Lana Passport - OAuth 2.0 Server for WordPress

By implementing OAuth 2.0 Server in a WordPress plugin, users can securely and easily authorize access to their data and resources, while maintaining control over their account credentials. Lana Passport also supports OpenID Connect.

The Single Sign On solution enables users to access multiple applications using a single set of login credentials.

Useful links for the Lana Passport:

Learn more about Lana Passport:

The Lana Passport plugin allows almost any type of software to connect to the WordPress authentication system with OAuth 2.0 protocol.

The Lana Single Sign On plugin with Lana Passport plugin provide that the user can log in to the WordPress client website via “Single Sign On” button which uses WordPress OAuth server authentication.

Lana Passport: https://lana-passport.com/

Demo: https://lana.solutions/lana-passport/wp-admin Username: demo Password: demo

Online Documentation: https://lana.solutions/documentation/lana-passport/

Tutorial Video: https://www.youtube.com/watch?v=a7JQE9j-q-Q

Case Study: https://lana.codes/case-study/oauth2-server-and-client-wordpress-plugin/

Lana Single Sign On plugin: https://wordpress.org/plugins/lana-sso/

Reporting a Vulnerability

Contact https://www.wordfence.com/threat-intel/vulnerabilities/submit

Policy https://lana.codes/vulnerability-disclosure-policy/

We take the security of our software very seriously. If you discover any security vulnerabilities within our project, please report them through Wordfence. To submit a vulnerability report for Lana Passport, kindly complete the form available at https://www.wordfence.com/threat-intel/vulnerabilities/submit.

Depending on the nature of the vulnerability, you may be eligible for a bounty through the Wordfence Bug Bounty Program. The program’s scope eligibility can be reviewed here: https://www.wordfence.com/threat-intel/bug-bounty-program/#scope.

Changelog

Current version: 1.4.0

Version 1.4.0
- Add openid support
- Add userinfo endpoint
- Add well known endpoints
- Add server encryption keys storage method option
- Add server encryption key files use unique filename prefix option
- Add kid to client-specific encryption keys
- Add wp bcrypt hash check function
- Improve utc date functions
- Improve get query params in authorize rest api endpoint redirect
- Improve oauth2 server encryption jwt class
- Improve nullable type hint
- Improve wpdb prepare usage
- Security fix current user can edit user capability check in add and set jwt
- Bugfix redirect uri sanitize, handle multiple redirect uri
- Bugfix expires date, handle past and future dates
- Bugfix client-specific encryption keys upload
- Bugfix get server encryption key files paths, normalize path
- Bugfix access token lifetime default value
- Bugfix authorization allow add scopes, array unique
- Bugfix server encryption keys upload, remove the incorrect escape and sanitize, add public and private key format check, add is uploaded file check
- Bugfix jwt revoke action jti delete query
- Bugfix jwt public key upload, remove the incorrect escape and sanitize, add public key format check, add is uploaded file check
- Bugfix get scope in create user personal access token, array filter
- Bugfix grant types post meta empty update
- Bugfix scope post meta empty update
- Bugfix resource rest api endpoint access_token arg, not required
- Bugfix redirect_uri urldecode in oauth2 server authorize controller class validate authorize request method
- Bugfix redirect_uri urldecode in oauth2 server authorize code grant type class validate token request method
- Bugfix xml format in oauth response class
- Bugfix jwt bearer audience
- Bugfix array slice function in addon plugins list table
- Bugfix admin js missing proxy function usage
- Bugfix admin js proxy event function return
- Remove hash encryption algorithms
- Remove emoji style from authorize
- Fix textdomain load
- Fix translation functions missing domain

Version 1.3.0
- Fix save lana passport post author in multisite
- Add lana passport post type args filter

Version 1.2.3
- Fix hash_equals usage

Version 1.2.2
- Bugfix html attributes in settings page
- Improve description text

Version 1.2.1
- Bugfix settings url in plugin action links
- Reformat code

Version 1.2.0
- Improve encrypt 
- Improve random token generator

Version 1.1.0
- Bugfix get http api url
- Added the option to store the client secret hashed
- Added the option to check the protective status of encryption keys
- Added toastr for notifications
- Improve client edit method
- Improve CSS

Version 1.0.0
 - Added Lana Passport