WP Manifestindependent plugin directory
manifest / security / wordpress-oauth

[LW] OAuth SSO GitLab

Dead simple OAuth login for Wordpress

★ 0stars
21composer installs

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitLab with WP-CLI:

wp plugin install https://gitlab.com/littlewonders/plugins/wordpress-oauth/-/archive/main/wordpress-oauth-main.zip

On Packagist as littlewonders/wordpress-oauth:

composer require littlewonders/wordpress-oauth
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Wordpress OAuth A bare-minimum Wordpress plugin to allow single-sign-on via OAuth. Tested with Amazon Cognito but should work with any OAuth compliant server. Originally forked from the wordpress plugin (oauth-client-for-user-authentication)[https://wordpress.org/plugins/oauth-client-for-user-authentication/], as when testing that plugin I found many security vulnerabilities so I decided to use it as a base and strip it back as much as possible to make the code easy to audit and understand. The plugin scope is designed to be deliberately very simple. It supports: - Adding a button to the login form to begin SSO - Authenticating with a single Identity Provider - Automatically redirecting /wp-login.php to begin the OAuth process with the IDP - Finding a user by any attribute returned by your IDP, against any wordpressusers column - Redirecting a user to your IDP's logout endpoint after logging out of Wordpress It does not, and will not, support: - Editing plugin settings from the wp-admin interface - Registering/making new users for IDP users - Syncing from / authenticating to LDAP - Multiple Identity Providers - OpenID Connect It does not currently support, but suppo