDC plugin if you prefer OpenID Connect.
CAS or OIDC?
- CAS is a mature single sign-on protocol. The client redirects to the CAS server, the user signs in, and CAS redirects back with a service ticket that the client validates. It is easy to reason about and widely supported by older systems.
- OIDC is the modern option. It returns an ID token and userinfo, and fits better if you also need APIs, mobile apps or newer integrations.
If your identity provider supports both, choose based on the plugin you trust, not on the protocol alone. Casdoor supports both.
Step 1: prepare the CAS application
In Casdoor, create or choose an application for WordPress. Note the organization name and application name; the CAS service URL includes both:
https://<casdoor-host>/cas/<organization>/<application>
The exact base URL depends on how Casdoor is deployed. If your Casdoor instance exposes CAS on a separate port, include that port. Check the application's CAS settings in the Casdoor console if the URL is not obvious.
Unlike OAuth, CAS does not use a client ID and secret for this integration. The WordPress plugin talks to the CAS endpoint directly.
Step 2: install wp-cassify
In WordPress, go to Plugins → Add New, search for wp-cassify, install it, and activate it. The settings page appears under Settings → WP-Cassify.
Step 3: configure the plugin
On the settings page, set:
| Setting | Value |
|---|---|
| CAS Server Base URL | https:// |
| Create user if not exist | Enabled, if you want first-time visitors to get a WordPress account automatically |
Then map the WordPress user fields to the attributes Casdoor sends:
| WordPress field | Casdoor attribute | Example |
|---|---|---|
| user_email | user@example.org | |
| display_name | displayName | John Doe |
| user_nickname | displayName | John Doe |
If the mapping is empty, WordPress may create a user with a blank display name or fail to match an existing account. Fill in at least the email and display name.
Step 4: test the login
Log out of WordPress, open the login page, and sign in. You should be redirected to Casdoor, sign in there, and land back in WordPress as the mapped user.
Test with a non-administrator account first. If the mapping is wrong, you do not want to discover it with the only administrator account.
Keep a local admin fallback
SSO is convenient, but it is also a single point of failure. Keep one local WordPress administrator with a strong password, and document how to use it if the identity provider is down. Do not let the SSO plugin become the only way into wp-admin.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Redirected to a 404 on the CAS URL | The organization or application name in the base URL is wrong, or CAS is not enabled for that application. |
| Login loops back to WordPress without a session | The CAS service ticket is not validating. Check the base URL and the server clock. |
| User is created with a blank name | The attribute mapping does not match the claims Casdoor sends. |
| Existing users get duplicate accounts | The email attribute is missing or different from the WordPress user's email. |
| Cannot log in as admin | The plugin redirected the admin login. Use the local fallback account or temporarily disable the plugin over FTP. |
| Mixed content or SSL errors | WordPress and Casdoor should both use HTTPS; a redirect from HTTPS to HTTP will break the flow. |
FAQ
Does WordPress support SAML? Not natively. SAML support comes from plugins. CAS and OIDC are usually simpler for a single WordPress site; SAML is common when an enterprise IdP mandates it.
Can I map WordPress roles from the identity provider? wp-cassify focuses on authentication and basic profile fields. Role mapping usually needs a separate plugin or a custom hook. Do not assume that an IdP group becomes a WordPress role automatically.
Can users still log in with a local password? Yes, unless you disable the local login form. Keeping a local administrator is recommended; disabling local login for everyone else is a policy decision, not a plugin requirement.
Is CAS secure over the public internet? CAS relies on TLS and on validating the service ticket. Use HTTPS on both sides, keep the servers' clocks synchronized, and restrict the CAS endpoint to the sites that need it.
If you want one identity provider that serves CAS to WordPress and OIDC/SAML to the rest of your systems, Casdoor supports all three. Casdoor Cloud starts at $6.67/month billed yearly for a dedicated instance. See the Casdoor WordPress guide for the exact settings.
Sources
- wp-cassify on WordPress.org
- Casdoor WordPress integration
- WordPress plugin installation
- CAS Protocol specification
Product names are trademarks of their respective owners.