Single Sign-On (SSO) for WP Engine User Portal

The Single Sign-On (SSO) feature will allow customers to use their own identity provider (like Active Directory, Google, Okta, etc.) to authenticate and log in to WP Engine’s User Portal (my.wpengine.com). SSO will give you the ability to set up custom security rules for the User Portal based on your own internal processes and security practices.

---

About WP Engine SSO

WP Engine uses SAML 2.0 to provide SSO to corporate identity systems. When you log in to the WP Engine User Portal, you are first prompted for your email. Our systems then use this email to route authentication to your business’s identity system.

When you integrate through SAML, you can use the SAML app from your identity UI to push authentication from your company to WP Engine, so you are automatically logged in to WP Engine’s User Portal. Often this means you click a tile in your identity application to launch the WP Engine User Portal.

Once logged in to the User Portal, your users can additionally utilize WP Engine’s Seamless Login feature to access any WordPress® admin dashboards on your account that they have access to.¹

Add a New User with SSO

To add a new user using SSO for WP Engine, ensure you’ve added the user to the WP Engine User Portal as well as to your SAML application.

The email address on WP Engine must match the email in your identity system, and should use the domain for which SSO was enabled.

As long as these two requirements are met, the user will automatically be prompted to log in with SSO at my.wpengine.com and can log in remotely from your identity app.

Limitations

• SSO for WP Engine only supports the login process for accessing the WP Engine User Portal. This feature does not support SFTP, SSH, or API credentials.
• At this time, we do not support SCIM, Just in Time (JIT) user provisioning, or group integrations.
• Only one identity provider may be configured per account. Multiple domain configurations may be tied to a single account, only in the case where there is one identity provider.
• We require email, first name, and last name attributes, and can optionally configure a mobile phone attribute to map through SAML. We do not map group attributes.
• If you have configured multi-factor authentication (MFA) for your WP Engine account you will no longer see that verification requested after SSO is enabled. If your identity provider requires MFA users will see verification prompts as dictated by your corporate identity provider when logging in.
• Only one email domain per account can have SSO configured. Multi-domain configurations are not supported. If you require this configuration, please reach out to Support.

---

Before Starting

SSO for the User Portal can only be configured by the owner of the account. To see if you have the self-serve option available:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Click Single Sign-On

If the Single Sign-On page is available, please skip to the SSO configuration steps.

If you do not see the Single Sign-on option, please contact Support to have this feature enabled or reach out to an Owner on the account.

SSO Enablement Request

If you do not have the SSO Page enabled in your User Portal, or if you need to configure SSO for multiple email domains on a single account, please reach out to the WP Engine Support team to have this feature enabled. Support will get your request to the appropriate team internally to have SSO enabled for your domain. Please provide the following information with your request:

• Domain name(s) attached to your email addresses.
  • EX: If your email is [email protected] we would need to know somedomain.com
• The name and email of an initial test user.
  • We will use this address to allow you to test logging in prior to enabling SSO for the entire domain.
• Contact emails of the people doing the SSO setup for your domain.
  • At least one of these should have admin access to your identity management system.
• Support PIN for an Owner of the WP Engine plan.
  • The Owner user’s email must use the same domain for which we’re enabling SSO.

---

Configure SSO

Setting up single sign-on for a domain is restricted to Owner level users. If you have multiple WP Engine accounts for your business then we suggest configuring SSO on the primary account.

Before You Begin

You will need access to the DNS records for the domain that SSO will be configured for.

Additionally, this automated process will walk you through connecting the WP Engine SSO feature to your identity app. Below are the configuration guides for the most common identity providers:

• AD FS – Configure a SAML 2.0 provider with Active Directory Federation Services
• Azure – Set up your Azure AD subscription, which is included with Microsoft 365
• OneLogin – Learn how to add a custom SAML app to OneLogin
• Okta – Configure an SSO integration with Okta
• Google SSO – Set up SSO via a third party SSO provider

If you do not see your identity provider here, please reach out to WP Engine Support.

Configuration Steps

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Click Setup SSO for a new domain

6. Enter email domain name
   • This is not necessarily the domain of the website, it’s the domain of the email addresses.
   • For example, if your business email addresses look like [email protected] we would need somedomain.com entered here.
7. Select a WP Engine account
   • This ties the SSO configuration to a given account. Any Owner on this account can view and edit these settings.
8. Click Next
9. The TXT and Value for a DNS record are provided on this page. Log in to your DNS host for the domain and add the TXT record for validation.

Your TXT verification record should look similar to the following:

10. Click Next
    • There will be an error message at the top of this page until the DNS record has been validated. Record propagation may take some time, depending on your DNS host.
11. When the DNS record has been validated, the SAML app details will appear. Enter these into your SAML app where requested.
    • App name
    • Description
    • WP Engine app logo downloads
    • WP Engine metadata
    • ACS URL and recipient
    • Audience URL
12. Click Next
13. Integrate SAML:
    • Upload the XML metadata file supplied by your identity provider, or input the metadata manually using copy and paste
14. Click Next
15. Test SSO:
    • Enter an email address to test with
    • We suggest using a user account other than the one you are logged in with while configuring SSO, and that uses the same domain as the email addresses you wish to enable. This is to prevent the possibility of being locked out if there’s an issue with the configuration. You can use this guide to add a new user to WP Engine. For example, I’m logged into the User Portal configuring SSO with [email protected], but I will test with [email protected].
    • Additionally, take note of your support PIN, located in the lower left-hand side of the screen, next to the key icon. This will be required if you need to contact Support with any issues.
16. Test signing in to the WP Engine User Portal using the designated test email
    • We suggest trying to log in with the test user through a separate incognito browser window. That way you can stay logged in with your normal user account in the original session in case there’s an issue.
17. Test launching the WP Engine User Portal from your identity system
18. Once satisfied, return to the SSO Configuration page of the User Portal and click Next
19. Go live:
    • Be sure to notify your users about the new authentication flow and assign the application to required users in your identity system before going live.
    • After going live with SSO, MFA for SSO users will be handled by your Identity Provider (IdP). WP Engine will not prompt SSO users for MFA.
    • This will impact all users who have an email at this domain and force them through your corporate identity provider for authentication.
    • Finally, as a contingency for any unforeseen SSO issues or IdP outages, we recommend adding a user to the account as an Owner that doesn’t use the SSO email domain.
20. Click Go live
21. (Optional) Add SSO Exceptions: Learn more here

