jfwenisch

<p>Keystone OIDC transforms your WordPress installation into a fully-featured <strong>OpenID Connect (OIDC) identity provider</strong>, allowing other applications to authenticate users via your WordPress user database.</p>
<h4>Key Features</h4>
<ul>
<li><strong>OIDC Authorization Code Flow</strong> with PKCE support</li>
<li><strong>RS256 JWT</strong> signed access tokens and ID tokens</li>
<li><strong>Admin UI</strong> to create and manage multiple OIDC clients</li>
<li><strong>Client secret management</strong> – generate and reset secrets securely (shown only once)</li>
<li><strong>OIDC Discovery</strong> endpoint (<code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code>) for automatic client configuration</li>
<li><strong>Standard scopes</strong>: <code>openid</code>, <code>profile</code>, <code>email</code></li>
<li><strong>Refresh tokens</strong> for long-lived sessions</li>
<li><strong>Zero additional configuration</strong> after install – just create a client and you’re ready</li>
</ul>
<h4>Quick Start</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Go to <strong>OIDC Provider <span aria-hidden="true" class="wp-exclude-emoji">→</span> Add Client</strong> in your WordPress admin</li>
<li>Enter your application name and redirect URI(s)</li>
<li>Copy the generated <strong>Client ID</strong> and <strong>Client Secret</strong> (shown once)</li>
<li>Configure your OIDC client application with the discovery URL shown in the settings</li>
</ol>
<h4>Endpoints</h4>
<p>All URLs are relative to your WordPress site root.</p>
<ul>
<li><strong>Discovery:</strong> <code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code></li>
<li><strong>Authorization:</strong> <code>/wenisch-tech/keystone-oidc/oauth/authorize</code></li>
<li><strong>Token:</strong> <code>/wenisch-tech/keystone-oidc/oauth/token</code></li>
<li><strong>UserInfo:</strong> <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code></li>
<li><strong>JWKS:</strong> <code>/wenisch-tech/keystone-oidc/oauth/jwks</code></li>
</ul>
<p>Compatibility aliases are also routed under <code>/wenisch-tech/keystone-oidc/protocol/openid-connect/*</code> for clients that still derive Keycloak-style paths from the custom issuer URI. These aliases are not advertised in discovery.</p>
<h4>UserInfo Example</h4>
<p>For <code>openid profile email</code>, <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code> returns:</p>
<pre><code>{
  "sub": "42",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "preferred_username": "jane",
  "email": "jane@example.com",
  "email_verified": true
}

sub is the WordPress user ID as a string, `preferred_username` is the WordPress `user_login`, and `email` is the WordPress `user_email`.
</code></pre>
<p>Roles are not currently emitted. The plugin does not expose WordPress roles or capabilities in UserInfo or ID tokens.</p>
<h3>[2.3.0](https://github.com/wenisch-tech/wordpress-keystone-oidc/compare/v2.2.2…v2.3.0) (2026-06-14)</h3>
<h3>Features</h3>
<ul>
<li>consent-screen now uses theme default colors if available (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/24beefead5ac2fab30e0945c58af3f009a733c1c" rel="nofollow ugc">24beefe</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>ensure compability with wordpress v7 (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/36f0d5040ee72d8f2ad9b76ff07da25ed5649bce" rel="nofollow ugc">36f0d50</a>)</li>
</ul>
<h4>2.2.2</h4>
<p>Released on 2026-06-12.</p>
<h4>Bug Fixes</h4>
<ul>
<li>updated release versioning and changelog creation (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/98cfb3062232f96346646f915a90198f69b17f51" rel="nofollow ugc">98cfb30</a>)</li>
<li>updated repository links (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/f46b2b6f2012cd348eab5e73f5ca9410f0efc406" rel="nofollow ugc">f46b2b6</a>)</li>
<li>updatet generation of changelog. (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/357bded5f6cd824859dfc4710d72bdbec60da983" rel="nofollow ugc">357bded</a>)</li>
</ul>
<h4>Documentation</h4>
<ul>
<li>added “Report a bug” button to plugin page (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/8281f6c5cfd9474e785c06eaf562e1a2cb84f47d" rel="nofollow ugc">8281f6c</a>)</li>
</ul>
<h4>1.0.0</h4>
<ul>
<li>Initial release</li>
<li>Authorization Code Flow with PKCE</li>
<li>RS256 JWT tokens</li>
<li>Multi-client admin UI with secret management</li>
<li>OIDC Discovery endpoint</li>
<li>Refresh token support</li>
</ul>


