{"id":80590,"date":"2018-02-25T15:23:35","date_gmt":"2018-02-25T15:23:35","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/openid-connect-generic\/"},"modified":"2026-02-13T04:36:09","modified_gmt":"2026-02-13T04:36:09","slug":"daggerhart-openid-connect-generic","status":"publish","type":"plugin","link":"https:\/\/bal.wordpress.org\/plugins\/daggerhart-openid-connect-generic\/","author":6466358,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"3.11.3","stable_tag":"3.11.3","tested":"6.9.0","requires":"5.0","requires_php":"7.4","requires_plugins":null,"header_name":"OpenID Connect Generic","header_author":"daggerhart","header_description":"Connect to an OpenID Connect generic client using Authorization Code Flow","assets_banners_color":"","last_updated":"2026-02-13 04:36:09","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/oidc-wp\/openid-connect-generic","header_author_uri":"https:\/\/www.daggerhartlab.com","rating":5,"author_block_rating":0,"active_installs":10000,"downloads":182766,"num_ratings":20,"support_threads":1,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"3.10.0":{"tag":"3.10.0","author":"daggerhart","date":"2024-04-09 02:03:14"},"3.10.1":{"tag":"3.10.1","author":"daggerhart","date":"2025-12-13 13:51:11"},"3.10.2":{"tag":"3.10.2","author":"daggerhart","date":"2025-12-17 21:19:00"},"3.10.3":{"tag":"3.10.3","author":"daggerhart","date":"2026-02-05 19:14:15"},"3.10.4":{"tag":"3.10.4","author":"daggerhart","date":"2026-02-10 22:58:40"},"3.11.0":{"tag":"3.11.0","author":"daggerhart","date":"2026-02-12 13:03:09"},"3.11.1":{"tag":"3.11.1","author":"daggerhart","date":"2026-02-12 13:48:35"},"3.11.2":{"tag":"3.11.2","author":"daggerhart","date":"2026-02-12 21:33:34"},"3.11.3":{"tag":"3.11.3","author":"daggerhart","date":"2026-02-13 04:36:09"},"3.3.1":{"tag":"3.3.1","author":"daggerhart","date":"2018-02-25 15:24:25"},"3.4.1":{"tag":"3.4.1","author":"daggerhart","date":"2018-11-03 16:01:39"},"3.5.0":{"tag":"3.5.0","author":"daggerhart","date":"2019-07-05 16:21:07"},"3.6.0":{"tag":"3.6.0","author":"daggerhart","date":"2020-06-15 11:26:56"},"3.7.0":{"tag":"3.7.0","author":"daggerhart","date":"2020-08-13 12:44:03"},"3.7.1":{"tag":"3.7.1","author":"daggerhart","date":"2020-08-13 13:04:32"},"3.8.0":{"tag":"3.8.0","author":"daggerhart","date":"2020-09-11 02:36:44"},"3.8.1":{"tag":"3.8.1","author":"daggerhart","date":"2021-01-20 04:13:49"},"3.8.2":{"tag":"3.8.2","author":"daggerhart","date":"2021-03-24 14:14:35"},"3.8.3":{"tag":"3.8.3","author":"daggerhart","date":"2021-04-09 02:14:51"},"3.8.4":{"tag":"3.8.4","author":"daggerhart","date":"2021-04-10 21:05:36"},"3.8.5":{"tag":"3.8.5","author":"daggerhart","date":"2021-04-16 04:17:37"},"3.9.0":{"tag":"3.9.0","author":"daggerhart","date":"2022-03-23 01:48:21"},"3.9.1":{"tag":"3.9.1","author":"daggerhart","date":"2022-08-19 13:09:27"}},"upgrade_notice":{"3.11.3":"<p>SECURITY UPDATE: 3.11.x branch - Fixes authentication vulnerabilities including JWT signature bypass and SSRF protection. Update immediately and configure JWKS endpoint in settings.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":20},"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.10.4","3.11.0","3.11.1","3.11.2","3.11.3","3.3.1","3.4.1","3.5.0","3.6.0","3.7.0","3.7.1","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.9.0","3.9.1"],"block_files":[],"assets_screenshots":[],"screenshots":[],"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[896,602,12644,31802,600],"plugin_category":[38,54],"plugin_contributors":[82247,160238],"plugin_business_model":[],"class_list":["post-80590","plugin","type-plugin","status-publish","hentry","plugin_tags-apps","plugin_tags-login","plugin_tags-oauth2","plugin_tags-openidconnect","plugin_tags-security","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-daggerhart","plugin_contributors-tnolte","plugin_committers-daggerhart"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/daggerhart-openid-connect-generic.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>This plugin allows to authenticate users against OpenID Connect OAuth2 API with Authorization Code Flow.\nOnce installed, it can be configured to automatically authenticate users (SSO), or provide a \"Login with OpenID Connect\"\nbutton on the login form. After consent has been obtained, an existing user is automatically logged into WordPress, while\nnew users are created in WordPress database.<\/p>\n\n<p>Much of the documentation can be found on the Settings &gt; OpenID Connect Generic dashboard page.