WordPress.org
Get WordPress

Plugin Directory

Changeset 2698055


Ignore:
Timestamp:
03/23/2022 01:48:21 AM (4 years ago)
Author:
daggerhart
Message:

Update to version 3.9.0 from GitHub

Location:
daggerhart-openid-connect-generic
Files:
6 added
16 edited
1 copied

Legend:

Unmodified
Added
Removed

  • daggerhart-openid-connect-generic/tags/3.9.0/CHANGELOG.md

    r2516022 r2698055  
    11# OpenId Connect Generic Changelog
    22
    3 3.8.5
    4 * Fix: @timnolte - Fixes missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
    5 * Fix: @timnolte - Fixes Redirect URL Logic to Handle Sub-directory Installs.
    6 * Fix: @timnolte - Fixes to provide proper redirect user back for the openid_connect_generic_auth_url shortcode.
     33.9.0
    74
    8 3.8.4
    9 * Fix: @timnolte - Fixed invalid State object access for redirection handling.
    10 * Improvement: @timnolte - Fixed local wp-env Docker development environment.
    11 * Improvement: @timnolte - Fixed Composer scripts for linting and static analysis.
     5- Feature: @matchaxnb - Added support for additional configuration constants.
     6- Feature: @schanzen - Added support for agregated claims.
     7- Fix: @rkcreation - Fixed access token not updating user metadata after login.
     8- Fix: @danc1248 - Fixed user creation issue on Multisite Networks.
     9- Feature: @RobjS - Added plugin singleton to support for more developer customization.
     10- Feature: @jkouris - Added action hook to allow custom handling of session expiration.
     11- Fix: @tommcc - Fixed admin CSS loading only on the plugin settings screen.
     12- Feature: @rkcreation - Added method to refresh the user claim.
     13- Feature: @Glowsome - Added acr_values support & verification checks that it when defined in options is honored.
     14- Fix: @timnolte - Fixed regression which caused improper fallback on missing claims.
     15- Fix: @slykar - Fixed missing query string handling in redirect URL.
     16- Fix: @timnolte - Fixed issue with some user linking and user creation handling.
     17- Improvement: @timnolte - Fixed plugin settings typos and screen formatting.
     18- Security: @timnolte - Updated build tooling security vulnerabilities.
     19- Improvement: @timnolte - Changed build tooling scripts.
    1220
    13 3.8.3
     21  3.8.5
    1422
    15 * Fix: @timnolte - Fixed problems with proper redirect handling.
    16 * Improvement: @timnolte - Changes redirect handling to use State instead of cookies.
    17 * Improvement: @timnolte - Refactored additional code to meet coding standards.
     23- Fix: @timnolte - Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
     24- Fix: @timnolte - Fixed Redirect URL Logic to Handle Sub-directory Installs.
     25- Fix: @timnolte - Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.
    1826
    19 3.8.2
     27  3.8.4
    2028
    21 * Fix: @timnolte - Fixed reported XSS vulnerability on WordPress login screen.
     29- Fix: @timnolte - Fixed invalid State object access for redirection handling.
     30- Improvement: @timnolte - Fixed local wp-env Docker development environment.
     31- Improvement: @timnolte - Fixed Composer scripts for linting and static analysis.
    2232
    23 3.8.1
     33  3.8.3
    2434
    25 * Fix: @timnolte - Prevent SSO redirect on password protected posts.
    26 * Fix: @timnolte - CI/CD build issues.
    27 * Fix: @timnolte - Invalid redirect handling on logout for Auto Login setting.
     35- Fix: @timnolte - Fixed problems with proper redirect handling.
     36- Improvement: @timnolte - Changes redirect handling to use State instead of cookies.
     37- Improvement: @timnolte - Refactored additional code to meet coding standards.
    2838
    29 3.8.0
     39  3.8.2
    3040
    31 * Feature: @timnolte - Ability to use 6 new constants for setting client configuration instead of storing in the DB.
    32 * Improvement: @timnolte - NPM version requirements for development.
    33 * Improvement: @timnolte - Travis CI build fixes.
    34 * Improvement: @timnolte - GrumPHP configuration updates for code contributions.
    35 * Improvement: @timnolte - Refactored to meet WordPress coding standards.
    36 * Improvement: @timnolte - Refactored to provide localization.
    37 * Improvement: @timnolte - Refactored to provide a Docker-based local development environment.
     41- Fix: @timnolte - Fixed reported XSS vulnerability on WordPress login screen.
    3842
    39 3.7.1
     43  3.8.1
    4044
    41 * Fix: Release Version Number.
     45- Fix: @timnolte - Prevent SSO redirect on password protected posts.
     46- Fix: @timnolte - CI/CD build issues.
     47- Fix: @timnolte - Invalid redirect handling on logout for Auto Login setting.
    4248
    43 3.7.0
     49  3.8.0
    4450
    45 * Feature: @timnolte - Ability to enable/disable token refresh. Useful for IDPs that don't support token refresh.
    46 * Feature: @timnolte - Support custom redirect URL(`redirect_to`) with the authentication URL & login button shortcodes.
     51- Feature: @timnolte - Ability to use 6 new constants for setting client configuration instead of storing in the DB.
     52- Improvement: @timnolte - NPM version requirements for development.
     53- Improvement: @timnolte - Travis CI build fixes.
     54- Improvement: @timnolte - GrumPHP configuration updates for code contributions.
     55- Improvement: @timnolte - Refactored to meet WordPress coding standards.
     56- Improvement: @timnolte - Refactored to provide localization.
     57- Improvement: @timnolte - Refactored to provide a Docker-based local development environment.
     58
     59  3.7.1
     60
     61- Fix: Release Version Number.
     62
     63  3.7.0
     64
     65- Feature: @timnolte - Ability to enable/disable token refresh. Useful for IDPs that don't support token refresh.
     66- Feature: @timnolte - Support custom redirect URL(`redirect_to`) with the authentication URL & login button shortcodes.
     67
    4768  - Supports additional attribute overrides including login `button_text`, `endpoint_login`, `scope`, `redirect_uri`.
    4869
    49 3.6.0
     70    3.6.0
    5071
    51 * Improvement: @RobjS - Improved error messages during login state failure.
    52 * Improvement: @RobjS - New developer filter for login form button URL.
    53 * Fix: @cs1m0n - Only increment username during new user creation if the "Link existing user" setting is enabled.
    54 * Fix: @xRy-42 - Allow periods and spaces in usernames to match what WordPress core allows.
    55 * Feature: @benochen - New setting named "Create user if does not exist" determines whether new users are created during login attempts.
    56 * Improvement: @flat235 - Username transliteration and normalization.
     72- Improvement: @RobjS - Improved error messages during login state failure.
     73- Improvement: @RobjS - New developer filter for login form button URL.
     74- Fix: @cs1m0n - Only increment username during new user creation if the "Link existing user" setting is enabled.
     75- Fix: @xRy-42 - Allow periods and spaces in usernames to match what WordPress core allows.
     76- Feature: @benochen - New setting named "Create user if does not exist" determines whether new users are created during login attempts.
     77- Improvement: @flat235 - Username transliteration and normalization.
    5778
    58 3.5.1
     79  3.5.1
    5980
    60 * Fix: @daggerhart - New approach to state management using transients.
     81- Fix: @daggerhart - New approach to state management using transients.
    6182
    62 3.5.0
     83  3.5.0
    6384
    64 * Readme fix: @thijskh - Fix syntax error in example openid-connect-generic-login-button-text
    65 * Feature: @slavicd - Allow override of the plugin by posting credentials to wp-login.php
    66 * Feature: @gassan - New action on use login
    67 * Fix: @daggerhart - Avoid double question marks in auth url query string
    68 * Fix: @drzraf - wp-cli bootstrap must not inhibit custom rewrite rules
    69 * Syntax change: @mullikine - Change PHP keywords to comply with PSR2
     85- Readme fix: @thijskh - Fix syntax error in example openid-connect-generic-login-button-text
     86- Feature: @slavicd - Allow override of the plugin by posting credentials to wp-login.php
     87- Feature: @gassan - New action on use login
     88- Fix: @daggerhart - Avoid double question marks in auth url query string
