ICC.gg Sign-In for OpenID Connect

A WordPress plugin that provides SSO (Single Sign-On) authentication against an OpenID Connect OAuth2 Identity Provider using Authorization Code Flow.

Features

• Auto Login (SSO) — Automatically redirect users to the Identity Provider for authentication
• Login Button — Add a "Login with OpenID Connect" button to the WordPress login form
• Button-Only Login Mode — Show the OpenID Connect button while hiding the WordPress username/password form
• Login Button Logo — Upload a logo from the WordPress media library to display before the button text
• JWT Signature Verification — JWKS-based JWT validation to prevent token forgery
• User Auto-Creation — Automatically create WordPress users from IDP claims
• Link Existing Users — Link existing WordPress accounts to IDP identities
• Email Domain Restriction 🔒 — Restrict login to specific email domains (e.g., company.com) or full email addresses (e.g., specificuser@gmail.com). Leave empty to allow all
• Token Refresh — Automatic access token refresh for supported IDPs
• End Session Support — Redirect to IDP logout endpoint on WordPress logout
• Discovery Document Import — Auto-populate settings from .well-known/openid-configuration
• Shortcodes — [icc_gg_sign_in_openid_connect_login_button] and [icc_gg_sign_in_openid_connect_auth_url]

Requirements

• WordPress 5.0+
• PHP 8.1+
• An OpenID Connect Identity Provider (Keycloak, Auth0, Okta, Azure AD, Google, etc.)

Installation

1. Download the plugin or clone this repository into /wp-content/plugins/
2. Activate the plugin through the WordPress admin panel
3. Go to Settings > OpenID Connect to configure

Quick Setup

Use the Discovery Document Import feature on the settings page:

1. Enter your IDP's discovery URL (e.g., https://your-idp.com/.well-known/openid-configuration)
2. Click Load Configuration
3. Fill in your Client ID and Client Secret
4. Click Save Changes

Supported IDPs:

• Auth0: https://{tenant}.{region}.auth0.com/.well-known/openid-configuration
• Keycloak: https://{domain}/realms/{realm}/.well-known/openid-configuration
• Okta: https://{domain}/.well-known/openid-configuration
• Azure AD: https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
• Google: https://accounts.google.com/.well-known/openid-configuration

Configuration Reference

OAuth Client Settings

User Settings

Environment Variables / Constants

All settings can be defined as PHP constants for added security and CI/CD support:

define( 'OIDC_CLIENT_ID', 'your-client-id' );
define( 'OIDC_CLIENT_SECRET', 'your-client-secret' );
define( 'OIDC_ENDPOINT_LOGIN_URL', 'https://idp.example.com/auth' );
define( 'OIDC_ENDPOINT_TOKEN_URL', 'https://idp.example.com/token' );
define( 'OIDC_ENDPOINT_USERINFO_URL', 'https://idp.example.com/userinfo' );
define( 'OIDC_ENDPOINT_LOGOUT_URL', 'https://idp.example.com/logout' );
define( 'OIDC_ENDPOINT_JWKS_URL', 'https://idp.example.com/certs' );
define( 'OIDC_CLIENT_SCOPE', 'openid profile email' );
define( 'OIDC_LOGIN_TYPE', 'button' );
define( 'OIDC_EMAIL_DOMAIN_RESTRICTION', 'company.com specificuser@gmail.com partner.org' );
define( 'OIDC_CREATE_IF_DOES_NOT_EXIST', true );
define( 'OIDC_LINK_EXISTING_USERS', true );
define( 'OIDC_ENFORCE_PRIVACY', false );
define( 'OIDC_REDIRECT_ON_LOGOUT', true );
define( 'OIDC_REDIRECT_USER_BACK', false );
define( 'OIDC_ENABLE_LOGGING', false );
define( 'OIDC_LOG_LIMIT', 1000 );

Redirect URI

The default redirect URI registered with your IDP should be:

https://your-site.com/wp-admin/admin-ajax.php?action=icc-gg-sign-in-openid-connect-authorize

If your IDP doesn't support query strings in redirect URIs, enable Alternate Redirect URI in settings to use:

https://your-site.com/icc-gg-sign-in-openid-connect-authorize

Hooks & Filters

The plugin provides many hooks for customization. See the main plugin file for the complete list including:

• icc_gg_sign_in_openid_connect_user_login_test — Control whether a user can log in based on their claim
• icc_gg_sign_in_openid_connect_user_creation_test — Control whether a new user can be created
• icc_gg_sign_in_openid_connect_alter_user_claim — Modify user claim data before user creation
• icc_gg_sign_in_openid_connect_alter_user_data — Modify user data before insertion
• icc_gg_sign_in_openid_connect_login_button_text — Customize the login button text
• icc_gg_sign_in_openid_connect_login_button_logo_id — Customize the login button logo attachment ID
• icc_gg_sign_in_openid_connect_user_logged_in — Action fired after successful login

Security

• JWKS-based JWT signature verification to prevent token forgery
• Cryptographically secure state generation (random_bytes)
• SSRF protection via wp_safe_remote_* by default
• SSL verification bypass restricted to local development environments only
• Nonce-protected settings forms
• Email domain restriction for access control

User Authentication & Creation

This plugin creates and authenticates WordPress users as a technical necessity of its core function — OpenID Connect Single Sign-On. User sessions are established only after successful authentication by the configured Identity Provider. User accounts are created only when explicitly enabled by the site administrator and only after the IDP has verified the user's identity.

Security measures protecting user login/creation:

About OpenID Connect

OpenID Connect (OIDC) is an open authentication protocol standardized by the OpenID Foundation. It extends the OAuth 2.0 authorization framework to provide identity verification and single sign-on capabilities. This plugin implements the OIDC Authorization Code Flow as defined in the OpenID Connect Core 1.0 specification, enabling WordPress sites to delegate authentication to a trusted Identity Provider (IDP) rather than managing user credentials directly.

The OpenID Foundation is a non-profit international standardization organization that develops and maintains the OpenID Connect protocol and related specifications. This plugin is an independent implementation and is not affiliated with, endorsed by, or sponsored by the OpenID Foundation.

Credits

ICC.gg Sign-In for OpenID Connect is maintained by Ivan Carlos.

Based on OpenID Connect Generic by daggerhart.

🧑‍💻 Consulting and technical support

• For personal support and queries, please submit a new issue to have it addressed.
• For commercial related questions, please contact me for consulting costs.