Keystone OIDC

Turn your WordPress site into an OpenID Connect (OIDC) identity provider. Manage clients through a simple admin panel.

miniOrange

<p>WordPress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any OpenID Connect provider that conforms to the OpenID Connect 1.0 standard.<br />
You can SSO to your WordPress site with any OAuth 2.0 or OpenID Connect 1.0 provider using this plugin.</p>
<h4>Description</h4>
<p>OpenID Connect Client plugin works with any OAuth/OpenIDConnect provider that conforms to the OAuth 2.0 or OpenID Connect 1.0 standard. OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. Each time you need to log in to a website using OIDC, you are redirected to your OpenID provider where you login, and then taken back to the website.</p>
<h4>Use-Cases</h4>
<ul>
<li>Login with Office365 (Office365 Login)</li>
<li>Login with Cognito (Cognito Login)</li>
<li>Login with Yahoo (Yahoo Login)</li>
<li>Login with WordPress (WordPress Login)</li>
<li>Login with Google (Google Login)</li>
<li>Login with Facebook (Facebook Login)<br />
and SSO with many more social login and mobile applications.</li>
</ul>
<p>WP OIDC / OpenID Connect client plugin enables user registration and authentication against any standard OpenID Connect (OIDC) Provider.</p>
<p>Login<br />
OIDC Client plugin enables a WordPress site to send users to an external OpenID Provider for login.</p>
<p>Registration<br />
If the user has an existing account in the OpenID Connect Provider, but not in WordPress, this plugin will enable dynamic registration of the user in WordPress.</p>
<h4>List of popular OpenID Connect Providers we support</h4>
<ul>
<li>Office 365</li>
<li>AWS Cognito</li>
<li>Amazon</li>
<li>SalesForce</li>
<li>PayPal</li>
<li>Microsoft</li>
<li>Yahoo</li>
<li>Google</li>
<li>Onelogin</li>
<li>Okta</li>
<li>ADFS</li>
<li>Gigya</li>
<li>DID.app</li>
<li>PhantAuth</li>
<li>Openidentityplatform</li>
<li>Yelp</li>
</ul>
<h4>List of popular OAuth Providers we support</h4>
<ul>
<li>WSO2</li>
<li>Eve Online</li>
<li>Slack</li>
<li>Discord</li>
<li>HR Answerlink / Support center</li>
<li>Wechat</li>
<li>Weibo</li>
<li>AWS cognito</li>
<li>Azure AD</li>
<li>Gitlab</li>
<li>Shibboleth</li>
<li>Blizzard (Formerly Battle.net)</li>
<li>servicem8</li>
<li>Meetup</li>
<li>DigitalID</li>
<li>Aerobase</li>
<li>Yandex</li>
<li>ORY Hydra</li>
<li>Odex</li>
</ul>
<h4>Other OpenID Connect/OAuth Providers we support</h4>
<ul>
<li>Keycloak, Foursquare, Harvest, Mailchimp, Bitrix24, Spotify, Vkontakte, Huddle, Reddit, Strava, Ustream, Yammer, RunKeeper, Instagram, SoundCloud, Pocket, PayPal, Pinterest, Vimeo, Nest, Heroku, DropBox, Buffer, Box, Hubic, Deezer, DeviantArt, Delicious, Dailymotion, Bitly, Mondo, Netatmo, Amazon, WHMCS, FitBit, Clever, Sqaure Connect, Windows, Dash 10, Github, Invision Comminuty, Blizzar, authlete etc.</li>
</ul>
<h4>List of grant types we support</h4>
<ul>
<li>Authorization code grant</li>
<li>Implicit grant</li>
<li>Resource owner credentials grant (Password Grant)</li>
<li>Client credentials grant</li>
<li>Refresh token grant</li>
</ul>
<h4>FREE VERSION FEATURES</h4>
<ul>
<li>WordPress OpenID Connect Client (OIDC Client) supports single sign-on / SSO with any 3rd party OAuth / OpenIDConnect server or custom OAuth / OpenIDConnect server.</li>
<li>Auto Create Users : After SSO, new user automatically gets created in WordPress</li>
<li>Account Linking : After user SSO to WordPress, if user already exists in WordPress, then his profile gets updated or it will create a new WordPress User</li>
<li>Attribute Mapping : OpenIDConnect Client supports username Attribute Mapping feature to map WordPress user profile username attribute.</li>