     89- Fix: @drzraf - wp-cli bootstrap must not inhibit custom rewrite rules
     90- Syntax change: @mullikine - Change PHP keywords to comply with PSR2
    7091
    7192**3.4.1**
    7293
    73 * Minor documentation update and additional error checking.
     94- Minor documentation update and additional error checking.
    7495
    7596**3.4.0**
    7697
    77 * Feature: @drzraf - New filter hook: ability to filter claim and derived user data before user creation.
    78 * Feature: @anttileppa - State time limit can now be changed on the settings page.
    79 * Fix: @drzraf - Fix PHP notice when using traditional login, $token_response may be empty.
    80 * Fix: @drzraf - Fixed a notice when cookie does not contain expected redirect_url
     98- Feature: @drzraf - New filter hook: ability to filter claim and derived user data before user creation.
     99- Feature: @anttileppa - State time limit can now be changed on the settings page.
     100- Fix: @drzraf - Fix PHP notice when using traditional login, $token_response may be empty.
     101- Fix: @drzraf - Fixed a notice when cookie does not contain expected redirect_url
    81102
    82103**3.3.1**
    83104
    84 * Prefixing classes for more efficient autoloading.
    85 * Avoid altering global wp_remote_post() parameters.
    86 * Minor metadata updates for wp.org
     105- Prefixing classes for more efficient autoloading.
     106- Avoid altering global wp_remote_post() parameters.
     107- Minor metadata updates for wp.org
    87108
    88109**3.3.0**
    89110
    90 * Fix: @pjeby - Handle multiple user sessions better by using the `WP_Session_Tokens` object. Predecessor to fixes for multiple other issues: #49, #50, #51
     111- Fix: @pjeby - Handle multiple user sessions better by using the `WP_Session_Tokens` object. Predecessor to fixes for multiple other issues: #49, #50, #51
    91112
    92113**3.2.1**
    93114
    94 * Bug fix: @svenvanhal - Exit after issuing redirect. Fixes #46
     115- Bug fix: @svenvanhal - Exit after issuing redirect. Fixes #46
    95116
    96117**3.2.0**
    97118
    98 * Feature: @robbiepaul - trigger core action `wp_login` when user is logged in through this plugin
    99 * Feature: @moriyoshi - Determine the WP_User display name with replacement tokens on the settings page. Tokens can be any property of the user_claim.
    100 * Feature: New setting to set redirect URL when session expires.
    101 * Feature: @robbiepaul - New filter for modifying authentication URL
    102 * Fix: @cedrox - Adding id_token_hint to logout URL according to spec
    103 * Bug fix: Provide port to the request header when requesting the user_claim
     119- Feature: @robbiepaul - trigger core action `wp_login` when user is logged in through this plugin
     120- Feature: @moriyoshi - Determine the WP_User display name with replacement tokens on the settings page. Tokens can be any property of the user_claim.
     121- Feature: New setting to set redirect URL when session expires.
     122- Feature: @robbiepaul - New filter for modifying authentication URL
     123- Fix: @cedrox - Adding id_token_hint to logout URL according to spec
     124- Bug fix: Provide port to the request header when requesting the user_claim
    104125
    105126**3.1.0**
    106127
    107 * Feature: @rwasef1830 - Refresh tokens
    108 * Feature: @rwasef1830 - Integrated logout support with end_session endpoint
    109 * Feature: May use an alternate redirect_uri that doesn't rely on admin-ajax
    110 * Feature: @ahatherly - Support for IDP behind reverse proxy
    111 * Bug fix: @robertstaddon - case insensitive check for Bearer token
    112 * Bug fix: @rwasef1830 - "redirect to origin when auto-sso" cookie issue
    113 * Bug fix: @rwasef1830 - PHP Warnings headers already sent due to attempts to redirect and set cookies during login form message
    114 * Bug fix: @rwasef1830 - expire session when access_token expires if no refresh token found
    115 * UX fix: @rwasef1830 - Show login button on error redirect when using auto-sso
     128- Feature: @rwasef1830 - Refresh tokens
     129- Feature: @rwasef1830 - Integrated logout support with end_session endpoint
     130- Feature: May use an alternate redirect_uri that doesn't rely on admin-ajax
     131- Feature: @ahatherly - Support for IDP behind reverse proxy
     132- Bug fix: @robertstaddon - case insensitive check for Bearer token
     133- Bug fix: @rwasef1830 - "redirect to origin when auto-sso" cookie issue
     134- Bug fix: @rwasef1830 - PHP Warnings headers already sent due to attempts to redirect and set cookies during login form message
     135- Bug fix: @rwasef1830 - expire session when access_token expires if no refresh token found
     136- UX fix: @rwasef1830 - Show login button on error redirect when using auto-sso
    116137
    117138**3.0.8**
    118139
    119 * Feature: @wgengarelly - Added `openid-connect-generic-update-user-using-current-claim` action hook allowing other plugins/themes
     140- Feature: @wgengarelly - Added `openid-connect-generic-update-user-using-current-claim` action hook allowing other plugins/themes
    120141  to take action using the fresh claims received when an existing user logs in.
    121142
    122143**3.0.7**
    123144
    124 * Bug fix: @wgengarelly - When requesting userinfo, send the access token using the Authorization header field as recommended in
    125 section 5.3.1 of the specs.
     145- Bug fix: @wgengarelly - When requesting userinfo, send the access token using the Authorization header field as recommended in
     146  section 5.3.1 of the specs.
    126147
    127148**3.0.6**
    128149
    129 * Bug fix: @robertstaddon - If "Link Existing Users" is enabled, allow users who login with OpenID Connect to also log in with WordPress credentials
     150- Bug fix: @robertstaddon - If "Link Existing Users" is enabled, allow users who login with OpenID Connect to also log in with WordPress credentials
    130151
    131152**3.0.5**
    132153
    133 * Feature: @robertstaddon - Added `[openid_connect_generic_login_button]` shortcode to allow the login button to be placed anywhere
    134 * Feature: @robertstaddon - Added setting to "Redirect Back to Origin Page" after a successful login instead of redirecting to the home page.
     154- Feature: @robertstaddon - Added `[openid_connect_generic_login_button]` shortcode to allow the login button to be placed anywhere
     155- Feature: @robertstaddon - Added setting to "Redirect Back to Origin Page" after a successful login instead of redirecting to the home page.
    135156
    136157**3.0.4**
    137158
    138 * Feature: @robertstaddon - Added setting to allow linking existing WordPress user accounts with newly-authenticated OpenID Connect login
     159- Feature: @robertstaddon - Added setting to allow linking existing WordPress user accounts with newly-authenticated OpenID Connect login
    139160
    140161**3.0.3**
    141162
    142 * Using WordPresss's is_ssl() for setcookie()'s "secure" parameter
    143 * Bug fix: Incrementing username in case of collision.
    144 * Bug fix: Wrong error sent when missing token body
     163- Using WordPresss's is_ssl() for setcookie()'s "secure" parameter
     164- Bug fix: Incrementing username in case of collision.
     165- Bug fix: Wrong error sent when missing token body
    145166
    146167**3.0.2**
    147168
    148 * Added http_request_timeout setting
     169- Added http_request_timeout setting
    149170
    150171**3.0.1**
    151172
    152 * Finalizing 3.0.x api
     173- Finalizing 3.0.x api
    153174
    154175**3.0**
    155176
    156 * Complete rewrite to separate concerns
    157 * Changed settings keys for clarity (requires updating settings if upgrading from another version)
    158 * Error logging
     177- Complete rewrite to separate concerns
     178- Changed settings keys for clarity (requires updating settings if upgrading from another version)
     179- Error logging
    159180
    160181**2.1**
    161182
    162 * Working my way closer to spec. Possible breaking change. Now checking for preferred_username as priority.
    163 * New username determination to avoid collisions
     183- Working my way closer to spec. Possible breaking change. Now checking for preferred_username as priority.
     184- New username determination to avoid collisions
    164185
    165186**2.0**
    166187
    167188Complete rewrite
    168 

