# buffcleb/buffcleb-saml-sp architecture

> Architecture diagram of the GitHub repository buffcleb/buffcleb-saml-sp, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-18). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/buffcleb/buffcleb-saml-sp
- Repository: https://github.com/buffcleb/buffcleb-saml-sp

## Overview

1. **What this repo is**
   - This is a **WordPress plugin** that turns a site into a **SAML 2.0 Service Provider (SP)**.
   - It is not a standalone service: it runs inside WordPress, uses WordPress admin/UI hooks, and exposes SAML endpoints through query parameters on the normal site URL.

2. **Top-level structure**
   - `buffcleb-saml-sp.php` is the plugin bootstrap entrypoint.
   - `includes/` contains the protocol, security, user, logging, CLI, and lifecycle classes.
   - `admin/` contains the WordPress admin tabs and list-table UI.
   - `docs/` is extensive operational and architectural documentation, which closely matches the plugin’s runtime responsibilities.

3. **Request-routing and public endpoints**
   - The plugin exposes five main public endpoints via `?buffcleb_saml_sp=...`:
     - `metadata` for SP metadata output
     - `login` to start SP-initiated SSO
     - `acs` for the SAML Assertion Consumer Service callback
     - `sls` for Single Logout
     - `attributes` for per-user attribute display
   - These endpoints are the main boundary between the browser/IdP and the plugin’s internal SAML engine.

4. **SAML protocol core**
   - The core protocol implementation is split across classes such as:
     - `authn-request`, `response`, `logout`, `acs`
     - `metadata`, `idp-metadata`, `metadata-refresh`
     - `xml`, `xml-verifier`, `schema`, `crypto`, `decrypter`
     - `request-store`
   - Together they handle request construction, XML parsing, signature verification, assertion decryption, replay protection, and logout message handling.

5. **Security model is a first-class subsystem**
   - The plugin deliberately avoids third-party SAML libraries and implements XML signing/verification directly with PHP `ext-dom` and `ext-openssl`.
   - Security-sensitive code enforces anti-wrapping checks, destination/audience/recipient/timing validation, XXE-safe XML loading, login-CSRF browser binding, and SSRF-safe metadata retrieval.
   - The architecture is therefore “WordPress integration + custom SAML engine,” rather than “WordPress wrapper around a SAML SDK.”

6. **Identity Provider lifecycle**
   - Identity Providers are managed as first-class configuration objects through the admin UI and metadata import.
   - The plugin supports importing IdP metadata from URL, paste, or file, then refreshing it automatically later.
   - It also supports certificate rollover by staging a primary and “next” signing certificate, which matters for zero-downtime IdP key rotation.

7. **User resolution, provisioning, and access control**
   - After a successful SAML response, the plugin maps the assertion to a WordPress user via `user`, `transform`, and related access-control logic.
   - It supports matching by email or username, optional auto-provisioning, attribute-to-field/meta mapping, role mapping, and per-IdP allow/deny rules.
   - Access-denied handling is a distinct flow with customizable denial messages, so authorization is separate from authentication.

8. **Login UX and WordPress integration points**
   - The plugin integrates into `wp-login.php` with a branded “Sign in with SSO” button and per-IdP buttons/logos.
   - Shortcodes expose the same login entry points inside content, which makes the login UI reusable outside the default login screen.
   - “Force SSO” changes the normal WordPress authentication boundary by disabling local passwords, with an emergency token as a recovery path.

9. **Administration, monitoring, and operational controls**
   - `admin/` contains tabbed screens for SP settings, IdPs, logs, maintenance, and users.
   - The plugin extends the Users list with SSO-related columns and a per-user attributes view.
   - Logging is a core subsystem: searchable/filterable activity logs, verbose SAML message capture, CSV export, retention controls, failure-spike alerts, and IP anonymization.

10. **External integrations and operational outputs**
   - Beyond WordPress and IdPs, the main external operational sink is optional **SIEM forwarding** to a file in JSON Lines or CEF format.
   - There is also certificate-expiry monitoring and metadata refresh automation, both of which behave like scheduled maintenance jobs inside WordPress.