<\/p>\n\n<p>Please submit issues to the Github repo: https:\/\/github.com\/oidc-wp\/openid-connect-generic<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload to the <code>\/wp-content\/plugins\/<\/code> directory<\/li>\n<li>Activate the plugin<\/li>\n<li>Visit Settings &gt; OpenID Connect and configure to meet your needs<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20is%20the%20client%27s%20redirect%20uri%3F\"><h3>What is the client's Redirect URI?<\/h3><\/dt>\n<dd><p>Most OAuth2 servers will require whitelisting a set of redirect URIs for security purposes. The Redirect URI provided\nby this client is like so:  https:\/\/example.com\/wp-admin\/admin-ajax.php?action=openid-connect-authorize<\/p>\n\n<p>Replace <code>example.com<\/code> with your domain name and path to WordPress.<\/p><\/dd>\n<dt id=\"can%20i%20change%20the%20client%27s%20redirect%20uri%3F\"><h3>Can I change the client's Redirect URI?<\/h3><\/dt>\n<dd><p>Some OAuth2 servers do not allow for a client redirect URI to contain a query string. The default URI provided by\nthis module leverages WordPress's <code>admin-ajax.php<\/code> endpoint as an easy way to provide a route that does not include\nHTML, but this will naturally involve a query string. Fortunately, this plugin provides a setting that will make use of\nan alternate redirect URI that does not include a query string.<\/p>\n\n<p>On the settings page for this plugin (Dashboard &gt; Settings &gt; OpenID Connect Generic) there is a checkbox for\n<strong>Alternate Redirect URI<\/strong>. When checked, the plugin will use the Redirect URI\n    https:\/\/example.com\/openid-connect-authorize.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>3.11.3<\/h4>\n\n<ul>\n<li>Feature\/improvement: Added configurable issuer setting for JWT validation.<\/li>\n<\/ul>\n\n<h4>3.11.2<\/h4>\n\n<ul>\n<li>Improvement: Support identity providers that omit algorithm parameter in JWKS (Microsoft Entra ID).<\/li>\n<\/ul>\n\n<h4>3.11.1<\/h4>\n\n<ul>\n<li>Fix bug created in 3.11.0 release when comparing issuer to derived expected value.<\/li>\n<\/ul>\n\n<h4>3.11.0<\/h4>\n\n<p><strong>SECURITY RELEASE<\/strong><\/p>\n\n<ul>\n<li>Security: Added JWT signature verification using JWKS to prevent token forgery<\/li>\n<li>Security: Enhanced token claim validation (exp, aud, iss, iat, nonce)<\/li>\n<li>Security: Replaced weak state generation with cryptographically secure random_bytes()<\/li>\n<li>Security: Fixed open redirect vulnerability in authentication flow<\/li>\n<li>Security: Restricted SSL verification bypass to local development environments only<\/li>\n<li>Security: Added nonce protection to debug mode to prevent information disclosure<\/li>\n<li>Security: Added SSRF protection by default through use of wp_safe_remote_* functions<\/li>\n<li>Feature: Added JWKS endpoint configuration setting<\/li>\n<li>Feature: Added OpenID Connect discovery document support<\/li>\n<li>Feature: Added customizable login button text setting<\/li>\n<li>Improvement: Migrated to Composer-managed dependencies<\/li>\n<li>Fix: Corrected issuer validation to properly extract base URL from endpoints<\/li>\n<li>Fix: Identity token timestamp tracking<\/li>\n<\/ul>\n\n<h4>3.10.4<\/h4>\n\n<ul>\n<li>Fix issue with finding users on multisite after switch to user options in place of user meta.<\/li>\n<li>Improvement: Retry logins for some IDP errors to bypass issue with Safari ITP. Also improves display of error messages that come from the IDP.<\/li>\n<\/ul>\n\n<h4>3.10.3<\/h4>\n\n<ul>\n<li>Fix issue with log corruption causing fatal error.<\/li>\n<li>Fix: Fallback to a POST request for userinfo when GET fails.<\/li>\n<li>Fix: Improves multisite compatibility by switching to *_user_options() functions.<\/li>\n<li>Fix: Fix for WordPress user session length being very short when refresh tokens are enabled.<\/li>\n<\/ul>\n\n<h4>3.10.2<\/h4>\n\n<ul>\n<li>Fix: @socialmedialabs - Regression affecting SSO Auto Login with url handling improvement changes.<\/li>\n<\/ul>\n\n<h4>3.10.1<\/h4>\n\n<ul>\n<li>Chore: @daggerhart - Readme updates and clarifications.<\/li>\n<li>Chore: @daggerhart - Release workflow updates.<\/li>\n<li>Improved error handling for malformed urls.<\/li>\n<li>Fix: @JUVOJustin - Change request for userinfo to GET.<\/li>\n<li>Feature: @JUVOJustin - New filter for settings values <code>openid-connect-generic-settings<\/code>.<\/li>\n<li>Feature: @JUVOJustin - New filter for state values <code>openid-connect-generic-new-state-value<\/code>.<\/li>\n<\/ul>\n\n<h4>3.10.0<\/h4>\n\n<ul>\n<li>Chore: @timnolte - Dependency updates.<\/li>\n<li>Fix: @drzraf - Prevents running the auth url filter twice.<\/li>\n<li>Fix: @timnolte - Updates the log cleanup handling to properly retain the configured number of log entries.