  • daggerhart-openid-connect-generic/tags/3.9.0/includes/openid-connect-generic-client-wrapper.php

    r2516022 r2698055  
    149149     */
    150150    public function get_redirect_to() {
     151        // @var WP $wp WordPress environment setup class.
    151152        global $wp;
    152153
    … …  
    171172        if ( $this->settings->redirect_user_back ) {
    172173            if ( ! empty( $wp->request ) ) {
    173                 if ( ! empty( $wp->did_permalink ) && $wp->did_permalink ) {
    174                     $redirect_url = home_url( trailingslashit( $wp->request ) );
     174                if ( ! empty( $wp->did_permalink ) && boolval( $wp->did_permalink ) === true ) {
     175                    $redirect_url = home_url( add_query_arg( $_GET, trailingslashit( $wp->request ) ) );
    175176                } else {
    176177                    $redirect_url = home_url( add_query_arg( null, null ) );
    … …  
    211212                'redirect_uri' => $this->client->get_redirect_uri(),
    212213                'redirect_to' => $this->get_redirect_to(),
     214                'acr_values' => $this->settings->acr_values,
    213215            ),
    214216            $atts,
    … …  
    225227            $separator = '&';
    226228        }
     229
     230        $url_format = '%1$s%2$sresponse_type=code&scope=%3$s&client_id=%4$s&state=%5$s&redirect_uri=%6$s';
     231        if ( ! empty( $atts['acr_values'] ) ) {
     232            $url_format .= '&acr_values=%7$s';
     233        }
     234
    227235        $url = sprintf(
    228             '%1$s%2$sresponse_type=code&scope=%3$s&client_id=%4$s&state=%5$s&redirect_uri=%6$s',
     236            $url_format,
    229237            $atts['endpoint_login'],
    230238            $separator,
    … …  
    232240            rawurlencode( $atts['client_id'] ),
    233241            $this->client->new_state( $atts['redirect_to'] ),
    234             rawurlencode( $atts['redirect_uri'] )
     242            rawurlencode( $atts['redirect_uri'] ),
     243            rawurlencode( $atts['acr_values'] )
    235244        );
    236245
    … …  
    272281
    273282        if ( ! $refresh_token || ( $refresh_expires && $current_time > $refresh_expires ) ) {
    274             wp_logout();
    275 
    276             if ( $this->settings->redirect_on_logout ) {
    277                 $this->error_redirect( new WP_Error( 'access-token-expired', __( 'Session expired. Please login again.', 'daggerhart-openid-connect-generic' ) ) );
     283            if ( isset( $_SERVER['REQUEST_URI'] ) ) {
     284                do_action( 'openid-connect-generic-session-expired', wp_get_current_user(), esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
     285                wp_logout();
     286
     287                if ( $this->settings->redirect_on_logout ) {
     288                    $this->error_redirect( new WP_Error( 'access-token-expired', __( 'Session expired. Please login again.', 'daggerhart-openid-connect-generic' ) ) );
     289                }
     290
     291                return;
    278292            }
    279 
    280             return;
    281293        }
    282294
    … …  
    295307        }
    296308
     309        update_user_meta( $user_id, 'openid-connect-generic-last-token-response', $token_response );
    297310        $this->save_refresh_token( $manager, $token, $token_response );
    298311    }
    … …  
    511524        $user = $this->get_user_by_identity( $subject_identity );
    512525
     526        // A pre-existing IDP mapped user wasn't found.
    513527        if ( ! $user ) {
    514             if ( $this->settings->create_if_does_not_exist ) {
     528            // If linking existing users or creating new ones call the `create_new_user` method which handles both cases.
     529            if ( $this->settings->link_existing_users || $this->settings->create_if_does_not_exist ) {
    515530                $user = $this->create_new_user( $subject_identity, $user_claim );
    516531                if ( is_wp_error( $user ) ) {
    … …  
    520535                $this->error_redirect( new WP_Error( 'identity-not-map-existing-user', __( 'User identity is not linked to an existing WordPress user.', 'daggerhart-openid-connect-generic' ), $user_claim ) );
    521536            }
    522         } else {
    523             // Allow plugins / themes to take action using current claims on existing user (e.g. update role).
    524             do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    525537        }
    526538
    … …  
    535547        $this->login_user( $user, $token_response, $id_token_claim, $user_claim, $subject_identity );
    536548
     549        // Allow plugins / themes to take action once a user is logged in.
    537550        do_action( 'openid-connect-generic-user-logged-in', $user );
    538551
    … …  
    581594
    582595    /**
     596     * Refresh user claim.
     597     *
     598     * @param WP_User $user             The user object.
     599     * @param array   $token_response   The token response.
     600     *
     601     * @return WP_Error|array
     602     */
     603    public function refresh_user_claim( $user, $token_response ) {
     604        $client = $this->client;
     605
     606        /**
     607         * The id_token is used to identify the authenticated user, e.g. for SSO.
     608         * The access_token must be used to prove access rights to protected
     609         * resources e.g. for the userinfo endpoint
     610         */
     611        $id_token_claim = $client->get_id_token_claim( $token_response );
     612
     613        // Allow for other plugins to alter data before validation.
     614        $id_token_claim = apply_filters( 'openid-connect-modify-id-token-claim-before-validation', $id_token_claim );
     615
     616        if ( is_wp_error( $id_token_claim ) ) {
     617            return $id_token_claim;
     618        }
     619
     620        // Validate our id_token has required values.
     621        $valid = $client->validate_id_token_claim( $id_token_claim );
     622
     623        if ( is_wp_error( $valid ) ) {
     624            return $valid;
     625        }
     626
     627        // If userinfo endpoint is set, exchange the token_response for a user_claim.
     628        if ( ! empty( $this->settings->endpoint_userinfo ) && isset( $token_response['access_token'] ) ) {
     629            $user_claim = $client->get_user_claim( $token_response );
     630        } else {
     631            $user_claim = $id_token_claim;
     632        }
     633
     634        if ( is_wp_error( $user_claim ) ) {
     635            return $user_claim;
     636        }
     637
     638        // Validate our user_claim has required values.
     639        $valid = $client->validate_user_claim( $user_claim, $id_token_claim );
     640
     641        if ( is_wp_error( $valid ) ) {
     642            $this->error_redirect( $valid );
     643            return $valid;
     644        }
     645
     646        // Store the tokens for future reference.
     647        update_user_meta( $user->ID, 'openid-connect-generic-last-token-response', $token_response );
     648        update_user_meta( $user->ID, 'openid-connect-generic-last-id-token-claim', $id_token_claim );
     649        update_user_meta( $user->ID, 'openid-connect-generic-last-user-claim', $user_claim );
     650
     651        return $user_claim;
     652    }
     653
     654    /**
    583655     * Record user meta data, and provide an authorization cookie.
    584656     *
    … …  
    596668        update_user_meta( $user->ID, 'openid-connect-generic-last-id-token-claim', $id_token_claim );
    597669        update_user_meta( $user->ID, 'openid-connect-generic-last-user-claim', $user_claim );
     670        // Allow plugins / themes to take action using current claims on existing user (e.g. update role).
     671        do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    598672
    599673        // Create the WP session, so we know its token.
    … …  
    657731                    ),
    658732                ),
     733                // Override the default blog_id (get_current_blog_id) to find users on different sites of a multisite install.
     734                'blog_id' => 0,
    659735            )
    660736        );
    661737
    662         // If we found an existing users, grab the first one returned.
     738        // If we found existing users, grab the first one returned.
    663739        if ( $user_query->get_total() > 0 ) {
    664740            $users = $user_query->get_results();
    … …  
    674750     * @param array $user_claim The IDP authenticated user claim data.
    675751     *
    676      * @return string|WP_Error|null
     752     * @return string|WP_Error
    677753     */
    678754    private function get_username_from_claim( $user_claim ) {
    … …  
    684760        if ( ! empty( $this->settings->identity_key ) && isset( $user_claim[ $this->settings->identity_key ] ) ) {
    685761            $desired_username = $user_claim[ $this->settings->identity_key ];
    686         } else if ( isset( $user_claim['preferred_username'] ) && ! empty( $user_claim['preferred_username'] ) ) {
     762        }
     763        if ( empty( $desired_username ) && isset( $user_claim['preferred_username'] ) && ! empty( $user_claim['preferred_username'] ) ) {
    687764            $desired_username = $user_claim['preferred_username'];
    688         } else if ( isset( $user_claim['name'] ) && ! empty( $user_claim['name'] ) ) {
     765        }
     766        if ( empty( $desired_username ) && isset( $user_claim['name'] ) && ! empty( $user_claim['name'] ) ) {
    689767            $desired_username = $user_claim['name'];
    690         } else if ( isset( $user_claim['email'] ) && ! empty( $user_claim['email'] ) ) {
     768        }
     769        if ( empty( $desired_username ) && isset( $user_claim['email'] ) && ! empty( $user_claim['email'] ) ) {
    691770            $tmp = explode( '@', $user_claim['email'] );
    692771            $desired_username = $tmp[0];
    693         } else {
     772        }
     773        if ( empty( $desired_username ) ) {
    694774            // Nothing to build a name from.
    695775            return new WP_Error( 'no-username', __( 'No appropriate username found.', 'daggerhart-openid-connect-generic' ), $user_claim );
    696776        }
    697777
    698         // Normalize the data a bit.
    699         // @var string $transliterated_username The username converted to ASCII from UTF-8.
    700         $transliterated_username = iconv( 'UTF-8', 'ASCII//TRANSLIT', $desired_username );
    701         if ( empty( $transliterated_username ) ) {
    702             // translators: $1$s is a username from the IDP.
    703             return new WP_Error( 'username-transliteration-failed', sprintf( __( 'Username %1$s could not be transliterated.', 'daggerhart-openid-connect-generic' ), $desired_username ), $desired_username );
