jfwenisch

<p>Keystone OIDC transforms your WordPress installation into a fully-featured <strong>OpenID Connect (OIDC) identity provider</strong>, allowing other applications to authenticate users via your WordPress user database.</p>
<h4>Key Features</h4>
<ul>
<li><strong>OIDC Authorization Code Flow</strong> with PKCE support</li>
<li><strong>RS256 JWT</strong> signed access tokens and ID tokens</li>
<li><strong>Admin UI</strong> to create and manage multiple OIDC clients</li>
<li><strong>Client secret management</strong> – generate and reset secrets securely (shown only once)</li>
<li><strong>OIDC Discovery</strong> endpoint (<code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code>) for automatic client configuration</li>
<li><strong>Standard scopes</strong>: <code>openid</code>, <code>profile</code>, <code>email</code></li>
<li><strong>Refresh tokens</strong> for long-lived sessions</li>
<li><strong>Zero additional configuration</strong> after install – just create a client and you’re ready</li>
</ul>
<h4>Quick Start</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Go to <strong>OIDC Provider <span aria-hidden="true" class="wp-exclude-emoji">→</span> Add Client</strong> in your WordPress admin</li>
<li>Enter your application name and redirect URI(s)</li>
<li>Copy the generated <strong>Client ID</strong> and <strong>Client Secret</strong> (shown once)</li>
<li>Configure your OIDC client application with the discovery URL shown in the settings</li>
</ol>
<h4>Endpoints</h4>
<p>All URLs are relative to your WordPress site root.</p>
<ul>
<li><strong>Discovery:</strong> <code>/wenisch-tech/keystone-oidc/.well-known/openid-configuration</code></li>
<li><strong>Authorization:</strong> <code>/wenisch-tech/keystone-oidc/oauth/authorize</code></li>
<li><strong>Token:</strong> <code>/wenisch-tech/keystone-oidc/oauth/token</code></li>
<li><strong>UserInfo:</strong> <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code></li>
<li><strong>JWKS:</strong> <code>/wenisch-tech/keystone-oidc/oauth/jwks</code></li>
</ul>
<p>Compatibility aliases are also routed under <code>/wenisch-tech/keystone-oidc/protocol/openid-connect/*</code> for clients that still derive Keycloak-style paths from the custom issuer URI. These aliases are not advertised in discovery.</p>
<h4>UserInfo Example</h4>
<p>For <code>openid profile email</code>, <code>/wenisch-tech/keystone-oidc/oauth/userinfo</code> returns:</p>
<pre><code>{
  "sub": "42",
  "name": "Jane Doe",
  "given_name": "Jane",
  "family_name": "Doe",
  "preferred_username": "jane",
  "email": "jane@example.com",
  "email_verified": true
}

sub is the WordPress user ID as a string, `preferred_username` is the WordPress `user_login`, and `email` is the WordPress `user_email`.
</code></pre>
<p>Roles are not currently emitted. The plugin does not expose WordPress roles or capabilities in UserInfo or ID tokens.</p>
<h3>[2.3.0](https://github.com/wenisch-tech/wordpress-keystone-oidc/compare/v2.2.2…v2.3.0) (2026-06-14)</h3>
<h3>Features</h3>
<ul>
<li>consent-screen now uses theme default colors if available (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/24beefead5ac2fab30e0945c58af3f009a733c1c" rel="nofollow ugc">24beefe</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>ensure compability with wordpress v7 (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/36f0d5040ee72d8f2ad9b76ff07da25ed5649bce" rel="nofollow ugc">36f0d50</a>)</li>
</ul>
<h4>2.2.2</h4>
<p>Released on 2026-06-12.</p>
<h4>Bug Fixes</h4>
<ul>
<li>updated release versioning and changelog creation (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/98cfb3062232f96346646f915a90198f69b17f51" rel="nofollow ugc">98cfb30</a>)</li>
<li>updated repository links (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/f46b2b6f2012cd348eab5e73f5ca9410f0efc406" rel="nofollow ugc">f46b2b6</a>)</li>
<li>updatet generation of changelog. (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/357bded5f6cd824859dfc4710d72bdbec60da983" rel="nofollow ugc">357bded</a>)</li>
</ul>
<h4>Documentation</h4>
<ul>
<li>added “Report a bug” button to plugin page (<a href="https://github.com/wenisch-tech/wordpress-keystone-oidc/commit/8281f6c5cfd9474e785c06eaf562e1a2cb84f47d" rel="nofollow ugc">8281f6c</a>)</li>
</ul>
<h4>1.0.0</h4>
<ul>
<li>Initial release</li>
<li>Authorization Code Flow with PKCE</li>
<li>RS256 JWT tokens</li>
<li>Multi-client admin UI with secret management</li>
<li>OIDC Discovery endpoint</li>
<li>Refresh token support</li>
</ul>


Keystone OIDC

Turn your WordPress site into an OpenID Connect (OIDC) identity provider. Manage clients through a simple admin panel.

Automattic

WordPress.org

Alex Kirk

Ashish Kumar (Ashfame)

Paulo Pinto

<p>With this plugin you can use your own WordPress install to authenticate with a webservice that provides <a href="https://openid.net/connect/" rel="nofollow ugc">OpenID Connect</a> to implement Single-Sign On (SSO) for your users.</p>
<p>The plugin is currently only configured using constants and hooks as follows:</p>
<h3>Define the RSA keys</h3>
<p>If you don’t have keys that you want to use yet, generate them using these commands:</p>
<pre><code>openssl genrsa -out oidc.key 4096
openssl rsa -in oidc.key -pubout -out public.key
</code></pre>
<p>And make them available to the plugin as follows (this needs to be added before WordPress loads):</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', <<<OIDC_PUBLIC_KEY
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
OIDC_PUBLIC_KEY
);

define( 'OIDC_PRIVATE_KEY', <<<OIDC_PRIVATE_KEY
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
OIDC_PRIVATE_KEY
);
</code></pre>
<p>Alternatively, you can also put them outside the webroot and load them from the files like this:</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', file_get_contents( '/web-inaccessible/oidc.key' ) );
define( 'OIDC_PRIVATE_KEY', file_get_contents( '/web-inaccessible/private.key' ) );
</code></pre>
<h3>Define the clients</h3>
<p>Define your clients by adding a filter to <code>oidc_registered_clients</code> in a separate plugin file or <code>functions.php</code> of your theme or in a MU-plugin like:</p>
<pre><code>add_filter( 'oidc_registered_clients', 'my_oidc_clients' );
function my_oidc_clients() {
    return array(
        'client_id_random_string' => array(
            'name' => 'The name of the Client',
            'secret' => 'a secret string',
            'redirect_uri' => 'https://example.com/redirect.uri',
            'grant_types' => array( 'authorization_code' ),
            'scope' => 'openid profile',
        ),
    );
}
</code></pre>
<h3>Exclude URL from caching</h3>
<ul>
<li><code>example.com/wp-json/openid-connect/userinfo</code>: We implement caching exclusion measures for this endpoint by setting <code>Cache-Control: 'no-cache'</code> headers and defining the <code>DONOTCACHEPAGE</code> constant. If you have a unique caching configuration, please ensure that you manually exclude this URL from caching.</li>
</ul>
<h3>Github Repo</h3>
<p>You can report any issues you encounter directly on <a href="https://github.com/Automattic/wp-openid-connect-server" rel="nofollow ugc">Github repo: Automattic/wp-openid-connect-server</a></p>


OpenID Connect Server

Use OpenID Connect to log in to other webservices using your own WordPress.

Keystone OIDC vs OpenID Connect Server