OpenID Connect (OIDC) with WordPress Authorizer

A knowledge base article about OpenID Connect (OIDC) with WordPress Authorizer provided by the UC Berkeley IT Service Hub - Knowledge Portal

Configuring WordPress Authorizer with CalNet OIDC

Background

The WordPress Authorizer plugin supports OpenID Connect (OIDC). This plugin can be used to integrate WordPress with CalNet's SSO system. For more information on technical support for OIDC, see the OIDC Scopes and Claims (KB0015637) reference.

Example Configuration

Follow these high-level steps to configure the WordPress Authorizer plugin for use with CalNet's SSO system using OIDC.

  1. Submit an SSO Service Request with the CalNet team to obtain your credentials.
  2. Once you have the client_id and client_secret, configure the Authorizer plugin using the following settings under the External Service tab:
Field Value
OIDC Logins Enable OIDC logins
Custom label Sign in with CalNet
Issuer URL Production: https://auth.berkeley.edu/cas/oidc/.well-known
Test: https://auth-test.berkeley.edu/cas/oidc/.well-known
Client ID <provided by CalNet in step 1>
Client Secret <provided by CalNet in step 1>
Scopes openid email profile
Attribute containing username preferred_username
Attribute containing email email
Attribute containing first name given_name
Attribute containing last name family_name
OIDC Hosted Domain berkeley.edu

Your configuration should look similar to the following example:

Screenshot of WordPress Authorizer OIDC configuration settings.

Recommended Security Step: Once SSO is tested and confirmed, navigate to Authorizer > Advanced and enable Disable WordPress Logins. If you are working with an external vendor, you can add a bypass username. Disabling local logins in favor of SSO helps prevent brute-force attacks.

Screenshot of the Authorizer Advanced settings showing the Disable WordPress Logins option.

Important Notes

  • The username attribute preferred_username is the CalNet ID by default. If you require a different unique identifier, request this during the initial service request (Step 1).
  • The OIDC automatic login option should remain unchecked until after you have successfully validated that the SSO login flow is working correctly.

Support: If you have questions regarding OIDC or this plugin, please contact calnet-admin@berkeley.edu.