Now, any user that attempts to log in to the WP Engine User Portal with an email address belonging to the SSO-configured domain will be redirected to your identity provider, then redirected back to the User Portal once authenticated.

---

Delete SSO Configuration

SSO can be disabled either by deactivation (temporary) or deletion (permanent). To delete your SSO configuration, it must first be deactivated. Only account owners where the configuration was created can deactivate and delete SSO.

Deactivate SSO

Deactivating SSO will temporarily stop redirecting all email domain users to your identity provider’s log in. The SSO configuration must be reactivated to begin functioning again. To delete your SSO configuration, you must first deactivate the configuration.

To deactivate SSO:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Deactivate

Follow the prompts to complete SSO deactivation.

Reactivate SSO

Reactivating the SSO configuration will begin forwarding email domain users to your identity provider for login to access the WP Engine User Portal.

To enable SSO again after deactivating the configuration:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Go Live

Delete SSO

Deleting the SSO configuration can only be done after deactivation, and will delete your SSO configuration from WP Engine. Email domain users will no longer log in to the WP Engine User Portal with your identity provider. Once a configuration is deleted, it cannot be restored. If necessary, it should be created again as a new configuration.

To delete an SSO configuration:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Delete

Follow the prompts to complete SSO configuration deletion.

---

Manage Metadata

Once saved to the WP Engine User Portal, SSO configuration metadata can be downloaded at any time. Only account owners where the configuration was created can access SSO metadata.

Download Metadata

Downloading metadata will allow you to export the current SSO configuration as an XML file. Only the current metadata can be downloaded, previous settings are not available for download.

To download SSO metadata:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Download metadata

---

SSO Exceptions

Exceptions allow you to have an email address within the SSO-configured domain that does not have the SSO configuration applied. SSO exceptions will not redirect to your identity provider for login, and can be used as a backup should an SSO issue arise preventing access. Exception emails must share the email domain that you have configured SSO for and must exist as a user on the account. Multiple exceptions can be added. Exceptions can only be added to SSO configurations that are currently live.

Add Exception

To add an email exception to an SSO configuration:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the live SSO email domain and click the 3 dot menu icon to the right
5. Click Manage exceptions

7. Add the exception email(s) to the exception field
8. Click Save to activate the exception(s)

Remove Exception

To delete an exception from an SSO configuration:

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Manage exceptions

7. Locate the email address under Exception email addresses
8. Delete it from the exceptions list by clicking x
9. Click Save to apply any changes

---

Troubleshooting SSO

Once SSO is enabled for a domain, WP Engine no longer owns any User Portal credentials for the attached email addresses. For this reason, what we’re able to assist with is limited, and any issues may need to be taken to the identity provider directly.

Some important points to note:

• Users must be added to the WP Engine User Portal. Learn about managing WP Engine users here.
• Users must be added to the corporate identity system.
• Users must be assigned to the SAML application in your identity system.

WP Engine WP Engine Support can confirm if an email address has been added to the User Portal. For security reasons, our team cannot add any user on your behalf.

Refer to SSO Limitations above for additional information.

Okta Lock Out

Users may get locked out from Okta if the incorrect credentials are entered too many times. If this occurs you must wait 24 hours before trying again.

---

Updating your SSO certificate

To update your SSO certificate you simply have to deactivate SSO for the email domain and then go through the configuration stepper again to add the new cert. Deactivating won’t remove your configuration details, so you won’t have to fully reconfigure your SSO.

1. Log in to the User Portal
2. Expand Users in the lefthand menu
3. Select Single Sign-On
4. Locate the SSO email domain and click the 3 dot menu icon to the right
5. Click Deactivate
6. Once the configuration is deactivated, click Continue to step through the SSO configuration
7. When you reach the certificate configuration step, upload your new certificate
8. Proceed to the end of the SSO configuration stepper and go live

---

Setup Instructions by Provider

Below are setup instructions for the top identity providers we see used. Be aware that because these identity providers are third party, the interface may be different than the one shown below, but the settings should remain the same.

• Active Directory Federation Services
• Azure Active Directory
• Google Single Sign-on
• Okta SSO
• OneLogin SSO

---

Multi-Domain SSO

Configuring SSO for multiple domains on a single account cannot currently be configured through the User Portal, and requires Support assistance to finalize the set up. If you need to configure SSO for multiple email domains on a single account, please take the following actions, and then reach out to the WP Engine Support team to have them complete this process.

1. Complete the setup of your first domain through the User Portal using the steps above.
   • This includes going live with the configuration.
2. Click the three dot menu on your live SSO configuration and choose “Add Domain”. This will display the TXT records to be used to verify ownership for your additional domains.
3. Add the TXT record entry in your DNS provider for all of the domains that you want to configure SSO for.
4. Contact WP Engine Support to request multi-domain SSO setup.
   • Include the list of the additional domains you want to configure.

---

NEXT STEP: Enable seamless login to WordPress