<li>Login Widget : Use Widgets to easily integrate the login link with your WordPress site</li>
<li>OAuth / OpenID Connect Provider Support : OpenIDConnect / OAuth Login supports only one OAuth / OpenID Connect Provider. </li>
<li>Redirect URL after Login : OpenIDConnect / OAuth Login Automatically Redirects user after successful login. </li>
<li>Logging :  If you run into issues OAuth Login can be helpful to enable debug logging</li>
</ul>
<h4>STANDARD VERSION FEATURES</h4>
<ul>
<li>All the FREE Version Features included.</li>
<li>Optionally Auto Register Users : OpenIDConnect Login does automatic user registration after login if the user is not already registered with your site</li>
<li>Basic Role Mapping :  OpenIDConnect Client provides basic Attribute Mapping feature to map WordPress user profile attributes like username, firstname, lastname, email and profile picture. Manage username & email with data provided.<br />
                      Also, Assign default role to user registering through OIDC Login based on rules you define.</li>
<li>Support for Shortcode : Use shortcode to place OIDC / OAuth login button anywhere in your Theme or Plugin</li>
<li>Customize Login Buttons / Icons / Text : Wide range of OpenIDConnect / OAuth Login Buttons/Icons and it allows you to customize Text shadow</li>
<li>Custom Redirect URL after Login : WordPress OpenIDConnect SSO provides auto redirection and this is useful if you wanted to globally protect your whole site</li>
<li>Custom Redirect URL after logout : WordPress OIDC SSO allows you to auto redirect Users to custom URL after he logs out from your WordPress site</li>
</ul>
<h4>PREMIUM VERSION FEATURES</h4>
<ul>
<li>All the STANDARD Version Features</li>
<li>Advanced Role Mapping : Assign roles to users registering through OAuth Login based on rules you define.</li>
<li>Force Authentication / Protect Complete Site : Allows user to restrict login / authorization for particular site</li>
<li>Multiple Userinfo Endpoints Support : OIDC Login supports multiple Userinfo Endpoints.</li>
<li>App domain specific Registration Restrictions : OIDC Login restricts registration on your site based on the person’s email address domain</li>
<li>Multi-site Support : OIDC Login have unique ability to support multiple sites under one account</li>
</ul>
<h4>ENTERPRISE VERSION FEATURES</h4>
<ul>
<li>All the PREMIUM Version Features</li>
<li>Multiple OAuth / OpenID Connect Provider Support</li>
<li>Single Login button for Multiple Apps : It provides single login button for multiple providers</li>
<li>Extended OIDC / OAuth API support : Extend OAuth API support to extend functionality to the existing OAuth client.</li>
<li>BuddyPress Attribute Mapping : OIDC Login allows BuddyPress Attribute Mapping.</li>
<li>Page Restriction according to roles : Limit Access to pages based on user status or roles. This WordPress OIDC Login plugin allows you to restrict access to the content of a page or post to which only certain group of users can access.</li>
<li>WP Hooks for Different Events : Provides support for different hooks for user defined functions</li>
<li>Login Reports : OIDC Login creates user login and registration reports based on application used. </li>
</ul>
<h4>REST API Authentication</h4>
<p>Secures the unauthorized access to your WordPress sites/pages using our <a href="https://wordpress.org/plugins/wp-rest-api-authentication/">WordPress REST API Authentication</a> plugin.</p>


WordPress OpenID Connect Client

Wordpress OpenID Connect (OIDC / openidconnect) Client plugin allows Single Sign On (SSO) with any…

Keystone OIDC vs WordPress OpenID Connect Client