    704         }
    705         $normalized_username = strtolower( preg_replace( '/[^a-zA-Z0-9 _.\-@]/', '', $transliterated_username ) );
    706         if ( empty( $normalized_username ) ) {
    707             // translators: %1$s is the ASCII version of the username from the IDP.
    708             return new WP_Error( 'username-normalization-failed', sprintf( __( 'Username %1$s could not be normalized.', 'daggerhart-openid-connect-generic' ), $transliterated_username ), $transliterated_username );
    709         }
    710 
    711         // Copy the username for incrementing.
    712         $username = ! empty( $normalized_username ) ? $normalized_username : null;
    713 
    714         if ( ! $this->settings->link_existing_users && ! is_null( $username ) ) {
    715             // @example Original user gets "name", second user gets "name2", etc.
    716             $count = 1;
    717             while ( username_exists( $username ) ) {
    718                 $count ++;
    719                 $username = $normalized_username . $count;
    720             }
    721         }
    722 
    723         return $username;
     778        // Don't use the full email address for a username.
     779        $_desired_username = explode( '@', $desired_username );
     780        $desired_username = $_desired_username[0];
     781        // Use WordPress Core to sanitize the IDP username.
     782        $sanitized_username = sanitize_user( $desired_username, true );
     783        if ( empty( $sanitized_username ) ) {
     784            // translators: %1$s is the santitized version of the username from the IDP.
     785            return new WP_Error( 'username-sanitization-failed', sprintf( __( 'Username %1$s could not be sanitized.', 'daggerhart-openid-connect-generic' ), $desired_username ), $desired_username );
     786        }
     787
     788        return $sanitized_username;
    724789    }
    725790
    … …  
    747812
    748813    /**
     814     * Checks if $claimname is in the body or _claim_names of the userinfo.
     815     * If yes, returns the claim value. Otherwise, returns false.
     816     *
     817     * @param string $claimname the claim name to look for.
     818     * @param array  $userinfo the JSON to look in.
     819     * @param string $claimvalue the source claim value ( from the body of the JWT of the claim source).
     820     * @return true|false
     821     */
     822    private function get_claim( $claimname, $userinfo, &$claimvalue ) {
     823        /**
     824         * If we find a simple claim, return it.
     825         */
     826        if ( array_key_exists( $claimname, $userinfo ) ) {
     827            $claimvalue = $userinfo[ $claimname ];
     828            return true;
     829        }
     830        /**
     831         * If there are no aggregated claims, it is over.
     832         */
     833        if ( ! array_key_exists( '_claim_names', $userinfo ) ||
     834            ! array_key_exists( '_claim_sources', $userinfo ) ) {
     835            return false;
     836        }
     837        $claim_src_ptr = $userinfo['_claim_names'];
     838        if ( ! isset( $claim_src_ptr ) ) {
     839            return false;
     840        }
     841        /**
     842         * No reference found
     843         */
     844        if ( ! array_key_exists( $claimname, $claim_src_ptr ) ) {
     845            return false;
     846        }
     847        $src_name = $claim_src_ptr[ $claimname ];
     848        // Reference found, but no corresponding JWT. This is a malformed userinfo.
     849        if ( ! array_key_exists( $src_name, $userinfo['_claim_sources'] ) ) {
     850            return false;
     851        }
     852        $src = $userinfo['_claim_sources'][ $src_name ];
     853        // Source claim is not a JWT. Abort.
     854        if ( ! array_key_exists( 'JWT', $src ) ) {
     855            return false;
     856        }
     857        /**
     858         * Extract claim from JWT.
     859         * FIXME: We probably want to verify the JWT signature/issuer here.
     860         * For example, using JWKS if applicable. For symmetrically signed
     861         * JWTs (HMAC), we need a way to specify the acceptable secrets
     862         * and each possible issuer in the config.
     863         */
     864        $jwt = $src['JWT'];
     865        list ( $header, $body, $rest ) = explode( '.', $jwt, 3 );
     866        $body_str = base64_decode( $body, false );
     867        if ( ! $body_str ) {
     868            return false;
     869        }
     870        $body_json = json_decode( $body_str, true );
     871        if ( ! isset( $body_json ) ) {
     872            return false;
     873        }
     874        if ( ! array_key_exists( $claimname, $body_json ) ) {
     875            return false;
     876        }
     877        $claimvalue = $body_json[ $claimname ];
     878        return true;
     879    }
     880
     881
     882    /**
    749883     * Build a string from the user claim according to the specified format.
    750884     *
    … …  
    758892        $matches = null;
    759893        $string = '';
     894        $info = '';
    760895        $i = 0;
    761896        if ( preg_match_all( '/\{[^}]*\}/u', $format, $matches, PREG_OFFSET_CAPTURE ) ) {
    … …  
    763898                $key = substr( $match[0], 1, -1 );
    764899                $string .= substr( $format, $i, $match[1] - $i );
    765                 if ( ! isset( $user_claim[ $key ] ) ) {
     900                if ( ! $this->get_claim( $key, $user_claim, $info ) ) {
    766901                    if ( $error_on_missing_key ) {
    767902                        return new WP_Error(
    … …  
    777912                    }
    778913                } else {
    779                     $string .= $user_claim[ $key ];
     914                    $string .= $info;
    780915                }
    781916                $i = $match[1] + strlen( $match[0] );
    … …  
    836971        // Allow claim details to determine username, email, nickname and displayname.
    837972        $_email = $this->get_email_from_claim( $user_claim, true );
    838         if ( is_wp_error( $_email ) ) {
     973        if ( is_wp_error( $_email ) || empty( $_email ) ) {
    839974            $values_missing = true;
    840         } else if ( ! is_null( $_email ) ) {
     975        } else {
    841976            $email = $_email;
    842977        }
    843978
    844979        $_username = $this->get_username_from_claim( $user_claim );
    845         if ( is_wp_error( $_username ) ) {
     980        if ( is_wp_error( $_username ) || empty( $_username ) ) {
    846981            $values_missing = true;
    847         } else if ( ! is_null( $_username ) ) {
     982        } else {
    848983            $username = $_username;
    849984        }
    850985
    851986        $_nickname = $this->get_nickname_from_claim( $user_claim );
    852         if ( is_null( $_nickname ) ) {
     987        if ( is_wp_error( $_nickname ) || empty( $_nickname ) ) {
    853988            $values_missing = true;
    854989        } else {
    … …  
    857992
    858993        $_displayname = $this->get_displayname_from_claim( $user_claim, true );
    859         if ( is_wp_error( $_displayname ) ) {
     994        if ( is_wp_error( $_displayname ) || empty( $_displayname ) ) {
    860995            $values_missing = true;
    861         } else if ( ! is_null( $_displayname ) ) {
     996        } else {
    862997            $displayname = $_displayname;
    863998        }
    … …  
    8781013        if ( is_wp_error( $_email ) ) {
    8791014            return $_email;
    880         } else if ( ! is_null( $_email ) ) {
     1015        }
     1016        // Use the email address from the latest userinfo request if not empty.
     1017        if ( ! empty( $_email ) ) {
    8811018            $email = $_email;
    8821019        }
    … …  
    8851022        if ( is_wp_error( $_username ) ) {
    8861023            return $_username;
    887         } else if ( ! is_null( $_username ) ) {
     1024        }
     1025        // Use the username from the latest userinfo request if not empty.
     1026        if ( ! empty( $_username ) ) {
    8881027            $username = $_username;
    8891028        }
    … …  
    8921031        if ( is_wp_error( $_nickname ) ) {
    8931032            return $_nickname;
    894         } else if ( is_null( $_nickname ) ) {
     1033        }
     1034        // Use the username as the nickname if the userinfo request nickname is empty.
     1035        if ( empty( $_nickname ) ) {
    8951036            $nickname = $username;
    8961037        }
    … …  
    8991040        if ( is_wp_error( $_displayname ) ) {
    9001041            return $_displayname;
    901         } else if ( is_null( $_displayname ) ) {
     1042        }
     1043        // Use the nickname as the displayname if the userinfo request displayname is empty.
     1044        if ( empty( $_displayname ) ) {
    9021045            $displayname = $nickname;
    9031046        }
    9041047
    905         // Before trying to create the user, first check if a user with the same email already exists.
     1048        // Before trying to create the user, first check if a matching user exists.
    9061049        if ( $this->settings->link_existing_users ) {
     1050            $uid = null;
    9071051            if ( $this->settings->identify_with_username ) {
    9081052                $uid = username_exists( $username );
    … …  
    9101054                $uid = email_exists( $email );
    9111055            }
    912             if ( $uid ) {
     1056            if ( ! empty( $uid ) ) {
    9131057                $user = $this->update_existing_user( $uid, $subject_identity );
    9141058                do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    … …  
    9211065         * based on the returned user claim.
    9221066         */
    923         $create_user = apply_filters( 'openid-connect-generic-user-creation-test', true, $user_claim );
     1067        $create_user = apply_filters( 'openid-connect-generic-user-creation-test', $this->settings->create_if_does_not_exist, $user_claim );
    9241068
    9251069        if ( ! $create_user ) {
    9261070            return new WP_Error( 'cannot-authorize', __( 'Can not authorize.', 'daggerhart-openid-connect-generic' ), $create_user );
     1071        }
     1072
     1073        // Copy the username for incrementing.
     1074        $_username = $username;
     1075        // Ensure prevention of linking usernames & collisions by incrementing the username if it exists.
     1076        // @example Original user gets "name", second user gets "name2", etc.
     1077        $count = 1;
     1078        while ( username_exists( $username ) ) {
     1079            $count ++;
     1080            $username = $_username . $count;
    9271081        }
    9281082

