OpenID Connect Generic WordPress Plugin

To install the plugin in your WordPress environment, follow these steps:

1. Upload the plugin files to your /wp-content/plugins/ directory.
2. Activate the plugin through the WordPress admin dashboard.
3. Navigate to Settings > OpenID Connect to configure the client settings.

You can install the plugin manually or via Composer.

Manual Installation:

1. Upload the plugin to your /wp-content/plugins/ directory.
2. Activate the plugin in the WordPress admin dashboard.
3. Configure the settings by visiting Settings > OpenID Connect.

Composer Installation: Use the following command to add the package to your project: composer require daggerhart/openid-connect-generic

OAuth2 servers require a whitelisted Redirect URI. This plugin provides two options depending on whether your Identity Provider (IdP) supports query strings in the redirect URI:

Default Redirect URI

By default, the plugin uses the WordPress admin-ajax.php endpoint. This includes a query string. Format: https://example.com/wp-admin/admin-ajax.php?action=openid-connect-authorize (replace example.com with your domain).

Alternate Redirect URI

If your OAuth2 server does not allow query strings in the redirect URI, enable the Alternate Redirect URI checkbox on the plugin settings page (Dashboard > Settings > OpenID Connect Generic). This will change the URI to a cleaner format. Format: https://example.com/openid-connect-authorize

OAuth2 servers require a whitelisted Redirect URI. This plugin provides two options depending on your server's requirements:

1. Default Redirect URI: Uses the WordPress admin-ajax.php endpoint. This includes a query string and is suitable for most servers. Format: https://example.com/wp-admin/admin-ajax.php?action=openid-connect-authorize

2. Alternate Redirect URI: If your OAuth2 server does not allow query strings in the redirect URI, enable the Alternate Redirect URI checkbox in the plugin settings (Dashboard > Settings > OpenID Connect Generic). This changes the URI to a cleaner path. Format: https://example.com/openid-connect-authorize

The project provides a docker-compose.yml file to orchestrate a full development stack, including a WordPress application environment, a MariaDB database, Apache web server, phpMyAdmin, and MailHog for email testing.

Service Overview

• app: The primary PHP/Node development container. It mounts the local repository to /workspaces/openid-connect-generic.
• web: An Apache (httpd) service running on port 8080.
• db: A MariaDB database service. It initializes using a test database script located at ./tests/db-wordpress_test.sql.
• phpmyadmin: A web interface for database management, accessible on port 8081.
• mailhog: An SMTP server and web interface for viewing/testing emails during development. The SMTP server runs on port 1025 and the Web UI runs on port 8026 (mapped from 8025).

As of version 3.11.3, a security update was released to fix authentication vulnerabilities (including JWT signature bypass and SSRF protection).

Required Action: Update to version 3.11.3 or higher immediately and ensure you configure the JWKS endpoint in the plugin settings to enable proper JWT validation.

As of version 3.11.3, a security update was released to fix authentication vulnerabilities (including JWT signature bypass and SSRF protection).

Required Action: Immediately update to version 3.11.3 or later and configure the JWKS endpoint in the plugin settings to ensure proper JWT validation.

Developers can hook into the plugin to customize settings or state values using the following WordPress filters:

• openid-connect-generic-settings: Use this to filter settings values.
• openid-connect-generic-new-state-value: Use this to filter state values.

Use this filter to change the text displayed on the OpenID Connect login button. The default value is __( 'Login with OpenID Connect' ).

add_filter('openid-connect-generic-login-button-text', function( $text ) {
    $text = __('Login to my super cool IDP server');
    
    return $text;
});

Use this filter to determine if a new user (who does not yet exist in WordPress) should be created in the system.

Arguments:

1. $result (boolean): The current result of the test (defaults to TRUE).
2. $user_claim (array): The user claims array received from the server.

add_filter('openid-connect-generic-user-creation-test', function( $result, $user_claim ) {
    // Don't let anyone from example.com create an account.
    $email_array = explode( '@', $user_claim['email'] );
    if ( $email_array[1] == 'example.com' ) {
        $result = FALSE;
    }
    
    return $result;
}, 10, 2) 

This action fires when a new user is created by the plugin.

Arguments:

1. $user ( WP_User object): The newly created WordPress user object.
2. $user_claim (array): The user claims provided by the IDP server.

add_action('openid-connect-generic-user-create', function( $user, $user_claim ) {
    // Send the user an email when their account is first created.
    wp_mail( 
        $user->user_email,
        __('Welcome to my web zone'),
        "Hi {$user->first_name},\n\nYour account has been created at my cool website.\n\n Enjoy!"
    ); 
}, 10, 2);

This action fires when an existing user logs in (after successful authentication and authorization). Use this to sync user roles or other metadata based on the latest claims from the IDP.

Arguments:

1. $user ( WP_User object): The current WordPress user object.
2. $user_claim (array): The user claims provided by the IDP server.

add_action('openid-connect-generic-update-user-using-current-claim', function( $user, $user_claim) {
    // Based on some data in the user_claim, modify the user.
    if ( !empty( $user_claim['wp_user_role'] ) ) {
        if ( $user_claim['wp_user_role'] == 'should-be-editor' ) {
            $user->set_role( 'editor' );
        }
    }
}, 10, 2);