Title: Sanch MultiDomain LDAP Auth for Active Directory Author: sanchshevchuk Published: August 1, 2026 Last modified: August 31, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/sanch-multidomain-ldap-auth.svg) # Sanch MultiDomain LDAP Auth for Active Directory By [sanchshevchuk](https://profiles.wordpress.org/sanchshevchuk/) [Download](https://downloads.wordpress.org/plugin/sanch-multidomain-ldap-auth.1.2.0.zip) * [Details](https://vec.wordpress.org/plugins/sanch-multidomain-ldap-auth/#description) * [Reviews](https://vec.wordpress.org/plugins/sanch-multidomain-ldap-auth/#reviews) * [Development](https://vec.wordpress.org/plugins/sanch-multidomain-ldap-auth/#developers) [Support](https://wordpress.org/support/plugin/sanch-multidomain-ldap-auth/) ## Description Sanch MultiDomain LDAP Auth for Active Directory provides enterprise-grade Single Sign-On (SSO) and access control for corporate WordPress intranets. Built for multi- forest environments, it allows users to authenticate seamlessly against multiple Domain Controllers while strictly enforcing path-based access policies and dynamic role propagation. #### Key Features * **Multi-Domain & Multi-DC Authentication:** Connect and authenticate against multiple LDAP/LDAPS servers across different Active Directory domains/UPN suffixes. * **Mandatory Intranet Login:** The site is strictly private. All guests are automatically redirected to the login screen. * **Blacklist Path-Based ACL:** Once logged in, content is accessible to all staff by default. Easily restrict specific intranet sections, categories, and custom routes based on AD Group Membership (CN) or mapped WP Roles. * **Strict Cascade Filtering:** Restricting a category URL automatically hides all posts belonging to that category, even if the post’s permalink does not match the restricted URL path. * **JIT Provisioning & Single Source of Truth:** Automatic user creation on first successful AD bind, with strict role sync on every login. * **LDAP Clone Protection:** Detects and prevents authentication if multiple accounts match the same SAMAccountName across refined Base DNs. ## FAQ ### Does this plugin require the PHP LDAP extension? Yes, your web server must have the `php-ldap` PHP module enabled to initiate connections with your Active Directory Domain Controllers. ### How does the Intranet Blacklist mode work? First, all guests must log in. By default, all pages, categories, and posts are accessible to logged-in users. When you add a URL path or category to the plugin settings and map it to an AD Group, that path becomes restricted. Only users belonging to the mapped AD group will be able to view or edit it. If a category is restricted, all posts inside it inherit this restriction automatically. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Sanch MultiDomain LDAP Auth for Active Directory” is open source software. The following people have contributed to this plugin. Contributors * [ sanchshevchuk ](https://profiles.wordpress.org/sanchshevchuk/) [Translate “Sanch MultiDomain LDAP Auth for Active Directory” into your language.](https://translate.wordpress.org/projects/wp-plugins/sanch-multidomain-ldap-auth) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/sanch-multidomain-ldap-auth/), check out the [SVN repository](https://plugins.svn.wordpress.org/sanch-multidomain-ldap-auth/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sanch-multidomain-ldap-auth/) by [RSS](https://plugins.trac.wordpress.org/log/sanch-multidomain-ldap-auth/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.0 * UI/UX: Restructured the Mapping Table. Moved the Up/Down sort buttons to the far left column to make priority ordering visually intuitive. * Security & UX Guard: Completely blocked the ability to restrict the site root path (`/`). The root page is now excluded from the URL dropdown selector. * Security Guard: Added dual-layer JavaScript and PHP backend validation. If a user manually types `/` in the restriction field, JS instantly strips it out on blur, and PHP firmly rejects and deletes it upon save with an admin warning to prevent catastrophic site-wide lockouts. * UI: Updated placeholders to emphasize selecting paths from the provided dropdown helper instead of manual entry. #### 1.1.9 * Feature: Added visual Drag/Move (Up/Down) buttons to the mapping table to easily prioritize roles (Top-to-Bottom processing). * UI/UX: Clarified the instructions for URL Protection, explaining that empty URL fields are valid for Role-only assignment. #### 1.1.8 * Feature: Implemented Strict Cascading ACL logic. Restricting access to a Category URL now automatically denies access to all posts belonging to that category across the frontend, REST API, and admin list tables. * Performance: Optimized cascading checks by executing a direct bulk SQL query against `$wpdb->term_relationships` during transient generation. #### 1.1.7 * Critical Bugfix: Resolved an infinite recursion loop (PHP Fatal Error: Allowed memory size exhausted) triggered by `get_terms` executing within its own cache generation filter. Added strict DB cycle guards to prevent infinite loops in malformed page trees. * Critical Bugfix: Prevented a fatal crash during AD user login by migrating from class-dependent `WP_Application_Passwords::delete_all_application_passwords()` to safe, direct core meta deletion `delete_user_meta()`. * Feature: Overhauled the UI settings to use multi-line Textareas for URL mapping inputs. #### 1.1.4 * Performance: Introduced high-speed persistent Transient Caching for taxonomy term resolution. * Security: Secured individual taxonomy endpoints (`/wp-json/wp/v2/categories/{ id}`) via dynamic `rest_prepare_{$tax}` filters. * Feature: Applied Safe Re-parenting logic to Categories and Tags (`get_terms` filter). * Feature: Transitioned ACL to Intranet Blacklist Mode. The site enforces mandatory login for all guests. * Feature: Added full support for exact query string matching (e.g., `/?cat=6`). * Feature: Introduced an internal Logging Engine and an Admin Dashboard Terminal. * Feature: Implemented Recursive Nested Groups Resolution for deep AD hierarchies. * Security: Blocked authentication bypass via the standard WordPress “Lost Password” mechanism and Application Passwords. * Security: Mitigated Log Forging (CRLF Injection) and fixed indirect metadata leaks in `get_pages`. #### 1.1.0 * Feature: Added Universal REST API Safe Reparenting hook. * Security: Implemented “Ghost Folders” for the admin page list to maintain site hierarchy. #### 1.0.0 * Initial release. ## Meta * Version **1.2.0** * Last updated **1 week ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/sanch-multidomain-ldap-auth/) * Tags * [acl](https://vec.wordpress.org/plugins/tags/acl/)[active directory](https://vec.wordpress.org/plugins/tags/active-directory/) [authentication](https://vec.wordpress.org/plugins/tags/authentication/)[ldap](https://vec.wordpress.org/plugins/tags/ldap/) [multi domain](https://vec.wordpress.org/plugins/tags/multi-domain/) * [Advanced View](https://vec.wordpress.org/plugins/sanch-multidomain-ldap-auth/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/sanch-multidomain-ldap-auth/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/sanch-multidomain-ldap-auth/reviews/) ## Contributors * [ sanchshevchuk ](https://profiles.wordpress.org/sanchshevchuk/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/sanch-multidomain-ldap-auth/)