  • daggerhart-openid-connect-generic/tags/3.9.0/includes/openid-connect-generic-client.php

    r2516022 r2698055  
    8484
    8585    /**
     86     * The specifically requested authentication contract at the IDP
     87     *
     88     * @see OpenID_Connect_Generic_Option_Settings::acr_values
     89     *
     90     * @var string
     91     */
     92    private $acr_values;
     93
     94    /**
    8695     * The state time limit. States are only valid for 3 minutes.
    8796     *
    … …  
    109118     * @param string                               $endpoint_token    @see OpenID_Connect_Generic_Option_Settings::endpoint_token for description.
    110119     * @param string                               $redirect_uri      @see OpenID_Connect_Generic_Option_Settings::redirect_uri for description.
     120     * @param string                               $acr_values        @see OpenID_Connect_Generic_Option_Settings::acr_values for description.
    111121     * @param int                                  $state_time_limit  @see OpenID_Connect_Generic_Option_Settings::state_time_limit for description.
    112122     * @param OpenID_Connect_Generic_Option_Logger $logger            The plugin logging object instance.
    113123     */
    114     public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $state_time_limit, $logger ) {
     124    public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $state_time_limit, $logger ) {
    115125        $this->client_id = $client_id;
    116126        $this->client_secret = $client_secret;
    … …  
    120130        $this->endpoint_token = $endpoint_token;
    121131        $this->redirect_uri = $redirect_uri;
     132        $this->acr_values = $acr_values;
    122133        $this->state_time_limit = $state_time_limit;
    123134        $this->logger = $logger;
    … …  
    213224        );
    214225
     226        if ( ! empty( $this->acr_values ) ) {
     227            $request['body'] += array( 'acr_values' => $this->acr_values );
     228        }
     229
    215230        // Allow modifications to the request.
    216231        $request = apply_filters( 'openid-connect-generic-alter-request', $request, 'get-authentication-token' );
    … …  
    465480        }
    466481
     482        // Validate acr values when the option is set in the configuration.
     483        if ( ! empty( $this->acr_values ) && isset( $id_token_claim['acr'] ) ) {
     484            if ( $this->acr_values != $id_token_claim['acr'] ) {
     485                return new WP_Error( 'no-match-acr', __( 'No matching acr values.', 'daggerhart-openid-connect-generic' ), $id_token_claim );
     486            }
     487        }
     488
    467489        return true;
    468490    }

  • daggerhart-openid-connect-generic/tags/3.9.0/includes/openid-connect-generic-option-settings.php

    r2511857 r2698055  
    3434 * @property string $endpoint_token       The IDP token validation endpoint URL.
    3535 * @property string $endpoint_end_session The IDP logout endpoint URL.
     36 * @property string $acr_values           The Authentication contract as defined on the IDP.
    3637 *
    3738 * Non-standard Settings:
    … …  
    8788     */
    8889    private $environment_settings = array(
    89         'client_id'            => 'OIDC_CLIENT_ID',
    90         'client_secret'        => 'OIDC_CLIENT_SECRET',
    91         'endpoint_login'       => 'OIDC_ENDPOINT_LOGIN_URL',
    92         'endpoint_userinfo'    => 'OIDC_ENDPOINT_USERINFO_URL',
    93         'endpoint_token'       => 'OIDC_ENDPOINT_TOKEN_URL',
    94         'endpoint_end_session' => 'OIDC_ENDPOINT_LOGOUT_URL',
     90        'client_id'                 => 'OIDC_CLIENT_ID',
     91        'client_secret'             => 'OIDC_CLIENT_SECRET',
     92        'endpoint_end_session'      => 'OIDC_ENDPOINT_LOGOUT_URL',
     93        'endpoint_login'            => 'OIDC_ENDPOINT_LOGIN_URL',
     94        'endpoint_token'            => 'OIDC_ENDPOINT_TOKEN_URL',
     95        'endpoint_userinfo'         => 'OIDC_ENDPOINT_USERINFO_URL',
     96        'login_type'                => 'OIDC_LOGIN_TYPE',
     97        'scope'                     => 'OIDC_CLIENT_SCOPE',
     98        'create_if_does_not_exist'  => 'OIDC_CREATE_IF_DOES_NOT_EXIST',
     99        'enforce_privacy'           => 'OIDC_ENFORCE_PRIVACY',
     100        'link_existing_users'       => 'OIDC_LINK_EXISTING_USERS',
     101        'redirect_on_logout'        => 'OIDC_REDIRECT_ON_LOGOUT',
     102        'redirect_user_back'        => 'OIDC_REDIRECT_USER_BACK',
     103        'acr_values'                => 'OIDC_ACR_VALUES',
    95104    );
    96105