11. **Automation and lifecycle management**
   - `includes/class-buffcleb-saml-sp-cli.php` supports WP-CLI operations for maintenance and admin automation.
   - `uninstall.php` indicates a clean teardown path, and the docs mention config export/import for moving settings between environments.
   - This means the plugin has a full operational lifecycle: install, configure, observe, rotate keys, migrate config, and uninstall.

12. **How the main data flow works**
   - Admin imports or refreshes IdP metadata → settings/certs are stored → SP publishes metadata to the IdP → user hits login → plugin sends AuthnRequest → IdP POSTs SAMLResponse to ACS → response is verified/decrypted → attributes are mapped → WordPress user is matched/provisioned → session/login state is established → logs/alerts/SIEM are updated.

Main entry points: [`includes/class-buffcleb-saml-sp-response.php`](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-response.php) (SAML response), [`admin/class-buffcleb-saml-sp-admin.php`](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin.php) (Admin hub), [`includes/class-buffcleb-saml-sp-maintenance.php`](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-maintenance.php) (Maintenance), [`buffcleb-saml-sp.php`](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/buffcleb-saml-sp.php) (Plugin bootstrap)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_g_public["Public SAML"]
  node_public_router["Endpoint router<br/>request-routing"]
  node_metadata["SP metadata<br/>saml-endpoint"]
  node_login["SSO login<br/>saml-start"]
  node_acs["ACS callback<br/>saml-callback"]
  node_logout["SLS endpoint<br/>saml-logout"]
  node_attributes["Attributes view<br/>user-endpoint"]
end

subgraph group_g_core["SAML Core"]
  node_authn_request["AuthnRequest<br/>saml-message"]
  node_response["SAML response<br/>saml-message"]
  node_request_store["Request store<br/>replay-cache"]
  node_xml_verifier["XML verifier<br/>security"]
  node_xml["XML utils<br/>xml-processing"]
  node_crypto["Crypto<br/>signing"]
  node_decrypter["Decrypter<br/>assertion-decryption"]
end

subgraph group_g_admin["Admin UI"]
  node_admin["Admin hub<br/>wp-admin"]
  node_tab_sp["SP tab<br/>admin-screen"]
  node_tab_idps["IdP tab<br/>admin-screen"]
  node_tab_logs["Logs tab<br/>admin-screen"]
  node_tab_maintenance["Maintenance tab<br/>admin-screen"]
  node_users_list["Users list<br/>wp-admin-extension"]
  node_shortcodes["Shortcodes<br/>ui-integration"]
end

subgraph group_g_identity["Identity Flow"]
  node_user["User resolver<br/>identity-mapping"]
  node_transform["Attribute map<br/>mapping"]
  node_access_denied["Access control<br/>authorization"]
  node_force_sso["Force SSO<br/>login-policy"]
end

subgraph group_g_ops["Operations"]
  node_settings["Settings<br/>config"]
  node_idp_metadata["IdP metadata<br/>identity-provider"]
  node_metadata_refresh["Metadata refresh<br/>scheduled-job"]
  node_logger["Logger<br/>activity-log"]
  node_alerts["Alerts<br/>monitoring"]
  node_siem["SIEM export<br/>integration"]
  node_maintenance["Maintenance<br/>lifecycle"]
  node_cli["WP-CLI<br/>automation"]
  node_cert_status["Cert status<br/>monitoring"]
end

node_bootstrap["Plugin bootstrap<br/>entrypoint"]

