Title: OpenID Connect Generic Client Author: Jonathan Daggerhart Published: 25 February 2018 Last modified: 13 February 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/daggerhart-openid-connect-generic.svg) # OpenID Connect Generic Client By [Jonathan Daggerhart](https://profiles.wordpress.org/daggerhart/) [Download](https://downloads.wordpress.org/plugin/daggerhart-openid-connect-generic.3.11.3.zip) * [Details](https://en-gb.wordpress.org/plugins/daggerhart-openid-connect-generic/#description) * [Reviews](https://en-gb.wordpress.org/plugins/daggerhart-openid-connect-generic/#reviews) * [Installation](https://en-gb.wordpress.org/plugins/daggerhart-openid-connect-generic/#installation) * [Development](https://en-gb.wordpress.org/plugins/daggerhart-openid-connect-generic/#developers) [Support](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/) ## Description This plugin allows to authenticate users against OpenID Connect OAuth2 API with Authorization Code Flow. Once installed, it can be configured to automatically authenticate users (SSO), or provide a “Login with OpenID Connect” button on the login form. After consent has been obtained, an existing user is automatically logged into WordPress, while new users are created in WordPress database. Much of the documentation can be found on the Settings > OpenID Connect Generic dashboard page. Please submit issues to the Github repo: https://github.com/oidc-wp/openid-connect- generic ## Installation 1. Upload to the `/wp-content/plugins/` directory 2. Activate the plugin 3. Visit Settings > OpenID Connect and configure to meet your needs ## FAQ ### What is the client’s Redirect URI? Most OAuth2 servers will require whitelisting a set of redirect URIs for security purposes. The Redirect URI provided by this client is like so: https://example. com/wp-admin/admin-ajax.php?action=openid-connect-authorize Replace `example.com` with your domain name and path to WordPress. ### Can I change the client’s Redirect URI? Some OAuth2 servers do not allow for a client redirect URI to contain a query string. The default URI provided by this module leverages WordPress’s `admin-ajax.php` endpoint as an easy way to provide a route that does not include HTML, but this will naturally involve a query string. Fortunately, this plugin provides a setting that will make use of an alternate redirect URI that does not include a query string. On the settings page for this plugin (Dashboard > Settings > OpenID Connect Generic) there is a checkbox for **Alternate Redirect URI**. When checked, the plugin will use the Redirect URI https://example.com/openid-connect-authorize. ## Reviews ![](https://secure.gravatar.com/avatar/bc0d333b726b5c2d59d6d48f86554ab33662b7ba5d88f5696c8af9ee4dbbfed8? s=60&d=retro&r=g) ### 󠀁[Works like a charm](https://wordpress.org/support/topic/works-like-a-charm-2475/)󠁿 [liamdousti](https://profiles.wordpress.org/liamdousti/) 3 October 2026 Thank you so much! This works so well, really appreciate it! ![](https://secure.gravatar.com/avatar/f1286efadd49d5734bc82e0c90001f94734817f2f49f9ecf3b2052356c01d99c? s=60&d=retro&r=g) ### 󠀁[Excellent plugin and outstanding developer support](https://wordpress.org/support/topic/excellent-plugin-and-outstanding-developer-support-2/)󠁿 [lmu007](https://profiles.wordpress.org/lmu007/) 14 February 2026 I’m using this OpenID Connect Generic Client plugin to integrate WordPress with Microsoft Entra ID (Azure AD), and it works exactly as expected. During my setup I encountered a JWT validation issue related to JWKS handling. I reported it to the developer, and the response was absolutely impressive — the issue was understood, fixed, and resolved in less than 24 hours. This level of responsiveness and professionalism is rare and highly appreciated. The plugin itself is clean, flexible, and perfectly suited for enterprise authentication scenarios. It integrates smoothly with modern identity providers and gives full control over the configuration. Huge thanks to the developer for the fast support and for maintaining such a reliable and well- designed plugin.Highly recommended for anyone needing OpenID Connect / SSO on WordPress. ![](https://secure.gravatar.com/avatar/9d994ad53b94908ef7001f8b2af1c9ce753f3e700feddaf558ec585c45f97ad8? s=60&d=retro&r=g) ### 󠀁[Great Plugin!](https://wordpress.org/support/topic/great-plugin-40188/)󠁿 [Robert](https://profiles.wordpress.org/robert-knasmueller/) 24 February 2025 We have been using the plugin for several years. It's without frills and works absolutely reliably. Many thanks! ![](https://secure.gravatar.com/avatar/e2fa8645ce5dde985236ecd1555661ee4d8debab614e7390e7be296e6bc88d19? s=60&d=retro&r=g) ### 