  • daggerhart-openid-connect-generic/tags/3.9.0/includes/openid-connect-generic-settings-page.php

    r2511857 r2698055  
    217217                    'auto'   => __( 'Auto Login - SSO', 'daggerhart-openid-connect-generic' ),
    218218                ),
     219                'disabled'    => defined( 'OIDC_LOGIN_TYPE' ),
    219220                'section'     => 'client_settings',
    220221            ),
    … …  
    239240                'example'     => 'email profile openid offline_access',
    240241                'type'        => 'text',
     242                'disabled'    => defined( 'OIDC_CLIENT_SCOPE' ),
    241243                'section'     => 'client_settings',
    242244            ),
    … …  
    273275                'section'     => 'client_settings',
    274276            ),
     277            'acr_values'    => array(
     278                'title'       => __( 'ACR values', 'daggerhart-openid-connect-generic' ),
     279                'description' => __( 'Use a specific defined authentication contract from the IDP - optional.', 'daggerhart-openid-connect-generic' ),
     280                'type'        => 'text',
     281                'disabled'    => defined( 'OIDC_ACR_VALUES' ),
     282                'section'     => 'client_settings',
     283            ),
    275284            'identity_key'     => array(
    276285                'title'       => __( 'Identity Key', 'daggerhart-openid-connect-generic' ),
    … …  
    298307                'description' => __( 'Require users be logged in to see the site.', 'daggerhart-openid-connect-generic' ),
    299308                'type'        => 'checkbox',
     309                'disabled'    => defined( 'OIDC_ENFORCE_PRIVACY' ),
    300310                'section'     => 'authorization_settings',
    301311            ),
    … …  
    349359                'description' => __( 'If a WordPress account already exists with the same identity as a newly-authenticated user over OpenID Connect, login as that user instead of generating an error.', 'daggerhart-openid-connect-generic' ),
    350360                'type'        => 'checkbox',
     361                'disabled'    => defined( 'OIDC_LINK_EXISTING_USERS' ),
    351362                'section'     => 'user_settings',
    352363            ),
    353364            'create_if_does_not_exist'   => array(
    354365                'title'       => __( 'Create user if does not exist', 'daggerhart-openid-connect-generic' ),
    355                 'description' => __( 'If the user identity is not link to an existing Wordpress user, it is created. If this setting is not enabled and if the user authenticates with an account which is not link to an existing Wordpress user then the authentication failed', 'daggerhart-openid-connect-generic' ),
    356                 'type'        => 'checkbox',
     366                'description' => __( 'If the user identity is not linked to an existing WordPress user, it is created. If this setting is not enabled, and if the user authenticates with an account which is not linked to an existing WordPress user, then the authentication will fail.', 'daggerhart-openid-connect-generic' ),
     367                'type'        => 'checkbox',
     368                'disabled'    => defined( 'OIDC_CREATE_IF_DOES_NOT_EXIST' ),
    357369                'section'     => 'user_settings',
    358370            ),
    … …  
    361373                'description' => __( 'After a successful OpenID Connect authentication, this will redirect the user back to the page on which they clicked the OpenID Connect login button. This will cause the login process to proceed in a traditional WordPress fashion. For example, users logging in through the default wp-login.php page would end up on the WordPress Dashboard and users logging in through the WooCommerce "My Account" page would end up on their account page.', 'daggerhart-openid-connect-generic' ),
    362374                'type'        => 'checkbox',
     375                'disabled'    => defined( 'OIDC_REDIRECT_USER_BACK' ),
    363376                'section'     => 'user_settings',
    364377            ),
    … …  
    367380                'description' => __( 'When enabled, this will automatically redirect the user back to the WordPress login page if their access token has expired.', 'daggerhart-openid-connect-generic' ),
    368381                'type'        => 'checkbox',
     382                'disabled'    => defined( 'OIDC_REDIRECT_ON_LOGOUT' ),
    369383                'section'     => 'user_settings',
    370384            ),
    … …  
    415429     */
    416430    public function settings_page() {
     431        wp_enqueue_style( 'daggerhart-openid-connect-generic-admin', plugin_dir_url( __DIR__ ) . 'css/styles-admin.css', array(), OpenID_Connect_Generic::VERSION, 'all' );
     432
    417433        $redirect_uri = admin_url( 'admin-ajax.php?action=openid-connect-authorize' );
    418434
    … …  
    473489        ?>
    474490        <input type="<?php print esc_attr( $field['type'] ); ?>"
    475                 <?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) ) ? ' disabled' : ''; ?>
     491                <?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) === true ) ? ' disabled' : ''; ?>
    476492              id="<?php print esc_attr( $field['key'] ); ?>"
    477               class="large-text<?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) ) ? ' disabled' : ''; ?>"
     493              class="large-text<?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) === true ) ? ' disabled' : ''; ?>"
    478494              name="<?php print esc_attr( $field['name'] ); ?>"
    479495              value="<?php print esc_attr( $this->settings->{ $field['key'] } ); ?>">
    … …  
    531547        ?>
    532548        <p class="description">
    533             <?php print esc_html( $field['description'] ); ?>
     549            <?php print wp_kses_post( $field['description'] ); ?>
    534550            <?php if ( isset( $field['example'] ) ) : ?>
    535551                <br/><strong><?php esc_html_e( 'Example', 'daggerhart-openid-connect-generic' ); ?>: </strong>

  • daggerhart-openid-connect-generic/tags/3.9.0/languages/openid-connect-generic.pot

