=== Sanch MultiDomain LDAP Auth for Active Directory ===
Contributors: sanchshevchuk
Tags: active directory, ldap, authentication, acl, multi-domain
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enterprise Active Directory integration featuring multi-domain authentication, Zero-Trust ACL URL routing, and dynamic role mapping.

== Description ==

Sanch MultiDomain LDAP Auth for Active Directory provides enterprise-grade Single Sign-On (SSO) and access control for corporate WordPress intranets. Built for multi-forest environments, it allows users to authenticate seamlessly against multiple Domain Controllers while strictly enforcing path-based access policies and dynamic role propagation.

= Key Features =
* **Multi-Domain & Multi-DC Authentication:** Connect and authenticate against multiple LDAP/LDAPS servers across different Active Directory domains/UPN suffixes.
* **Zero-Trust Path-Based ACL:** Restrict intranet sections, categories, and custom routes based on AD Group Membership (CN) or mapped WP Roles.
* **JIT Provisioning & Single Source of Truth:** Automatic user creation on first successful AD bind, with optional strict role sync on every login.
* **LDAP Clone Protection:** Detects and prevents authentication if multiple accounts match the same SAMAccountName across refined Base DNs to block privilege escalation.
* **REST API & Write ACL Protection:** Enforces URL routing policies over REST API endpoints and post/page editing privileges (`map_meta_cap`).
* **Secure Connections:** Supports LDAP (Plaintext), LDAP + StartTLS, and LDAPS (SSL/TLS Encrypted).

== Installation ==

1. Upload the `sanch-multidomain-ldap-auth` directory to the `/wp-content/plugins/` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Ensure the PHP LDAP extension (`php-ldap`) is installed and enabled on your web server.
4. Navigate to **Settings -> AD Auth Settings** in your WordPress admin dashboard.
5. Configure your Domain Controllers (IP, Port, Domain, Base DN) and define your AD Group to WP Role mapping rules.

== Frequently Asked Questions ==

= Does this plugin require the PHP LDAP extension? =
Yes, your web server must have the `php-ldap` PHP module enabled to initiate connections with your Active Directory Domain Controllers.

= What happens if an AD user does not belong to any mapped group? =
By default under Zero-Trust policy, authentication will fail with an "Access Denied" message if the user does not belong to at least one mapped AD Group.

= How are custom WP roles handled? =
You can select existing WordPress roles or create custom role slugs directly from the settings page, assigning base capability sets (`subscriber`, `editor`, `author`, `administrator`).

== Changelog ==

= 1.0.0 =
* Initial release. Features Multi-Domain authentication, LDAP Clone Guard, StartTLS/LDAPS support, and Zero-Trust path-based ACL routing.