Centrify作为IdP，能否配置传递.ASPAUTH Cookie供WordPress调用API？

Great question! Let’s walk through how this works and what you need to configure to make it happen, since you already have a working SAML SSO setup between Centrify and your internal WordPress site.

Short Answer #

Yes, you can configure Centrify to pass session cookies like .ASPAUTH to your WordPress site for API calls, but there are critical prerequisites and configuration steps to account for cross-domain behavior and session context.

Key Details & Configuration Steps #

1. Understand the .ASPAUTH Cookie’s Role
   The .ASPAUTH cookie is Centrify’s session authentication cookie, set when a user logs into the Centrify portal via their browser. It’s tied to the user’s browser session, Centrify’s domain, and specific path rules—so it won’t automatically work across domains unless configured properly.

2. Configure Centrify’s Cookie Cross-Domain Settings
   If your WordPress site and Centrify are on different subdomains (e.g., wordpress.your-intranet.local and centrify.your-intranet.local), you need to adjust Centrify’s cookie settings to allow cross-domain access:

   • Log into your Centrify admin portal
   • Navigate to Settings > Security > Session Management
   • Set the Domain field to your internal root domain (e.g., .your-intranet.local)—this lets the cookie be accessible to all subdomains under that root
   • Adjust the SameSite attribute:
     • Use Lax if your API requests are initiated from a navigation action (like a link click)
     • Use None (with the Secure attribute enabled) if you’re making XHR/fetch requests from WordPress to Centrify (note: None requires HTTPS, which is recommended even for internal networks)

3. Ensure API Calls Use the User’s Browser Session
   Important: .ASPAUTH is a browser-side cookie, so your API calls to Centrify must originate from the user’s browser (e.g., via JavaScript in WordPress frontend templates). If you try to make the API call from WordPress’s backend (PHP), the server won’t have access to the user’s browser cookie—this will fail.

   If you absolutely need to make backend API calls, skip the cookie approach and use Centrify’s OAuth2 flow instead (see below).

4. Enable CORS on Centrify for Your WordPress Domain
   To let WordPress send cross-origin requests to Centrify’s API endpoints:

   • In Centrify’s admin portal, go to Settings > Security > CORS
   • Add your WordPress site’s full domain (e.g., https://wordpress.your-intranet.local) to the allowed origins list
   • Ensure the allowed methods include POST (and any other HTTP verbs your API calls use)

Alternative: OAuth2 for Backend API Calls #

If you need to make Centrify API calls from WordPress’s backend (server-side), using .ASPAUTH cookies isn’t feasible. Instead, use Centrify’s OAuth2 authorization code flow:

• Create an OAuth application in Centrify’s admin portal, with a callback URL pointing to a WordPress page
• After a user logs into WordPress via SAML SSO, trigger an OAuth authorization flow to get an access token
• Use this token in the Authorization: Bearer <token> header for all Centrify API calls from WordPress’s backend—this is more secure and avoids cross-domain cookie limitations

Critical Notes #

• If your internal network doesn’t use HTTPS, browsers may block cross-domain cookies (especially with SameSite=None), so prioritize setting up HTTPS for both services
• .ASPAUTH cookies have an expiration time—you’ll need to handle session expiration by redirecting users back to Centrify for re-authentication if the cookie is no longer valid

内容的提问来源于stack exchange，提问作者PatrickC