Support for WordPress Multisite WPMU

Before you start

Choose a WordPress Multisite Mode

Network administrators now must choose one of two possible configurations:

• Shared All subsites in the network share the same Azure AD App registration. When a user successfully signs in with Microsoft, they are always redirected back to the network's main site, though they don't need to be added as a user there. Once the plugin processes Microsoft's authentication response, it will redirect the user to the URL they initially requested, whether it's the main site or one of the WPMU network subsites.
• Dedicated Each subsite in the network operates independently and must be configured separately. While you can use a single Azure AD App registration, you must add each site's URL as a Redirect URI. If a subsite isn't configured, SSO or other functionality will simply not be enabled. Mainly if you’d need to isolate each site in the network for reasons of security, if you need support for mapped domains, or if you wish to configure different role-assignment rules you should choose the dedicated mode.

Switching between WPMU mode is very easy. Simply go to My Sites > Network Admin > WPO365 > User Registration, scroll down to the section New User Experience (WordPress Multisite) and operate the toggle, as shown below.

Also note that prior to WPO365 | LOGIN version 35.0, administrators needed to configure the WPMU mode by adding the following line to the site's wp-config.php file.

define( 'WPO_MU_USE_SUBSITE_OPTIONS', true );

Whilst this configuration is still supported, it's now recommend to remove that line and instead operate the toggle on the plugin's User Registration configuration page.

Creating new users / adding members to a blog

The plugin treats new users / existing users differently, depending on the aforementioned Multisite Mode and additional  WPO365 configuration(s). The following table should help to understand the options available to you.

Considerations Shared Mode with subdomain installations

When you configure shared mode and set up WordPress Multisite to run on subdomains, each subsite will have a unique URL, such as subsiteA.your-wpmu.site and subsiteB.your-wpmu.site. This is important because WPO365 will authenticate each user in the context of the network's main site, which might be www.your-wpmu.site in this example. Without additional configuration, WPO365 will sign the user into WordPress and set a cookie valid only for the main domain: www.your-wpmu.site. Consequently, a user trying to access subsiteA.your-wpmu.site won't be able to reach the admin dashboard due to the cookie's domain restriction. To resolve this, you may need to add the following line to your site's wp-config.php, just above the line that reads /* That's all, stop editing! Happy publishing. */

define( 'COOKIE_DOMAIN', '.your-wpmu.site' );

Please note that '.your-wpmu.site' is used as an example, and you should replace it with your own URL. The period ('.') before the domain acts as a wildcard, instructing WordPress to set a cookie valid for all subdomains, even though this is generally not required anymore.

Recommended configuration Dedicated Mode

When you configure the dedicated scenario you must configure the WPO365 | LOGIN plugin and its single sign-on separately for a subsite by navigating to each subsite's WP Admin (Dashboard) and then click  WPO365 from the main admin menu on the left. However, you can define a default configuration when you navigate to  WP Admin > My Sites > Network Admin > WPO365. 

Perform the following steps to create a local copy of the default (central) configuration for the current subsite.

• Go to WP Admin > WPO365 > ... > Import / Export for the subsite in question.
• Locate the line Copy central WPO365 configuration (WordPress multisite) and click Copy options. Please note that this is a destructive action and will replace the existing configuration of the subsite in question.
• The Copy options will automatically replace the Redirect URI options in a configuration with the subsite's home URL address. But you must still manually add that URL to list of Redirect URIs on the App registration's Authentication page in Azure AD (also see the comment immediately beneath the table below).

If you set up WordPress Multisite to run on subdomains, you may need to add the following line to your site's wp-config.php, just above the line that reads  /* That's all, stop editing! Happy publishing. */ Adding this line may help to ensure that WordPress's authentication cookie is really limited to the one site that the user logged in to.

define( 'COOKIE_DOMAIN', $_SERVER[ 'HTTP_HOST' ] );

Single sign-on