node_bootstrap -->|"loads"| node_settings
node_bootstrap -->|"registers"| node_public_router
node_bootstrap -->|"boots"| node_admin
node_bootstrap -->|"registers"| node_shortcodes
node_bootstrap -->|"wires"| node_logger
node_public_router -->|"dispatches"| node_metadata
node_public_router -->|"dispatches"| node_login
node_public_router -->|"dispatches"| node_acs
node_public_router -->|"dispatches"| node_logout
node_public_router -->|"dispatches"| node_attributes
node_login -->|"builds"| node_authn_request
node_login -->|"tracks"| node_request_store
node_acs -->|"parses"| node_response
node_response -->|"verifies"| node_xml_verifier
node_response -->|"loads"| node_xml
node_response -->|"decrypts"| node_decrypter
node_response -->|"uses"| node_crypto
node_response -->|"checks"| node_request_store
node_response -->|"maps to"| node_user
node_user -->|"applies"| node_transform
node_user -->|"guards"| node_access_denied
node_user -->|"constrains"| node_force_sso
node_idp_metadata -->|"schedules"| node_metadata_refresh
node_idp_metadata -->|"stores certs"| node_crypto
node_admin -->|"shows"| node_tab_sp
node_admin -->|"shows"| node_tab_idps
node_admin -->|"shows"| node_tab_logs
node_admin -->|"shows"| node_tab_maintenance
node_admin -->|"extends"| node_users_list
node_tab_logs -->|"reads"| node_logger
node_tab_maintenance -->|"runs"| node_maintenance
node_maintenance -->|"checks"| node_cert_status
node_maintenance -->|"triggers"| node_metadata_refresh
node_maintenance -->|"exports"| node_siem
node_maintenance -->|"evaluates"| node_alerts
node_cli -->|"invokes"| node_maintenance
node_cli -->|"manages"| node_idp_metadata
node_logger -->|"forwards"| node_siem
node_logger -->|"feeds"| node_alerts

