Next ADI requires at least PHP 7.1 starting at 2019-01-01 as older PHP versions are outdated.
Does Next ADI run on web hosters like WP Engine?
It depends upon your web hoster's configuration. For WP Engine, please take a look at the page Running NADI on WP Engine.
Does Next ADI work with any theme?
In general Next ADI works with any theme. But we have customers who experienced problems when using the wOffice theme. wOffice changes the login form in a way that causes Next ADI (and other plug-ins) no longer to work as intended.
Can Next ADI create users in Active Directory?
No. Next ADI can create Active Directory users in WordPress but not vice versa. There are too many corner cases and security related problems which can not be easily implemented. Maybe we will add this feature someday if it gets sponsored - the effort for this is extremely high.
Next ADI itself does not implement any SSO functionality.
Is X.509 certificate SSO authentication supported?
We have no official support for that but if your certificate is issued for the userPrincipalName the Kerberos SSO process is automatically used if SSO is enabled.
Your user principal provided by the webserver does not include the password. The password is required to synchronize your user's data from Active Directory to WordPress, for example for checking your security group membership. As most Active Directories does not provide anonymous LDAP binds, the service account is used to retrieve that information.
Can I remove the "Log in using SSO" link?
Please take a look in our Lifecycle documentation how to remove the link.
My Active Directory username (sAMAccountName or userPrincipalName) contains German Umlauts but the Umlauts are not shown in WordPress.
ADI-317 This is a restriction of WordPress and not a bug. WordPress does not allow Umlauts as part of the user login (user_login) name or nicename (user_nicename). When Next ADI adds users with Umlauts by using Test authentication, Sync To WordPress or login, WordPress automatically converts the fields to characters without diacritics. Active Directory itself converts usernames with diacritics during the authentication in their non-diacritics counterparts. You can log in with "Müller" or "Muller" - both are mapped by Active Directory to the same user account.