Body
Environment
WordPress CMS, AFS virtual host
Issue
How to install and configure OpenID Connect (OIDC) client for WordPress CMS in an AFS-based virtual host.
Before You Begin
- The steps below describe how to install and configure the OpenID Connect Generic Client WordPress plugin for your WordPress website.
For an alternative solution, see the ITS Knowledge Article Configure WordPress Site to Restrict Access Using OIDC Logins and MCommunity Groups. This alternative
- uses the UMich OIDC Login WordPress Plugin
- supports restricting access using MCommunity groups
- does not require visitors to have a WordPress user account on your website in order to authenticate
Important note: You can only use one of the two plugins above (UMich OIDC Login and OpenID Connect Generic Client). Attempting to use both plugins at the same time will break your website.
- You will need to obtain OIDC credentials for your site
- These can be self-provisioned using the OIDC Provisioning and Management (OPaM) tool
- Provision OIDC service client credentials for your site per the instructions in the following ITS Knowledge Article: How to Provision OIDC Service Client Credentials
Resolution
- If you are preparing for a NEW installation of WordPress, install WordPress per instructions in the ITS Knowledge Article "Install WordPress CMS in an AFS-Based Virtual Host" and then return here for the remaining steps in the current article.
- Install the SSH SFTP Updater to make GUI-based installations, upgrades, etc. easier
- Install the “OpenID Connect Generic Client” by daggerhart
- From the site administrator dashboard, navigate to “Plugins → Add New” and do a keyword search for “daggerhart” in the search bar
- Press the 'Install now' button
- Again, follow the instructions in the following document to use the ssh-sftp-updater-support plugin to install the OpenID Connect Generic Client: Updating ITS Web Hosting WordPress Sites Within the WP Dashboard
- After the plugin is installed, configure it by navigating to “Settings → OpenID Connect Client” in the site administrator dashboard:
- Configure the plugin using the following settings:
|
Setting Name
|
Setting Value
|
| Login Type |
Auto Login - SSO |
| Client ID |
${OIDC_ID} |
| Client Secret Key |
${OIDC_SECRET} |
| OpenID Scope |
openid email profile |
| Login Endpoint URL |
https://weblogin.umich.edu/idp/profile/oidc/authorize |
| Userinfo Endpoint URL |
https://weblogin.umich.edu/idp/profile/oidc/userinfo |
| Token Validation Endpoint URL |
https://weblogin.umich.edu/idp/profile/oidc/token |
| End Session Endpoint URL |
https://weblogin.umich.edu/logout |
| Enable Refresh Token |
unchecked |
| Link Existing Users |
checked |
| Redirect Back to Origin Page |
checked |
| Redirect to the login screen when session is expired |
checked |
- Save the updated settings using the 'Save' button at the bottom of the configuration page
Additional Information
Need additional information or assistance? Contact the ITS Service Center.