<\/li>\n<li>Fix: @timnolte - Updates the log display output to reflect the log retention policy.<\/li>\n<li>Chore: @timnolte - Adds Unit Testing &amp; New Local Development Environment.<\/li>\n<li>Feature: @timnolte - Updates logging to allow for tracking processing time.<\/li>\n<li>Feature: @menno-ll - Adds a remember me feature via a new filter.<\/li>\n<li>Improvement: @menno-ll - Updates WP Cookie Expiration to Same as Session Length.<\/li>\n<\/ul>\n\n<h4>3.9.1<\/h4>\n\n<ul>\n<li>Improvement: @timnolte - Refactors Composer setup and GitHub Actions.<\/li>\n<li>Improvement: @timnolte - Bumps WordPress tested version compatibility.<\/li>\n<\/ul>\n\n<h4>3.9.0<\/h4>\n\n<ul>\n<li>Feature: @matchaxnb - Added support for additional configuration constants.<\/li>\n<li>Feature: @schanzen - Added support for agregated claims.<\/li>\n<li>Fix: @rkcreation - Fixed access token not updating user metadata after login.<\/li>\n<li>Fix: @danc1248 - Fixed user creation issue on Multisite Networks.<\/li>\n<li>Feature: @RobjS - Added plugin singleton to support for more developer customization.<\/li>\n<li>Feature: @jkouris - Added action hook to allow custom handling of session expiration.<\/li>\n<li>Fix: @tommcc - Fixed admin CSS loading only on the plugin settings screen.<\/li>\n<li>Feature: @rkcreation - Added method to refresh the user claim.<\/li>\n<li>Feature: @Glowsome - Added acr_values support &amp; verification checks that it when defined in options is honored.<\/li>\n<li>Fix: @timnolte - Fixed regression which caused improper fallback on missing claims.<\/li>\n<li>Fix: @slykar - Fixed missing query string handling in redirect URL.<\/li>\n<li>Fix: @timnolte - Fixed issue with some user linking and user creation handling.<\/li>\n<li>Improvement: @timnolte - Fixed plugin settings typos and screen formatting.<\/li>\n<li>Security: @timnolte - Updated build tooling security vulnerabilities.<\/li>\n<li>Improvement: @timnolte - Changed build tooling scripts.<\/li>\n<\/ul>\n\n<h4>3.8.5<\/h4>\n\n<ul>\n<li>Fix: @timnolte - Fixed missing URL request validation before use &amp; ensure proper current page URL is setup for Redirect Back.<\/li>\n<li>Fix: @timnolte - Fixed Redirect URL Logic to Handle Sub-directory Installs.<\/li>\n<li>Fix: @timnolte - Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.<\/li>\n<\/ul>\n\n<h4>3.8.4<\/h4>\n\n<ul>\n<li>Fix: @timnolte - Fixed invalid State object access for redirection handling.<\/li>\n<li>Improvement: @timnolte - Fixed local wp-env Docker development environment.<\/li>\n<li>Improvement: @timnolte - Fixed Composer scripts for linting and static analysis.<\/li>\n<\/ul>\n\n<h4>3.8.3<\/h4>\n\n<ul>\n<li>Fix: @timnolte - Fixed problems with proper redirect handling.<\/li>\n<li>Improvement: @timnolte - Changes redirect handling to use State instead of cookies.<\/li>\n<li>Improvement: @timnolte - Refactored additional code to meet coding standards.<\/li>\n<\/ul>\n\n<h4>3.8.2<\/h4>\n\n<ul>\n<li>Fix: @timnolte - Fixed reported XSS vulnerability on WordPress login screen.<\/li>\n<\/ul>\n\n<h4>3.8.1<\/h4>\n\n<ul>\n<li>Fix: @timnolte - Prevent SSO redirect on password protected posts.<\/li>\n<li>Fix: @timnolte - CI\/CD build issues.<\/li>\n<li>Fix: @timnolte - Invalid redirect handling on logout for Auto Login setting.<\/li>\n<\/ul>\n\n<h4>3.8.0<\/h4>\n\n<ul>\n<li>Feature: @timnolte - Ability to use 6 new constants for setting client configuration instead of storing in the DB.<\/li>\n<li>Improvement: @timnolte - Plugin development &amp; contribution updates.<\/li>\n<li>Improvement: @timnolte - Refactored to meet WordPress coding standards.<\/li>\n<li>Improvement: @timnolte - Refactored to provide localization.<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/github.com\/oidc-wp\/openid-connect-generic\/blob\/main\/CHANGELOG.md#changelog\">See the previous changelogs here<\/a><\/p>","raw_excerpt":"A simple client that provides SSO or opt-in authentication against a generic OAuth2 Server implementation.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/80590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=80590"}],"author":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/daggerhart"}],"wp:attachment":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=80590"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=80590"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=80590"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=80590"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=80590"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=80590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}