{"id":164430,"date":"2022-10-31T09:14:55","date_gmt":"2022-10-31T09:14:55","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/openid-connect-server\/"},"modified":"2025-04-17T11:48:06","modified_gmt":"2025-04-17T11:48:06","slug":"openid-connect-server","status":"publish","type":"plugin","link":"https:\/\/twd.wordpress.org\/plugins\/openid-connect-server\/","author":5279457,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"2.0.0","stable_tag":"2.0.0","tested":"6.8.5","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"OpenID Connect Server","header_author":"WordPress.Org Community","header_description":"Use OpenID Connect to log in to other webservices using your own WordPress.","assets_banners_color":"","last_updated":"2025-04-17 11:48:06","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/Automattic\/wp-openid-connect-server","header_author_uri":"https:\/\/wordpress.org\/","rating":0,"author_block_rating":0,"active_installs":100,"downloads":8005,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","changelog"],"tags":{"1.0":{"tag":"1.0","author":"ashfame","date":"2022-11-01 20:27:50"},"1.1.0":{"tag":"1.1.0","author":"ashfame","date":"2022-11-02 15:24:07"},"1.1.1":{"tag":"1.1.1","author":"ashfame","date":"2023-04-05 07:34:48"},"1.2.1":{"tag":"1.2.1","author":"psrpinto","date":"2023-05-09 10:06:28"},"1.3.0":{"tag":"1.3.0","author":"psrpinto","date":"2023-05-30 15:11:02"},"1.3.1":{"tag":"1.3.1","author":"psrpinto","date":"2023-09-14 17:06:13"},"1.3.2":{"tag":"1.3.2","author":"psrpinto","date":"2023-09-22 16:06:54"},"1.3.3":{"tag":"1.3.3","author":"psrpinto","date":"2023-12-08 09:23:08"},"1.3.4":{"tag":"1.3.4","author":"psrpinto","date":"2024-06-26 09:19:52"},"2.0.0":{"tag":"2.0.0","author":"ashfame","date":"2025-04-17 11:48:06"}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0","1.1.0","1.1.1","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","2.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[],"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[2061,144098,162353,6694,43290],"plugin_category":[38],"plugin_contributors":[77497,79668,215111,77594],"plugin_business_model":[],"class_list":["post-164430","plugin","type-plugin","status-publish","hentry","plugin_tags-oauth","plugin_tags-oauth-server","plugin_tags-oidc","plugin_tags-openid","plugin_tags-openid-connect","plugin_category-authentication","plugin_contributors-akirk","plugin_contributors-ashfame","plugin_contributors-psrpinto","plugin_contributors-wordpressdotorg","plugin_committers-akirk","plugin_committers-ashfame","plugin_committers-automattic","plugin_committers-psrpinto"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/openid-connect-server.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>With this plugin you can use your own WordPress install to authenticate with a webservice that provides <a href=\"https:\/\/openid.net\/connect\/\">OpenID Connect<\/a> to implement Single-Sign On (SSO) for your users.<\/p>\n\n<p>The plugin is currently only configured using constants and hooks as follows:<\/p>\n\n<h3>Define the RSA keys<\/h3>\n\n<p>If you don't have keys that you want to use yet, generate them using these commands:<\/p>\n\n<pre><code>openssl genrsa -out oidc.key 4096\nopenssl rsa -in oidc.key -pubout -out public.key\n<\/code><\/pre>\n\n<p>And make them available to the plugin as follows (this needs to be added before WordPress loads):<\/p>\n\n<pre><code>define( 'OIDC_PUBLIC_KEY', &lt;&lt;&lt;OIDC_PUBLIC_KEY\n-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\nOIDC_PUBLIC_KEY\n);\n\ndefine( 'OIDC_PRIVATE_KEY', &lt;&lt;&lt;OIDC_PRIVATE_KEY\n-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\nOIDC_PRIVATE_KEY\n);\n<\/code><\/pre>\n\n<p>Alternatively, you can also put them outside the webroot and load them from the files like this:<\/p>\n\n<pre><code>define( 'OIDC_PUBLIC_KEY', file_get_contents( '\/web-inaccessible\/oidc.key' ) );\ndefine( 'OIDC_PRIVATE_KEY', file_get_contents( '\/web-inaccessible\/private.key' ) );\n<\/code><\/pre>\n\n<h3>Define