    r2516022 r2698055  
    1 # Copyright (C) 2021 daggerhart
     1# Copyright (C) 2022 daggerhart
    22# This file is distributed under the GPL-2.0+.
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: OpenID Connect Generic 3.8.5\n"
     5"Project-Id-Version: OpenID Connect Generic 3.9.0\n"
    66"Report-Msgid-Bugs-To: "
    77"https://github.com/daggerhart/openid-connect-generic/issues\n"
    8 "POT-Creation-Date: 2021-04-16 03:38:39+00:00\n"
     8"POT-Creation-Date: 2022-03-22 03:28:37+00:00\n"
    99"MIME-Version: 1.0\n"
    1010"Content-Type: text/plain; charset=utf-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "PO-Revision-Date: 2021-MO-DA HO:MI+ZONE\n"
     12"PO-Revision-Date: 2022-MO-DA HO:MI+ZONE\n"
    1313"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    1414"Language-Team: LANGUAGE <LL@li.org>\n"
    … …  
    2626"X-Generator: grunt-wp-i18n 1.0.3\n"
    2727
    28 #: includes/openid-connect-generic-client-wrapper.php:277
     28#: includes/openid-connect-generic-client-wrapper.php:288
    2929msgid "Session expired. Please login again."
    3030msgstr ""
    3131
    32 #: includes/openid-connect-generic-client-wrapper.php:520
     32#: includes/openid-connect-generic-client-wrapper.php:535
    3333msgid "User identity is not linked to an existing WordPress user."
    3434msgstr ""
    3535
    36 #: includes/openid-connect-generic-client-wrapper.php:576
     36#: includes/openid-connect-generic-client-wrapper.php:589
    3737msgid "Invalid user."
    3838msgstr ""
    3939
    40 #: includes/openid-connect-generic-client-wrapper.php:695
     40#: includes/openid-connect-generic-client-wrapper.php:775
    4141msgid "No appropriate username found."
    4242msgstr ""
    4343
    44 #: includes/openid-connect-generic-client-wrapper.php:703
    45 #. translators: $1$s is a username from the IDP.
    46 msgid "Username %1$s could not be transliterated."
    47 msgstr ""
    48 
    49 #: includes/openid-connect-generic-client-wrapper.php:708
    50 #. translators: %1$s is the ASCII version of the username from the IDP.
    51 msgid "Username %1$s could not be normalized."
    52 msgstr ""
    53 
    54 #: includes/openid-connect-generic-client-wrapper.php:742
     44#: includes/openid-connect-generic-client-wrapper.php:785
     45#. translators: %1$s is the santitized version of the username from the IDP.
     46msgid "Username %1$s could not be sanitized."
     47msgstr ""
     48
     49#: includes/openid-connect-generic-client-wrapper.php:807
    5550#. translators: %1$s is the configured User Claim nickname key.
    5651msgid "No nickname found in user claim using key: %1$s."
    5752msgstr ""
    5853
    59 #: includes/openid-connect-generic-client-wrapper.php:769
     54#: includes/openid-connect-generic-client-wrapper.php:904
    6055msgid "User claim incomplete."
    6156msgstr ""
    6257
    63 #: includes/openid-connect-generic-client-wrapper.php:871
     58#: includes/openid-connect-generic-client-wrapper.php:1006
    6459msgid "Bad user claim result."
    6560msgstr ""
    6661
    67 #: includes/openid-connect-generic-client-wrapper.php:926
     62#: includes/openid-connect-generic-client-wrapper.php:1070
    6863msgid "Can not authorize."
    6964msgstr ""
    7065
    71 #: includes/openid-connect-generic-client-wrapper.php:945
     66#: includes/openid-connect-generic-client-wrapper.php:1099
    7267msgid "Failed user creation."
    7368msgstr ""
    7469
    75 #: includes/openid-connect-generic-client.php:165
     70#: includes/openid-connect-generic-client.php:176
    7671msgid "Missing state."
    7772msgstr ""
    7873
    79 #: includes/openid-connect-generic-client.php:169
     74#: includes/openid-connect-generic-client.php:180
    8075msgid "Invalid state."
    8176msgstr ""
    8277
    83 #: includes/openid-connect-generic-client.php:184
     78#: includes/openid-connect-generic-client.php:195
    8479msgid "Missing authentication code."
    8580msgstr ""
    8681
    87 #: includes/openid-connect-generic-client.php:223
     82#: includes/openid-connect-generic-client.php:238
    8883msgid "Request for authentication token failed."
    8984msgstr ""
    9085
    91 #: includes/openid-connect-generic-client.php:254
     86#: includes/openid-connect-generic-client.php:269
    9287msgid "Refresh token failed."
    9388msgstr ""
    9489
    95 #: includes/openid-connect-generic-client.php:269
     90#: includes/openid-connect-generic-client.php:284
    9691msgid "Missing token body."
    9792msgstr ""
    9893
    99 #: includes/openid-connect-generic-client.php:277
     94#: includes/openid-connect-generic-client.php:292
    10095msgid "Invalid token."
    10196msgstr ""
    10297
    103 #: includes/openid-connect-generic-client.php:328
     98#: includes/openid-connect-generic-client.php:343
    10499msgid "Request for userinfo failed."
    105100msgstr ""
    106101
    107 #: includes/openid-connect-generic-client.php:388
     102#: includes/openid-connect-generic-client.php:403
    108103msgid "Missing authentication state."
    109104msgstr ""
    110105
    111 #: includes/openid-connect-generic-client.php:425
     106#: includes/openid-connect-generic-client.php:440
    112107msgid "No identity token."
    113108msgstr ""
    114109
    115 #: includes/openid-connect-generic-client.php:432
     110#: includes/openid-connect-generic-client.php:447
    116111msgid "Missing identity token."
    117112msgstr ""
    118113
    119 #: includes/openid-connect-generic-client.php:459
     114#: includes/openid-connect-generic-client.php:474
    120115msgid "Bad ID token claim."
    121116msgstr ""
    122117
    123 #: includes/openid-connect-generic-client.php:464
     118#: includes/openid-connect-generic-client.php:479
    124119msgid "No subject identity."
    125120msgstr ""
    126121
    127 #: includes/openid-connect-generic-client.php:483
     122#: includes/openid-connect-generic-client.php:485
     123msgid "No matching acr values."
     124msgstr ""
     125
     126#: includes/openid-connect-generic-client.php:505
    128127msgid "Bad user claim."
    129128msgstr ""
    130129
    131 #: includes/openid-connect-generic-client.php:503
     130#: includes/openid-connect-generic-client.php:525
    132131msgid "Invalid user claim."
    133132msgstr ""
    134133
    135 #: includes/openid-connect-generic-client.php:508
     134#: includes/openid-connect-generic-client.php:530
    136135msgid "Error from the IDP."
    137136msgstr ""
    138137
    139 #: includes/openid-connect-generic-client.php:517
     138#: includes/openid-connect-generic-client.php:539
    140139msgid "Incorrect user claim."
    141140msgstr ""
    142141
    143 #: includes/openid-connect-generic-client.php:524
     142#: includes/openid-connect-generic-client.php:546
    144143msgid "Unauthorized access."
    145144msgstr ""
    … …  
    210209msgstr ""
    211210
    212 #: includes/openid-connect-generic-settings-page.php:222
     211#: includes/openid-connect-generic-settings-page.php:223
    213212msgid "Client ID"
    214213msgstr ""
    215214
    216 #: includes/openid-connect-generic-settings-page.php:223
     215#: includes/openid-connect-generic-settings-page.php:224
    217216msgid ""
    218217"The ID this client will be recognized as when connecting the to Identity "
    … …  
    220219msgstr ""
    221220
    222 #: includes/openid-connect-generic-settings-page.php:230
     221#: includes/openid-connect-generic-settings-page.php:231
    223222msgid "Client Secret Key"
    224223msgstr ""
    225224
    226 #: includes/openid-connect-generic-settings-page.php:231
     225#: includes/openid-connect-generic-settings-page.php:232
    227226msgid ""
    228227"Arbitrary secret key the server expects from this client. Can be anything, "
    … …  
    230229msgstr ""
    231230
    232 #: includes/openid-connect-generic-settings-page.php:237
     231#: includes/openid-connect-generic-settings-page.php:238
    233232msgid "OpenID Scope"
    234233msgstr ""
    235234
    236 #: includes/openid-connect-generic-settings-page.php:238
     235#: includes/openid-connect-generic-settings-page.php:239
    237236msgid "Space separated list of scopes this client should access."
    238237msgstr ""
    239238
    240 #: includes/openid-connect-generic-settings-page.php:244
     239#: includes/openid-connect-generic-settings-page.php:246
    241240msgid "Login Endpoint URL"
    242241msgstr ""
    243242
    244 #: includes/openid-connect-generic-settings-page.php:245
     243#: includes/openid-connect-generic-settings-page.php:247
    245244msgid "Identify provider authorization endpoint."
    246245msgstr ""
    247246
    248 #: includes/openid-connect-generic-settings-page.php:252
     247#: includes/openid-connect-generic-settings-page.php:254
    249248msgid "Userinfo Endpoint URL"
    250249msgstr ""
    251250
    252 #: includes/openid-connect-generic-settings-page.php:253
     251#: includes/openid-connect-generic-settings-page.php:255
    253252msgid "Identify provider User information endpoint."
    254253msgstr ""
    255254
    256 #: includes/openid-connect-generic-settings-page.php:260
     255#: includes/openid-connect-generic-settings-page.php:262
    257256msgid "Token Validation Endpoint URL"
    258257msgstr ""
    259258
