| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_wordpress [2026/09/06 16:31] – [Quick Overview] kainhofer | en:2.0:single_sign_on:oidc_wordpress [2026/09/06 18:51] (current) – [Setting up the Client (SP) in Admidio] kainhofer |
|---|
| ==== Configuring the Service Provider (WordPress) ==== | ==== Configuring the Service Provider (WordPress) ==== |
| |
| There are several OpenID plugins for WordPress, but none of the free versions supports permission mapping based on groups. The best free plugin we found is the [[https://github.com/forumone/openid-connect-wp-dist|OpenID Connect for WP]] plugin, which is a hard fork of Jonathan Daggerhart's OpenID Connect Generic plugin (which he is no longer able to maintain due to WordPress's stance on WP Engine and the fallout of the actions of Matt Mullenweg). The "OpenID Connect for WP" plugin is not available in the Wordpress plugin directory, only the previous "OpenID Connect Generic" by Daggerhart. We still recommend to use the newer "OpenID Connect for WP" and install it manually (either using git or by downloading the plugin code to the WP installation). See the plugin's source code repository on GitHub: https://github.com/forumone/openid-connect-wp-dist | There are several OpenID plugins for WordPress, but none of the free versions supports permission mapping based on groups easily. The best free plugin we found is the [[https://github.com/forumone/openid-connect-wp-dist|OpenID Connect for WP]] plugin, which is a hard fork of Jonathan Daggerhart's OpenID Connect Generic plugin (which he is no longer able to maintain due to WordPress's stance on WP Engine and the fallout of the actions of Matt Mullenweg). The "OpenID Connect for WP" plugin is not available in the Wordpress plugin directory, only the previous "OpenID Connect Generic" by Daggerhart. We still recommend to use the newer "OpenID Connect for WP" and install it manually (either using git or by downloading the plugin code to the WP installation). See the plugin's source code repository on GitHub: https://github.com/forumone/openid-connect-wp-dist |
| | That plugin also allows mapping Admidio's groups to WordPress roles, but that involves writing a tiny Wordpress plugin for the mapping. See below for the instructions. |
| |
| If you have shell access to the WP installation, the easiest way is to use the git shell command: | If you have shell access to the WP installation, the easiest way is to use the git shell command: |
| - Enter the **scopes** you desire in the WordPress config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). Sonce the WordPress plugin does not support OpenID groups, the presence of the "groups" scope has no effect. | - Enter the **scopes** you desire in the WordPress config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). Sonce the WordPress plugin does not support OpenID groups, the presence of the "groups" scope has no effect. |
| - In Admidio, choose which field should be sent to and used by the Wordpress Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible. | - In Admidio, choose which field should be sent to and used by the Wordpress Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible. |
| | - In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress. {{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}} |
| | - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration. {{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}} |
| | - WordPress's OIDC implementation does not support PKCE for increased security, which is enabled by Admidio by default. For this reason, make sure to disable the PKCE requirement in the OIDC client's advanced settings: {{ :en:2.0:sso:sso_oidc_04-04a_dw_settings_pkce.png?400 |}} |
| |
| In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress. | |
| {{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}} | |
| {{ :en:2.0:sso:sso_oidc_wp_09_oidc_wpsettings.png?direct&300 |}} | |
| |
| - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration. | |
| {{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}} | |
| |
| |