󠀁[It just works!](https://wordpress.org/support/topic/it-just-works-831/)󠁿 [imoorena](https://profiles.wordpress.org/imoorena/) 28 August 2024 As simple as it needs to be with no added cruft. Easy to configure and use. ![](https://secure.gravatar.com/avatar/d119cd485d9a60f982ed3842a86f47d32646792d961f2b65d1c1ca59bbcbb627? s=60&d=retro&r=g) ### 󠀁[Best OpenID plugin and free!](https://wordpress.org/support/topic/best-openid-plugin-and-free/)󠁿 [Matthias Kittsteiner](https://profiles.wordpress.org/kittmedia/) 17 October 2023 After testing multiple OpenID plugins – even paid one – this is by far the best. Thank you! Some suggestions for improvements: more flexible filtering, better documentation and enhanced multisite support. ![](https://secure.gravatar.com/avatar/5c63786d537517896dac24d0f96e71334654b273795ee416e6e7ed5afc560a3d? s=60&d=retro&r=g) ### 󠀁[Best Openid client plugin by far.](https://wordpress.org/support/topic/best-openid-client-plugin-by-far/)󠁿 [Xavi Ivars](https://profiles.wordpress.org/xavivars/) 27 May 2023 Every other plugin is simply a trap to get you paying a premium version. This one simply works as expected, with no bloatware. 🙂 [ Read all 21 reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/) ## Contributors and Developers “OpenID Connect Generic Client” is open source software. The following people have contributed to this plugin. Contributors * [ Jonathan Daggerhart ](https://profiles.wordpress.org/daggerhart/) * [ Tim Nolte ](https://profiles.wordpress.org/tnolte/) “OpenID Connect Generic Client” has been translated into 2 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/daggerhart-openid-connect-generic/contributors) for their contributions. [Translate “OpenID Connect Generic Client” into your language.](https://translate.wordpress.org/projects/wp-plugins/daggerhart-openid-connect-generic) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/daggerhart-openid-connect-generic/), check out the [SVN repository](https://plugins.svn.wordpress.org/daggerhart-openid-connect-generic/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/daggerhart-openid-connect-generic/) by [RSS](https://plugins.trac.wordpress.org/log/daggerhart-openid-connect-generic/?limit=100&mode=stop_on_copy&format=rss). ## Change Log #### 3.11.3 * Feature/improvement: Added configurable issuer setting for JWT validation. #### 3.11.2 * Improvement: Support identity providers that omit algorithm parameter in JWKS( Microsoft Entra ID). #### 3.11.1 * Fix bug created in 3.11.0 release when comparing issuer to derived expected value. #### 3.11.0 **SECURITY RELEASE** * Security: Added JWT signature verification using JWKS to prevent token forgery * Security: Enhanced token claim validation (exp, aud, iss, iat, nonce) * Security: Replaced weak state generation with cryptographically secure random_bytes() * Security: Fixed open redirect vulnerability in authentication flow * Security: Restricted SSL verification bypass to local development environments only * Security: Added nonce protection to debug mode to prevent information disclosure * Security: Added SSRF protection by default through use of wp_safe_remote_* functions * Feature: Added JWKS endpoint configuration setting * Feature: Added OpenID Connect discovery document support * Feature: Added customizable login button text setting * Improvement: Migrated to Composer-managed dependencies * Fix: Corrected issuer validation to properly extract base URL from endpoints * Fix: Identity token timestamp tracking #### 3.10.4 * Fix issue with finding users on multisite after switch to user options in place of user meta. * Improvement: Retry logins for some IDP errors to bypass issue with Safari ITP. Also improves display of error messages that come from the IDP. #### 3.10.3 * Fix issue with log corruption causing fatal error. * Fix: Fallback to a POST request for userinfo when GET fails. * Fix: Improves multisite compatibility by switching to *_user_options() functions. * Fix: Fix for WordPress user session length being very short when refresh tokens are enabled. #### 3.10.2 * Fix: @socialmedialabs – Regression affecting SSO Auto Login with url handling improvement changes. #### 3.10.1 * Chore: @daggerhart – Readme updates and clarifications. * Chore: @daggerhart – Release workflow updates. * Improved error handling for malformed urls. * Fix: @JUVOJustin – Change request for userinfo to GET. * Feature: @JUVOJustin – New filter for settings values `openid-connect-generic- settings`. * Feature: @JUVOJustin – New filter for state values `openid-connect-generic-new- state-value`. #### 3.10.0 * Chore: @timnolte – Dependency