the clients<\/h3>\n\n<p>Define your clients by adding a filter to <code>oidc_registered_clients<\/code> in a separate plugin file or <code>functions.php<\/code> of your theme or in a MU-plugin like:<\/p>\n\n<pre><code>add_filter( 'oidc_registered_clients', 'my_oidc_clients' );\nfunction my_oidc_clients() {\n    return array(\n        'client_id_random_string' =&gt; array(\n            'name' =&gt; 'The name of the Client',\n            'secret' =&gt; 'a secret string',\n            'redirect_uri' =&gt; 'https:\/\/example.com\/redirect.uri',\n            'grant_types' =&gt; array( 'authorization_code' ),\n            'scope' =&gt; 'openid profile',\n        ),\n    );\n}\n<\/code><\/pre>\n\n<h3>Exclude URL from caching<\/h3>\n\n<ul>\n<li><code>example.com\/wp-json\/openid-connect\/userinfo<\/code>: We implement caching exclusion measures for this endpoint by setting <code>Cache-Control: 'no-cache'<\/code> headers and defining the <code>DONOTCACHEPAGE<\/code> constant. If you have a unique caching configuration, please ensure that you manually exclude this URL from caching.<\/li>\n<\/ul>\n\n<h3>Github Repo<\/h3>\n\n<p>You can report any issues you encounter directly on <a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\">Github repo: Automattic\/wp-openid-connect-server<\/a><\/p>\n\n<!--section=changelog-->\n<h3>2.0.0<\/h3>\n\n<ul>\n<li>[Breaking] Add a configuration option to support clients that don't require consent <a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/118\">#118<\/a> props @lart2150<\/li>\n<li>Make client_id and client_secret optional for the token endpoint <a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/116\">#116<\/a> props @lart2150<\/li>\n<li>Update expected args specs for token endpoint as per OIDC spec <a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/117\">#117<\/a><\/li>\n<\/ul>\n\n<h3>1.3.4<\/h3>\n\n<ul>\n<li>Add the autoloader to the uninstall script <a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/111\">#111<\/a> props @MariaMozgunova<\/li>\n<\/ul>\n\n<h3>1.3.3<\/h3>\n\n<ul>\n<li>Fix failing login when Authorize form is non-English [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/108\">#108<\/a>]<\/li>\n<li>Improvements in site health tests for key detection [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/104\">#104<\/a>][<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/105\">#105<\/a>]<\/li>\n<\/ul>\n\n<h3>1.3.2<\/h3>\n\n<ul>\n<li>Prevent userinfo endpoint from being cached [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/99\">#99<\/a>]<\/li>\n<\/ul>\n\n<h3>1.3.0<\/h3>\n\n<ul>\n<li>Return <code>display_name<\/code> as the <code>name<\/code> property [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/87\">#87<\/a>]<\/li>\n<li>Change text domain to <code>openid-connect-server<\/code>, instead of <code>wp-openid-connect-server<\/code> [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/88\">#88<\/a>]<\/li>\n<\/ul>\n\n<h3>1.2.1<\/h3>\n\n<ul>\n<li>No user facing changes<\/li>\n<\/ul>\n\n<h3>1.2.0<\/h3>\n\n<ul>\n<li>Add <code>oidc_user_claims<\/code> filter [<a href=\"https:\/\/github.com\/Automattic\/wp-openid-connect-server\/pull\/82\">#82<\/a>]<\/li>\n<\/ul>","raw_excerpt":"Use OpenID Connect to log in to other webservices using your own WordPress.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/164430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=164430"}],"author":[{"embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/automattic"}],"wp:attachment":[{"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=164430"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=164430"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=164430"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=164430"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=164430"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/twd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=164430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}