Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
en:2.0:single_sign_on:oidc_wordpress [2026/09/06 18:28] – [Setting up the Client (SP) in Admidio] kainhoferen:2.0:single_sign_on:oidc_wordpress [2026/09/09 18:12] (current) – kainhofer
Line 27: Line 27:
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients and displayed to the user on the login screen, but has no technical use)     * Choose an easily understood **label for the client** (only used in Admidio's list of clients and displayed to the user on the login screen, but has no technical use)
     * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the WordPress configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.     * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the WordPress configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.
 +    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Wordpress. If the field names are not alligned, login will not be possible, but the error message will be quite generic without helpful hints.     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Wordpress. If the field names are not alligned, login will not be possible, but the error message will be quite generic without helpful hints.
  
Line 48: Line 49:
 {{ :en:2.0:sso:sso_oidc_wp_02_plugin_configuration.png?direct&200 |}} {{ :en:2.0:sso:sso_oidc_wp_02_plugin_configuration.png?direct&200 |}}
  
-First, one has to copy over the OpenID endpoint URLs from Admidio's OpenID preferences (each URL has a copy button). You can find them here: 
-{{ :en:2.0:sso:sso_oidc_wp_06_oidc_setupendpoints.png?direct&800 |}} 
  
-The remaining settings in Wordpress are client-specific, so one first needs to setup the OpenID client in Admidio and configure WordPress and Admidio in parallel. 
  
 ==== Setting up the Client (SP) in Admidio ==== ==== Setting up the Client (SP) in Admidio ====
Line 58: Line 56:
  
 Return to Admidio's SSO preferences page, go to the "Single-Sign-On Client Administration" (the button right below the endpoint URLs and above the "Save" button), and create a new client.  Return to Admidio's SSO preferences page, go to the "Single-Sign-On Client Administration" (the button right below the endpoint URLs and above the "Save" button), and create a new client. 
 +{{ :en:2.0:sso:sso_oidc_01-07_clientadmin.png?direct&400 |}}
 +
 +The first step is to copy over the endpoint URLs from Admidio into the WordPress configuration. WordPress does not support automatic discovery, so the individual URLs (hidden by default in a foldable section at the top) must be copied individually:
 +{{ :en:2.0:sso:sso_oidc_wp_06_oidc_setupendpoints.png?direct&800 |}}
 +
 +The remaining settings are individual to the WordPress installation:
 {{ :en:2.0:sso:sso_oidc_wp_07_oidc_setupclient.png?direct&800 |}} {{ :en:2.0:sso:sso_oidc_wp_07_oidc_setupclient.png?direct&800 |}}
  
   - The **Client Name** is the label of the client in Admidio's client list, it can be anything you like.   - The **Client Name** is the label of the client in Admidio's client list, it can be anything you like.
   - The **"Client ID"** and **"Client Secret"** in Admidio and WordPress have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.   - The **"Client ID"** and **"Client Secret"** in Admidio and WordPress have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.
 +    - Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
   - Enter the **scopes** you desire in the WordPress config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). Sonce the WordPress plugin does not support OpenID groups, the presence of the "groups" scope has no effect.   - Enter the **scopes** you desire in the WordPress config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). Sonce the WordPress plugin does not support OpenID groups, the presence of the "groups" scope has no effect.
   - In Admidio, choose which field should be sent to and used by the Wordpress Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible.   - In Admidio, choose which field should be sent to and used by the Wordpress Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible.
 +  - In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress. {{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}}
 +  - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration. {{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}}
 +  - OIDC also requires clients to register a URL where the user is returned after a logout. Admidio must be configured with the exact logout redirect URL that the WordPress plugin sends on the logout request. This is typically ''https://[YOUR-WORDPRESS]/wp-login.php?loggedout=true&lang=de_DE''. Insert this exactly in the "Allowed logout return URLs" box. Wildcards are allowed, so it's probably better to use ''https://[YOUR-WORDPRESS]/wp-login.php?loggedout=true*'' to allow any language.
 +  - WordPress's OIDC implementation does not support PKCE for increased security, which is enabled by Admidio by default. For this reason, make sure to disable the PKCE requirement in the OIDC client's advanced settings: {{ :en:2.0:sso:sso_oidc_04-04a_dw_settings_pkce.png?400 |}}
  