updates. * Fix: @drzraf – Prevents running the auth url filter twice. * Fix: @timnolte – Updates the log cleanup handling to properly retain the configured number of log entries. * Fix: @timnolte – Updates the log display output to reflect the log retention policy. * Chore: @timnolte – Adds Unit Testing & New Local Development Environment. * Feature: @timnolte – Updates logging to allow for tracking processing time. * Feature: @menno-ll – Adds a remember me feature via a new filter. * Improvement: @menno-ll – Updates WP Cookie Expiration to Same as Session Length. #### 3.9.1 * Improvement: @timnolte – Refactors Composer setup and GitHub Actions. * Improvement: @timnolte – Bumps WordPress tested version compatibility. #### 3.9.0 * Feature: @matchaxnb – Added support for additional configuration constants. * Feature: @schanzen – Added support for agregated claims. * Fix: @rkcreation – Fixed access token not updating user metadata after login. * Fix: @danc1248 – Fixed user creation issue on Multisite Networks. * Feature: @RobjS – Added plugin singleton to support for more developer customization. * Feature: @jkouris – Added action hook to allow custom handling of session expiration. * Fix: @tommcc – Fixed admin CSS loading only on the plugin settings screen. * Feature: @rkcreation – Added method to refresh the user claim. * Feature: @Glowsome – Added acr_values support & verification checks that it when defined in options is honored. * Fix: @timnolte – Fixed regression which caused improper fallback on missing claims. * Fix: @slykar – Fixed missing query string handling in redirect URL. * Fix: @timnolte – Fixed issue with some user linking and user creation handling. * Improvement: @timnolte – Fixed plugin settings typos and screen formatting. * Security: @timnolte – Updated build tooling security vulnerabilities. * Improvement: @timnolte – Changed build tooling scripts. #### 3.8.5 * Fix: @timnolte – Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back. * Fix: @timnolte – Fixed Redirect URL Logic to Handle Sub-directory Installs. * Fix: @timnolte – Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used. #### 3.8.4 * Fix: @timnolte – Fixed invalid State object access for redirection handling. * Improvement: @timnolte – Fixed local wp-env Docker development environment. * Improvement: @timnolte – Fixed Composer scripts for linting and static analysis. #### 3.8.3 * Fix: @timnolte – Fixed problems with proper redirect handling. * Improvement: @timnolte – Changes redirect handling to use State instead of cookies. * Improvement: @timnolte – Refactored additional code to meet coding standards. #### 3.8.2 * Fix: @timnolte – Fixed reported XSS vulnerability on WordPress login screen. #### 3.8.1 * Fix: @timnolte – Prevent SSO redirect on password protected posts. * Fix: @timnolte – CI/CD build issues. * Fix: @timnolte – Invalid redirect handling on logout for Auto Login setting. #### 3.8.0 * Feature: @timnolte – Ability to use 6 new constants for setting client configuration instead of storing in the DB. * Improvement: @timnolte – Plugin development & contribution updates. * Improvement: @timnolte – Refactored to meet WordPress coding standards. * Improvement: @timnolte – Refactored to provide localization. [See the previous changelogs here](https://github.com/oidc-wp/openid-connect-generic/blob/main/CHANGELOG.md#changelog) ## Meta * Version **3.11.3** * Last updated **8 months ago** * Active installations **10,000+** * WordPress version ** 5.0 or higher ** * Tested up to **6.9.0** * PHP version ** 7.4 or higher ** * Languages * [English (US)](https://wordpress.org/plugins/daggerhart-openid-connect-generic/), [French (France)](https://fr.wordpress.org/plugins/daggerhart-openid-connect-generic/) and [German](https://de.wordpress.org/plugins/daggerhart-openid-connect-generic/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/daggerhart-openid-connect-generic) * Tags * [apps](https://en-gb.wordpress.org/plugins/tags/apps/)[login](https://en-gb.wordpress.org/plugins/tags/login/) [oauth2](https://en-gb.wordpress.org/plugins/tags/oauth2/)[openidconnect](https://en-gb.wordpress.org/plugins/tags/openidconnect/) [security](https://en-gb.wordpress.org/plugins/tags/security/) * [Advanced View](https://en-gb.wordpress.org/plugins/daggerhart-openid-connect-generic/advanced/) ## Ratings 5 out of 5 stars. * [ 21 5-star reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/reviews/) ## Contributors * [ Jonathan Daggerhart ](https://profiles.wordpress.org/daggerhart/) * [ Tim Nolte ](https://profiles.wordpress.org/tnolte/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/daggerhart-openid-connect-generic/)