OpenID Connect (OIDC) with WordPress Authorizer

A knowledge base article about OpenID Connect (OIDC) with WordPress Authorizer provided by the UC Berkeley IT Service Hub - Knowledge Portal

Background

The WordPress Authorizer plugin supports OpenID Connect (OIDC).  This plugin can be used to integrate WordPress with CalNet's SSO system.  For more information on support for OIDC see OIDC Integration with CalNet.

Example Configuration

These are the high level steps to configure WordPress Authorizer for use with CalNet's SSO system using OIDC.

  1. Submit an SSO service request for OIDC.
  2. Once you have the client_id and client_secret you can configure Authorizer using the following settings under External Service:
    Field Value
    OIDC Logins Enable OIDC logins
    Custom label Sign in with CalNet
    Issuer URL https://auth.berkeley.edu/cas/oidc/.well-known (production)
    https://auth-test.berkeley.edu/cas/oidc/.well-known (test)
    Client ID <provided by CalNet in step 1>
    Client Secret <provided by CalNet in step 1>
    Scopes openid email profile
    Attribute containing username preferred_username
    Attribute containing email email
    Attribute containing first name given_name
    Attribute containing last name family_name
    OIDC Hosted Domain berkeley.edu
  3. Your configuration should look similar to the following example:
  4. Recommended: Once SSO is tested you should configured the Authorizer > Advanced > Disable WordPress Logins setting to be enabled.  If you are working with a vendor you can add a bypass username.  Disabling WordPress logins in favor of SSO will help prevent brute force login attempts.

Notes