-- In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress. 
-{{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}} 
  
-  - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration. 
-{{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}} 
  
-  - WordPress's OIDC implementation does not support PKCE for increased security, which is enabled by Admidio by default. For this reason, make sure to disable the PKCE requirement in the OIDC client's advanced settings: +After saving the changes (both in WordPress and Admidio), the apps should should now be set up for single-sign-on in WordPress.
-{{ :en:2.0:sso:sso_oidc_04-04a_dw_settings_pkce.png?400 |}}+
  
  
 +==== Mapping Admidio roles to WordPress roles ====
  
-After saving the changes (both in WordPress and Admidio), the apps should should now be set up for single-sign-on in WordPress.+Although the Wordpress OpenID Connect plugin does not provide any graphical way to map roles passed from Admidio as OIDC groups to WordPress roles, one can hook into the WordPress internals and write a small plugin that assigns the proper WordPress roles based on OIDC groups. 
  
 +The following PHP code is a fully working skeleton, assigning WordPress roles based on OIDC groups, as specified in the mapping defined at the beginning of the plugin. Place this code in the file ''wp-content/mu-plugins/admidio-role-map.php'' of your WordPress installation. All files in the ''mu-plugins'' ("mu" is short for "must use") directory are always loaded by WordPress, so this plugin will not appear in the Plugin manager and does not need to be enabled:
  
 +<code php>
 +<?php
 +/** Plugin Name: Admidio OIDC role mapping */
 +
 +/**
 + * WP role slug => Admidio role names (or mapped group names) that grant it.
 + * Most privileged first: the first key with a match wins.
 + */
 +function admidio_role_map() {
 +  return array(
 +    'administrator' => array( 'Administrator', 'admin', 'Webmaster' ),
 +    'editor'        => array( 'editor', 'Board' ),
 +    'author'        => array( 'author', 'Trainer', 'Another Admidio Group' ),
 +    'contributor'   => array( 'contributor', 'Staff', 'Volunteer', 'Janitor' ),
 +    'subscriber'    => array( 'subscriber', 'Players' ),
 +  );
 +}
 +
 +add_action( 'openid-connect-wp-user-create', 'admidio_apply_role', 10, 2 );
 +add_action( 'openid-connect-wp-update-user-using-current-claim', 'admidio_apply_role', 10, 2 );
 +
 +function admidio_apply_role( $user, $user_claim ) {
 +  // Never modify the local WordPress administrator!
 +  if ( (int) $user->ID === 1 ) {
 +    return;
 +  }
 +
 +  // Retrieve the groups passed via OIDC and search through the map until the user has one of the given groups
 +  $groups = isset( $user_claim['groups'] ) ? (array) $user_claim['groups'] : array();
 +  $groups = array_map( 'strtolower', array_map( 'trim', array_filter( $groups, 'is_string' ) ) );
 +
 +  $role = '';
 +  foreach ( admidio_role_map() as $wp_role => $admidio_roles ) {
 +    $admidio_roles = array_map( 'strtolower', array_map( 'trim', $admidio_roles ) );
 +    if ( array_intersect( $admidio_roles, $groups ) ) {
 +      $role = $wp_role;
 +      break;
 +    }
 +  }
 +
 +  if ( '' === $role ) {
 +    // No mapped group: no WP access. Use 'subscriber' instead if you
 +    // prefer every Admidio user to keep a read-only account.
 +    $user->set_role( '' );
 +    return;
 +  }
 +
 +  if ( ! in_array( $role, (array) $user->roles, true ) ) {
 +    $user->set_role( $role ); // set_role replaces all existing roles
 +  }
 +}
 +
 +</code>
 ==== Setup completed, test Single-Sign-On ==== ==== Setup completed, test Single-Sign-On ====
  
  • en/2.0/single_sign_on/oidc_wordpress.1788712110.txt.gz
  • Last modified: 2026/09/06 18:28
  • by kainhofer