BePlus Login Sync

BePlus Login Sync helps trusted WordPress sites authenticate users between each other without Multisite and without sharing passwords.

It is designed for agencies, site owners, and administrators who manage multiple independent WordPress installs and want a clear trust model for cross-site login.

This plugin is a good fit when you want to:

• let users sign in from one trusted WordPress site to another
• keep each site independent instead of using Multisite
• map provider roles to local roles explicitly
• control which consumer sites are trusted
• review redacted diagnostics when something fails

This plugin is not a good fit when you need:

• password synchronization
• raw capability mirroring
• third-party app OAuth support
• cloud-hosted identity brokering
• WordPress Multisite as the main architecture

Key features in version 1.0.0:

• provider and consumer mode, or both on the same site
• provider discovery with metadata, public key, and JWKS endpoints
• RS256 token issuance and offline signature validation
• consumer connection discovery and trusted provider storage
• explicit role mapping per trusted provider connection
• profile synchronization for approved core identity fields only
• provider-side Allowed Sites management with enable, disable, edit, delete, and icon support
• admin toolbar launchers for enabled trusted provider connections
• optional logout synchronization for SSO-created sessions
• redacted diagnostics logging for connection, token, login, logout, and trust events

How it works:

1. Configure one site as a provider.
2. Configure another site as a consumer.
3. Discover the provider from the consumer and save the trusted connection.
4. Start SSO, validate the signed token, create or update the local user, and apply the mapped local role.

Security highlights:

• no password synchronization
• no shared-secret JWT signing
• no raw capability synchronization
• no automatic trust for arbitrary sites
• private keys remain local to the provider
• redirects are validated before cross-site navigation
• diagnostics are redacted to avoid storing sensitive secrets

This release completes the initial production-readiness roadmap for BePlus Login Sync and is intended for staged rollout on trusted WordPress environments.

Troubleshooting

Provider discovery fails

Check that the provider site is reachable from the consumer, permalinks are enabled, and the provider discovery endpoints are available. Also confirm security plugins, page cache, or server rules are not blocking REST requests.

SSO returns an invalid state or token error

Start a fresh SSO flow from the consumer and retry. These errors usually indicate an expired login attempt, a tampered callback, or a mismatch between the trusted provider configuration and the signed response.

The provider blocks the login request

Review Allowed Sites on the provider and confirm the consumer site is trusted and enabled. If the consumer is new, a provider administrator may need to approve the first login flow.

Logout synchronization does not happen

Confirm logout synchronization is enabled, the session was created through Login Sync, and the provider connection has a valid trusted logout endpoint.

A role looks wrong after login

Review the consumer Role Mapping screen and test again. The plugin does not mirror provider capabilities automatically, so unmapped roles will follow the fallback behavior.