Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_wordpress [2026/09/06 16:31] – [Quick Overview] kainhofer
+++ en:2.0:single_sign_on:oidc_wordpress [2026/09/07 00:03] (current) – [Setting up the Client (SP) in Admidio] kainhofer
@@ Line 34: / Line 34: @@
 ==== Configuring the Service Provider (WordPress) ====
-There are several OpenID plugins for WordPress, but none of the free versions supports permission mapping based on groups. The best free plugin we found is the [[https://github.com/forumone/openid-connect-wp-dist|OpenID Connect for WP]] plugin, which is a hard fork of Jonathan Daggerhart's OpenID Connect Generic plugin (which he is no longer able to maintain due to WordPress's stance on WP Engine and the fallout of the actions of Matt Mullenweg). The "OpenID Connect for WP" plugin is not available in the Wordpress plugin directory, only the previous "OpenID Connect Generic" by Daggerhart. We still recommend to use the newer "OpenID Connect for WP" and install it manually (either using git or by downloading the plugin code to the WP installation). See the plugin's source code repository on GitHub: https://github.com/forumone/openid-connect-wp-dist
+There are several OpenID plugins for WordPress, but none of the free versions supports permission mapping based on groups easily. The best free plugin we found is the [[https://github.com/forumone/openid-connect-wp-dist|OpenID Connect for WP]] plugin, which is a hard fork of Jonathan Daggerhart's OpenID Connect Generic plugin (which he is no longer able to maintain due to WordPress's stance on WP Engine and the fallout of the actions of Matt Mullenweg). The "OpenID Connect for WP" plugin is not available in the Wordpress plugin directory, only the previous "OpenID Connect Generic" by Daggerhart. We still recommend to use the newer "OpenID Connect for WP" and install it manually (either using git or by downloading the plugin code to the WP installation). See the plugin's source code repository on GitHub: https://github.com/forumone/openid-connect-wp-dist
+That plugin also allows mapping Admidio's groups to WordPress roles, but that involves writing a tiny Wordpress plugin for the mapping. See below for the instructions.
 If you have shell access to the WP installation, the easiest way is to use the git shell command:
@@ Line 63: / Line 64: @@
   - Enter the **scopes** you desire in the WordPress config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). Sonce the WordPress plugin does not support OpenID groups, the presence of the "groups" scope has no effect.
   - In Admidio, choose which field should be sent to and used by the Wordpress Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible.
+  - In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress. {{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}}
+  - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration. {{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}}
+  - OIDC also requires clients to register a URL where the user is returned after a logout. Admidio must be configured with the exact logout redirect URL that the WordPress plugin sends on the logout request. This is typically ''https://[YOUR-WORDPRESS]/wp-login.php?loggedout=true&lang=de_DE''. Insert this exactly in the "Allowed logout return URLs" box. Wildcards are allowed, so it's probably better to use ''https://[YOUR-WORDPRESS]/wp-login.php?loggedout=true*'' to allow any language.
+  - WordPress's OIDC implementation does not support PKCE for increased security, which is enabled by Admidio by default. For this reason, make sure to disable the PKCE requirement in the OIDC client's advanced settings: {{ :en:2.0:sso:sso_oidc_04-04a_dw_settings_pkce.png?400 |}}
-In addition, WordPress also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the WordPress user's ID, nickname, email and fullname, as well as flags to enable automatic user creation when a new user logs in to WordPress.
-{{ :en:2.0:sso:sso_oidc_wp_08_oidc_wpsettings.png?direct&800 |}}
-{{ :en:2.0:sso:sso_oidc_wp_09_oidc_wpsettings.png?direct&300 |}}
-  - WordPress will display its **Redirect URL** at the very bottom of the form, which needs to be copied to Admidio's OpenID client configuration.
-{{ :en:2.0:sso:sso_oidc_wp_10_redirecturl.png?direct&800 |}}
@@ Line 75: / Line 74: @@
+==== Mapping Admidio roles to WordPress roles ====
+Although the Wordpress OpenID Connect plugin does not provide any graphical way to map roles passed from Admidio as OIDC groups to WordPress roles, one can hook into the WordPress internals and write a small plugin that assigns the proper WordPress roles based on OIDC groups.
+The following PHP code is a fully working skeleton, assigning WordPress roles based on OIDC groups, as specified in the mapping defined at the beginning of the plugin. Place this code in the file ''wp-content/mu-plugins/admidio-role-map.php'' of your WordPress installation. All files in the ''mu-plugins'' ("mu" is short for "must use") directory are always loaded by WordPress, so this plugin will not appear in the Plugin manager and does not need to be enabled:
+<code php>
+<?php
+/** Plugin Name: Admidio OIDC role mapping */
+/**
+ * WP role slug => Admidio role names (or mapped group names) that grant it.
+ * Most privileged first: the first key with a match wins.
+ */
+function admidio_role_map() {
+  return array(
+    'administrator' => array( 'Administrator', 'admin', 'Webmaster' ),
+    'editor'        => array( 'editor', 'Board' ),
+    'author'        => array( 'author', 'Trainer', 'Another Admidio Group' ),
+    'contributor'   => array( 'contributor', 'Staff', 'Volunteer', 'Janitor' ),
+    'subscriber'    => array( 'subscriber', 'Players' ),
+  );
+}
+add_action( 'openid-connect-wp-user-create', 'admidio_apply_role', 10, 2 );
+add_action( 'openid-connect-wp-update-user-using-current-claim', 'admidio_apply_role', 10, 2 );
+function admidio_apply_role( $user, $user_claim ) {
+  // Never modify the local WordPress administrator!
+  if ( (int) $user->ID === 1 ) {
+    return;
+  }
+  // Retrieve the groups passed via OIDC and search through the map until the user has one of the given groups
+  $groups = isset( $user_claim['groups'] ) ? (array) $user_claim['groups'] : array();
+  $groups = array_map( 'strtolower', array_map( 'trim', array_filter( $groups, 'is_string' ) ) );
+  $role = '';
+  foreach ( admidio_role_map() as $wp_role => $admidio_roles ) {
+    $admidio_roles = array_map( 'strtolower', array_map( 'trim', $admidio_roles ) );
+    if ( array_intersect( $admidio_roles, $groups ) ) {
+      $role = $wp_role;
+      break;
+    }
+  }
+  if ( '' === $role ) {
+    // No mapped group: no WP access. Use 'subscriber' instead if you
+    // prefer every Admidio user to keep a read-only account.
+    $user->set_role( '' );
+    return;
+  }
+  if ( ! in_array( $role, (array) $user->roles, true ) ) {
+    $user->set_role( $role ); // set_role replaces all existing roles
+  }
+}
+</code>
 ==== Setup completed, test Single-Sign-On ====