--- title: Wordpress auto sign-on with IIS7 and a plugin | daily.dev description: A custom WordPress plugin enables single sign-on for a RealDolmen internal blog platform hosted on Windows, IIS 7, and SQL Server. It works around IIS7's... canonical: https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Wordpress auto sign-on with IIS7 and a plugin | daily.dev og:description: A custom WordPress plugin enables single sign-on for a RealDolmen internal blog platform hosted on Windows, IIS 7, and SQL Server. It works around IIS7's... og:url: https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2 og:image: https://api.daily.dev/og/posts/Gb2Nc3WM2.png og:image:alt: Wordpress auto sign-on with IIS7 and a plugin og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Wordpress auto sign-on with IIS7 and a plugin **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 5 min read · 0 upvotes · 0 comments ## Summary A custom WordPress plugin enables single sign-on for a RealDolmen internal blog platform hosted on Windows, IIS 7, and SQL Server. It works around IIS7's anonymous authentication taking precedence over Windows Authentication by detecting LAN users on Internet Explorer and sending a 401 Unauthorized response, which triggers the browser to send Windows Authentication credentials. The plugin then matches the authenticated AD user to a WordPress account (creating one if needed) and logs them in automatically, avoiding a redundant login prompt for users already authenticated on the corporate network. The plugin source code is shared for download, including an updated version for WordPress 3.1+. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I enable single sign-on for Wordpress hosted on IIS7 with Active Directory? Enable Windows Authentication in IIS7 alongside anonymous authentication, then use a custom Wordpress plugin hooked into the init and login_form actions. When a LAN user on Internet Explorer has no REMOTE_USER set, the plugin sends an HTTP 401 Unauthorized response, forcing IE to resend the request with the Windows Authentication token, which IIS then honors. _Developers wiring up AD-based sign-on for internal Wordpress sites can find deeper walkthroughs like this on daily.dev._ ### Why does enabling Windows Authentication in IIS7 not automatically log in Wordpress users? Anonymous authentication is typically positioned higher in the IIS7 authentication provider order than Windows Authentication, so IIS authenticates the request anonymously before ever trying Active Directory credentials, leaving the user unauthenticated in Wordpress even though Windows Authentication is enabled. Reordering providers would force every user to log in manually, which defeats the single sign-on goal. _Teams troubleshooting IIS authentication ordering issues can track similar infrastructure gotchas on daily.dev._ ## Similar posts on daily.dev - [Hackers target WordPress sites in miniOrange auth bypass attacks](https://daily.dev/posts/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks-ayedwsayu) · BleepingComputer · 1 upvotes · 0 comments - [wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) · Latest Hacking News · 2 upvotes · 0 comments - [WordPress debuts a private workspace that runs in your browser via a new service, my.WordPress.net](https://daily.dev/posts/wordpress-debuts-a-private-workspace-that-runs-in-your-browser-via-a-new-service-my-wordpress-net-wglzsnk73) · TechCrunch · 0 upvotes · 0 comments - [Critical WordPress Plugin Vulnerability Allows Unauthenticated Admin Takeover on 150K Sites](https://daily.dev/posts/critical-wordpress-plugin-vulnerability-allows-unauthenticated-admin-takeover-on-150k-sites-2ap9ez0hm) · Orca Security Blog · 2 upvotes · 2 comments --- Tags: [#php](https://daily.dev/tags/php), [#authentication](https://daily.dev/tags/authentication), [#.net](https://daily.dev/tags/.net), [#wordpress](https://daily.dev/tags/wordpress), [#active-directory](https://daily.dev/tags/active-directory) [View this post on daily.dev](https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Wordpress auto sign-on with IIS7 and a plugin","url":"https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2"},"datePublished":"2026-10-04T13:06:14.176Z","dateModified":"2026-10-04T13:16:36.439Z","description":"A custom WordPress plugin enables single sign-on for a RealDolmen internal blog platform hosted on Windows, IIS 7, and SQL Server. It works around IIS7's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5c7f63be70b71ff69f3d8d7fc99a8b5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5c7f63be70b71ff69f3d8d7fc99a8b5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,authentication,.net,wordpress,active-directory","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Wordpress auto sign-on with IIS7 and a plugin"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/wordpress-auto-sign-on-with-iis7-and-a-plugin-gb2nc3wm2#faq","mainEntity":[{"@type":"Question","name":"How can I enable single sign-on for Wordpress hosted on IIS7 with Active Directory?","acceptedAnswer":{"@type":"Answer","text":"Enable Windows Authentication in IIS7 alongside anonymous authentication, then use a custom Wordpress plugin hooked into the init and login_form actions. When a LAN user on Internet Explorer has no REMOTE_USER set, the plugin sends an HTTP 401 Unauthorized response, forcing IE to resend the request with the Windows Authentication token, which IIS then honors. Developers wiring up AD-based sign-on for internal Wordpress sites can find deeper walkthroughs like this on daily.dev."}},{"@type":"Question","name":"Why does enabling Windows Authentication in IIS7 not automatically log in Wordpress users?","acceptedAnswer":{"@type":"Answer","text":"Anonymous authentication is typically positioned higher in the IIS7 authentication provider order than Windows Authentication, so IIS authenticates the request anonymously before ever trying Active Directory credentials, leaving the user unauthenticated in Wordpress even though Windows Authentication is enabled. Reordering providers would force every user to log in manually, which defeats the single sign-on goal. Teams troubleshooting IIS authentication ordering issues can track similar infrastructure gotchas on daily.dev."}}]} ```