click node_bootstrap "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/buffcleb-saml-sp.php"
click node_settings "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-settings.php"
click node_metadata "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-metadata.php"
click node_login "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-authn-request.php"
click node_acs "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-acs.php"
click node_logout "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-logout.php"
click node_authn_request "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-authn-request.php"
click node_response "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-response.php"
click node_request_store "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-request-store.php"
click node_xml_verifier "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-xml-verifier.php"
click node_xml "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-xml.php"
click node_crypto "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-crypto.php"
click node_decrypter "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-decrypter.php"
click node_idp_metadata "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-idp-metadata.php"
click node_metadata_refresh "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-metadata-refresh.php"
click node_user "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-user.php"
click node_transform "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-transform.php"
click node_access_denied "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-access-denied.php"
click node_force_sso "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-force-sso.php"
click node_admin "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin.php"
click node_tab_sp "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-sp.php"
click node_tab_idps "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-idps.php"
click node_tab_logs "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-logs.php"
click node_tab_maintenance "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-maintenance.php"
click node_users_list "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-users-list.php"
click node_logger "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-logger.php"
click node_alerts "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-alerts.php"
click node_siem "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-siem.php"
click node_maintenance "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-maintenance.php"
click node_cli "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-cli.php"
click node_cert_status "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-cert-status.php"
click node_shortcodes "https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-shortcodes.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_public_router,node_metadata,node_login,node_acs,node_logout,node_attributes toneBlue
class node_authn_request,node_response,node_request_store,node_xml_verifier,node_xml,node_crypto,node_decrypter toneAmber
class node_admin,node_tab_sp,node_tab_idps,node_tab_logs,node_tab_maintenance,node_users_list,node_shortcodes toneMint
class node_user,node_transform,node_access_denied,node_force_sso toneRose
class node_settings,node_idp_metadata,node_metadata_refresh,node_logger,node_alerts,node_siem,node_maintenance,node_cli,node_cert_status toneIndigo
class node_bootstrap toneNeutral
```

## Components

### Public SAML

Browser and IdP-facing endpoints exposed through WordPress routing.

- **Endpoint router**: request-routing · Dispatches ?buffcleb_saml_sp=... requests into the SAML flows.
- [SP metadata](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-metadata.php): saml-endpoint · Publishes service-provider metadata for IdP configuration. · `includes/class-buffcleb-saml-sp-metadata.php`
- [SSO login](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-authn-request.php): saml-start · Starts SP-initiated login and browser binding flow. · `includes/class-buffcleb-saml-sp-authn-request.php`
- [ACS callback](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-acs.php): saml-callback · Consumes SAML responses posted back from the IdP. · `includes/class-buffcleb-saml-sp-acs.php`
- [SLS endpoint](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-logout.php): saml-logout · Handles single logout requests and responses. · `includes/class-buffcleb-saml-sp-logout.php`
- **Attributes view**: user-endpoint · Displays per-user SSO attributes and resolved identity data.

### SAML Core

Protocol, XML, cryptography, and request tracking.

- [AuthnRequest](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-authn-request.php): saml-message · Builds outbound authentication requests to the IdP. · `includes/class-buffcleb-saml-sp-authn-request.php`
- [SAML response](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-response.php): saml-message · Parses and validates inbound assertions and response messages. · `includes/class-buffcleb-saml-sp-response.php`
- [Request store](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-request-store.php): replay-cache · Tracks request IDs and state to prevent replay and correlate flows. · `includes/class-buffcleb-saml-sp-request-store.php`
- [XML verifier](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-xml-verifier.php): security · Verifies signatures and protects against wrapping and malformed XML. · `includes/class-buffcleb-saml-sp-xml-verifier.php`
- [XML utils](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-xml.php): xml-processing · Safe XML loading, parsing, and serialization helpers. · `includes/class-buffcleb-saml-sp-xml.php`
- [Crypto](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-crypto.php): signing · Signing and cryptographic helpers built on PHP OpenSSL. · `includes/class-buffcleb-saml-sp-crypto.php`
- [Decrypter](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-decrypter.php): assertion-decryption · Decrypts encrypted assertions and related SAML payloads. · `includes/class-buffcleb-saml-sp-decrypter.php`

### Admin UI

WordPress administration screens and user list extensions.

- [Admin hub](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin.php): wp-admin · Coordinates the plugin's WordPress admin screens. · `admin/class-buffcleb-saml-sp-admin.php`
- [SP tab](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-sp.php): admin-screen · Service-provider settings and operational configuration screen. · `admin/class-buffcleb-saml-sp-admin-tab-sp.php`
- [IdP tab](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-idps.php): admin-screen · Identity-provider management, metadata import, and cert rollover UI. · `admin/class-buffcleb-saml-sp-admin-tab-idps.php`
- [Logs tab](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-logs.php): admin-screen · Searchable activity logs and SAML message review screen. · `admin/class-buffcleb-saml-sp-admin-tab-logs.php`
