Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
en:2.0:single_sign_on:oidc_wordpress [2026/09/08 07:47] – [Setting up the Client (SP) in Admidio] kainhoferen:2.0:single_sign_on:oidc_wordpress [2026/09/09 18:12] (current) – kainhofer
Line 27: Line 27:
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients and displayed to the user on the login screen, but has no technical use)     * Choose an easily understood **label for the client** (only used in Admidio's list of clients and displayed to the user on the login screen, but has no technical use)
     * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the WordPress configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.     * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the WordPress configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.
 +    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Wordpress. If the field names are not alligned, login will not be possible, but the error message will be quite generic without helpful hints.     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Wordpress. If the field names are not alligned, login will not be possible, but the error message will be quite generic without helpful hints.
  
Line 48: Line 49:
 {{ :en:2.0:sso:sso_oidc_wp_02_plugin_configuration.png?direct&200 |}} {{ :en:2.0:sso:sso_oidc_wp_02_plugin_configuration.png?direct&200 |}}
  
-First, one has to copy over the OpenID endpoint URLs from Admidio's OpenID preferences (each URL has a copy button). You can find them here: 
-{{ :en:2.0:sso:sso_oidc_wp_06_oidc_setupendpoints.png?direct&800 |}} 
  
-The remaining settings in Wordpress are client-specific, so one first needs to setup the OpenID client in Admidio and configure WordPress and Admidio in parallel. 
  
 ==== Setting up the Client (SP) in Admidio ==== ==== Setting up the Client (SP) in Admidio ====
Line 58: Line 56:
  
 Return to Admidio's SSO preferences page, go to the "Single-Sign-On Client Administration" (the button right below the endpoint URLs and above the "Save" button), and create a new client.  Return to Admidio's SSO preferences page, go to the "Single-Sign-On Client Administration" (the button right below the endpoint URLs and above the "Save" button), and create a new client. 
 +{{ :en:2.0:sso:sso_oidc_01-07_clientadmin.png?direct&400 |}}
 +
 +The first step is to copy over the endpoint URLs from Admidio into the WordPress configuration. WordPress does not support automatic discovery, so the individual URLs (hidden by default in a foldable section at the top) must be copied individually:
 +{{ :en:2.0:sso:sso_oidc_wp_06_oidc_setupendpoints.png?direct&800 |}}
 +
 +The remaining settings are individual to the WordPress installation:
 {{ :en:2.0:sso:sso_oidc_wp_07_oidc_setupclient.png?direct&800 |}} {{ :en:2.0:sso:sso_oidc_wp_07_oidc_setupclient.png?direct&800 |}}
  
  • en/2.0/single_sign_on/oidc_wordpress.1788846437.txt.gz
  • Last modified: 2026/09/08 07:47
  • by kainhofer