- [Maintenance tab](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-admin-tab-maintenance.php): admin-screen · Retention, export, refresh, and operational maintenance controls. · `admin/class-buffcleb-saml-sp-admin-tab-maintenance.php`
- [Users list](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/admin/class-buffcleb-saml-sp-users-list.php): wp-admin-extension · Extends the WordPress users table with SSO-related columns. · `admin/class-buffcleb-saml-sp-users-list.php`
- [Shortcodes](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-shortcodes.php): ui-integration · Reusable login-entry shortcodes for content and theme surfaces. · `includes/class-buffcleb-saml-sp-shortcodes.php`

### Identity Flow

User matching, provisioning, role mapping, and access control.

- [User resolver](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-user.php): identity-mapping · Matches assertions to WordPress users and handles provisioning. · `includes/class-buffcleb-saml-sp-user.php`
- [Attribute map](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-transform.php): mapping · Transforms SAML attributes into user fields, meta, and roles. · `includes/class-buffcleb-saml-sp-transform.php`
- [Access control](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-access-denied.php): authorization · Applies IdP/user allow-deny rules and denial messaging. · `includes/class-buffcleb-saml-sp-access-denied.php`
- [Force SSO](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-force-sso.php): login-policy · Overrides local password login and provides emergency recovery. · `includes/class-buffcleb-saml-sp-force-sso.php`

### Operations

Logging, alerts, maintenance, CLI, and lifecycle management.

- [Settings](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-settings.php): config · Central plugin settings and stored configuration. · `includes/class-buffcleb-saml-sp-settings.php`
- [IdP metadata](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-idp-metadata.php): identity-provider · Imports, stores, and refreshes identity-provider metadata and certs. · `includes/class-buffcleb-saml-sp-idp-metadata.php`
- [Metadata refresh](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-metadata-refresh.php): scheduled-job · Automatically refreshes remote IdP metadata on a schedule. · `includes/class-buffcleb-saml-sp-metadata-refresh.php`
- [Logger](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-logger.php): activity-log · Captures plugin activity, verbose protocol traces, and exports. · `includes/class-buffcleb-saml-sp-logger.php`
- [Alerts](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-alerts.php): monitoring · Failure-spike and operational alerting for SSO events. · `includes/class-buffcleb-saml-sp-alerts.php`
- [SIEM export](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-siem.php): integration · Forwards operational events to JSON Lines or CEF sinks. · `includes/class-buffcleb-saml-sp-siem.php`
- [Maintenance](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-maintenance.php): lifecycle · Runs cleanup, retention, and admin automation tasks. · `includes/class-buffcleb-saml-sp-maintenance.php`
- [WP-CLI](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-cli.php): automation · Command-line entrypoint for administrative and maintenance tasks. · `includes/class-buffcleb-saml-sp-cli.php`
- [Cert status](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/includes/class-buffcleb-saml-sp-cert-status.php): monitoring · Checks signing certificate expiry and rotation state. · `includes/class-buffcleb-saml-sp-cert-status.php`

### Other components

- [Plugin bootstrap](https://github.com/buffcleb/buffcleb-saml-sp/blob/main/buffcleb-saml-sp.php): entrypoint · Main plugin file that wires WordPress hooks and loads subsystems. · `buffcleb-saml-sp.php`

## Connections

- Plugin bootstrap → Settings: loads · Initializes configuration and stored options.
- Plugin bootstrap → Endpoint router: registers · Attaches request handling to WordPress routing.
- Plugin bootstrap → Admin hub: boots · Registers admin screens and WordPress UI hooks.
- Plugin bootstrap → Shortcodes: registers · Adds reusable login UI shortcodes.
- Plugin bootstrap → Logger: wires · Initializes logging and activity capture.
- Endpoint router → SP metadata: dispatches · Serves SP metadata requests.
- Endpoint router → SSO login: dispatches · Starts SSO login requests.
- Endpoint router → ACS callback: dispatches · Handles SAML assertion callbacks.
- Endpoint router → SLS endpoint: dispatches · Handles SLO requests and responses.
- Endpoint router → Attributes view: dispatches · Shows user attribute details.
- SSO login → AuthnRequest: builds · Creates outbound AuthnRequest messages.
- SSO login → Request store: tracks · Stores request state and correlation IDs.
- ACS callback → SAML response: parses · Consumes the inbound SAML response.
- SAML response → XML verifier: verifies · Checks signatures and XML integrity.
- SAML response → XML utils: loads · Safely parses XML documents.
- SAML response → Decrypter: decrypts · Decrypts encrypted assertions.
- SAML response → Crypto: uses · Uses cryptographic primitives for validation and signing.
- SAML response → Request store: checks · Validates response against saved request state.
- SAML response → User resolver: maps to · Resolves the assertion to a WordPress user.
- User resolver → Attribute map: applies · Transforms attributes into fields, meta, and roles.
- User resolver → Access control: guards · Separates authorization failures from authentication.
- User resolver → Force SSO: constrains · Enforces SSO-only login policy when enabled.
- IdP metadata → Metadata refresh: schedules · Refreshes imported metadata automatically.
- IdP metadata → Crypto: stores certs · Manages signing certificate rollover.
- Admin hub → SP tab: shows · Service-provider configuration screen.
- Admin hub → IdP tab: shows · IdP management and metadata import screen.
- Admin hub → Logs tab: shows · Logs and protocol trace screen.
- Admin hub → Maintenance tab: shows · Maintenance and retention controls screen.
- Admin hub → Users list: extends · Adds user columns and SSO details.
- Logs tab → Logger: reads · Displays activity and protocol logs.
- Maintenance tab → Maintenance: runs · Invokes cleanup and operational jobs.
- Maintenance → Cert status: checks · Monitors certificate expiry.
- Maintenance → Metadata refresh: triggers · Runs metadata refresh operations.
- Maintenance → SIEM export: exports · Forwards event data to SIEM output.
- Maintenance → Alerts: evaluates · Detects operational failure spikes.
- WP-CLI → Maintenance: invokes · Exposes maintenance actions through WP-CLI.
- WP-CLI → IdP metadata: manages · Supports automation around IdP configuration.
- Logger → SIEM export: forwards · Sends selected events to external sinks.
- Logger → Alerts: feeds · Supplies data for alert generation.