    260 #: includes/openid-connect-generic-settings-page.php:261
     259#: includes/openid-connect-generic-settings-page.php:263
    261260msgid "Identify provider token endpoint."
    262261msgstr ""
    263262
    264 #: includes/openid-connect-generic-settings-page.php:268
     263#: includes/openid-connect-generic-settings-page.php:270
    265264msgid "End Session Endpoint URL"
    266265msgstr ""
    267266
    268 #: includes/openid-connect-generic-settings-page.php:269
     267#: includes/openid-connect-generic-settings-page.php:271
    269268msgid "Identify provider logout endpoint."
    270269msgstr ""
    271270
    272 #: includes/openid-connect-generic-settings-page.php:276
     271#: includes/openid-connect-generic-settings-page.php:278
     272msgid "ACR values"
     273msgstr ""
     274
     275#: includes/openid-connect-generic-settings-page.php:279
     276msgid "Use a specific defined authentication contract from the IDP - optional."
     277msgstr ""
     278
     279#: includes/openid-connect-generic-settings-page.php:285
    273280msgid "Identity Key"
    274281msgstr ""
    275282
    276 #: includes/openid-connect-generic-settings-page.php:277
     283#: includes/openid-connect-generic-settings-page.php:286
    277284msgid ""
    278285"Where in the user claim array to find the user's identification data. "
    … …  
    281288msgstr ""
    282289
    283 #: includes/openid-connect-generic-settings-page.php:283
     290#: includes/openid-connect-generic-settings-page.php:292
    284291msgid "Disable SSL Verify"
    285292msgstr ""
    286293
    287 #: includes/openid-connect-generic-settings-page.php:285
     294#: includes/openid-connect-generic-settings-page.php:294
    288295#. translators: %1$s HTML tags for layout/styles, %2$s closing HTML tag for
    289296#. styles.
    … …  
    296303msgstr ""
    297304
    298 #: includes/openid-connect-generic-settings-page.php:290
     305#: includes/openid-connect-generic-settings-page.php:299
    299306msgid "HTTP Request Timeout"
    300307msgstr ""
    301308
    302 #: includes/openid-connect-generic-settings-page.php:291
     309#: includes/openid-connect-generic-settings-page.php:300
    303310msgid "Set the timeout for requests made to the IDP. Default value is 5."
    304311msgstr ""
    305312
    306 #: includes/openid-connect-generic-settings-page.php:297
     313#: includes/openid-connect-generic-settings-page.php:306
    307314msgid "Enforce Privacy"
    308315msgstr ""
    309316
    310 #: includes/openid-connect-generic-settings-page.php:298
     317#: includes/openid-connect-generic-settings-page.php:307
    311318msgid "Require users be logged in to see the site."
    312319msgstr ""
    313320
    314 #: includes/openid-connect-generic-settings-page.php:303
     321#: includes/openid-connect-generic-settings-page.php:313
    315322msgid "Alternate Redirect URI"
    316323msgstr ""
    317324
    318 #: includes/openid-connect-generic-settings-page.php:304
     325#: includes/openid-connect-generic-settings-page.php:314
    319326msgid ""
    320327"Provide an alternative redirect route. Useful if your server is causing "
    … …  
    324331msgstr ""
    325332
    326 #: includes/openid-connect-generic-settings-page.php:309
     333#: includes/openid-connect-generic-settings-page.php:319
    327334msgid "Nickname Key"
    328335msgstr ""
    329336
    330 #: includes/openid-connect-generic-settings-page.php:310
     337#: includes/openid-connect-generic-settings-page.php:320
    331338msgid ""
    332339"Where in the user claim array to find the user's nickname. Possible "
    … …  
    334341msgstr ""
    335342
    336 #: includes/openid-connect-generic-settings-page.php:316
     343#: includes/openid-connect-generic-settings-page.php:326
    337344msgid "Email Formatting"
    338345msgstr ""
    339346
    340 #: includes/openid-connect-generic-settings-page.php:317
     347#: includes/openid-connect-generic-settings-page.php:327
    341348msgid ""
    342349"String from which the user's email address is built. Specify \"{email}\" as "
    … …  
    344351msgstr ""
    345352
    346 #: includes/openid-connect-generic-settings-page.php:323
     353#: includes/openid-connect-generic-settings-page.php:333
    347354msgid "Display Name Formatting"
    348355msgstr ""
    349356
    350 #: includes/openid-connect-generic-settings-page.php:324
     357#: includes/openid-connect-generic-settings-page.php:334
    351358msgid "String from which the user's display name is built."
    352359msgstr ""
    353360
    354 #: includes/openid-connect-generic-settings-page.php:330
     361#: includes/openid-connect-generic-settings-page.php:340
    355362msgid "Identify with User Name"
    356363msgstr ""
    357364
    358 #: includes/openid-connect-generic-settings-page.php:331
     365#: includes/openid-connect-generic-settings-page.php:341
    359366msgid ""
    360367"If checked, the user's identity will be determined by the user name instead "
    … …  
    362369msgstr ""
    363370
    364 #: includes/openid-connect-generic-settings-page.php:336
     371#: includes/openid-connect-generic-settings-page.php:346
    365372msgid "State time limit"
    366373msgstr ""
    367374
    368 #: includes/openid-connect-generic-settings-page.php:337
     375#: includes/openid-connect-generic-settings-page.php:347
    369376msgid "State valid time in seconds. Defaults to 180"
    370377msgstr ""
    371378
    372 #: includes/openid-connect-generic-settings-page.php:342
     379#: includes/openid-connect-generic-settings-page.php:352
    373380msgid "Enable Refresh Token"
    374381msgstr ""
    375382
    376 #: includes/openid-connect-generic-settings-page.php:343
     383#: includes/openid-connect-generic-settings-page.php:353
    377384msgid ""
    378385"If checked, support refresh tokens used to obtain access tokens from "
    … …  
    380387msgstr ""
    381388
    382 #: includes/openid-connect-generic-settings-page.php:348
     389#: includes/openid-connect-generic-settings-page.php:358
    383390msgid "Link Existing Users"
    384391msgstr ""
    385392
    386 #: includes/openid-connect-generic-settings-page.php:349
     393#: includes/openid-connect-generic-settings-page.php:359
    387394msgid ""
    388395"If a WordPress account already exists with the same identity as a "
    … …  
    391398msgstr ""
    392399
    393 #: includes/openid-connect-generic-settings-page.php:354
     400#: includes/openid-connect-generic-settings-page.php:365
    394401msgid "Create user if does not exist"
    395402msgstr ""
    396403
    397 #: includes/openid-connect-generic-settings-page.php:355
    398 msgid ""
    399 "If the user identity is not link to an existing Wordpress user, it is "
    400 "created. If this setting is not enabled and if the user authenticates with "
    401 "an account which is not link to an existing Wordpress user then the "
    402 "authentication failed"
    403 msgstr ""
    404 
    405 #: includes/openid-connect-generic-settings-page.php:360
     404#: includes/openid-connect-generic-settings-page.php:366
     405msgid ""
     406"If the user identity is not linked to an existing WordPress user, it is "
     407"created. If this setting is not enabled, and if the user authenticates with "
     408"an account which is not linked to an existing WordPress user, then the "
     409"authentication will fail."
     410msgstr ""
     411
     412#: includes/openid-connect-generic-settings-page.php:372
    406413msgid "Redirect Back to Origin Page"
    407414msgstr ""
    408415
    409 #: includes/openid-connect-generic-settings-page.php:361
     416#: includes/openid-connect-generic-settings-page.php:373
    410417msgid ""
    411418"After a successful OpenID Connect authentication, this will redirect the "
    … …  
    418425msgstr ""
    419426
    420 #: includes/openid-connect-generic-settings-page.php:366
     427#: includes/openid-connect-generic-settings-page.php:379
    421428msgid "Redirect to the login screen when session is expired"
    422429msgstr ""
    423430
    424 #: includes/openid-connect-generic-settings-page.php:367
     431#: includes/openid-connect-generic-settings-page.php:380
    425432msgid ""
    426433"When enabled, this will automatically redirect the user back to the "
    … …  
    428435msgstr ""
    429436
    430 #: includes/openid-connect-generic-settings-page.php:372
     437#: includes/openid-connect-generic-settings-page.php:386
    431438msgid "Enable Logging"
    432439msgstr ""
    433440
    434 #: includes/openid-connect-generic-settings-page.php:373
     441#: includes/openid-connect-generic-settings-page.php:387
    435442msgid "Very simple log messages for debugging purposes."
    436443msgstr ""
    437444
    438 #: includes/openid-connect-generic-settings-page.php:378
     445#: includes/openid-connect-generic-settings-page.php:392
    439446msgid "Log Limit"
    440447msgstr ""
    441448
    442 #: includes/openid-connect-generic-settings-page.php:379
     449#: includes/openid-connect-generic-settings-page.php:393
    443450msgid ""
    444451"Number of items to keep in the log. These logs are stored as an option in "
    … …  
    446453msgstr ""
    447454
    448 #: includes/openid-connect-generic-settings-page.php:439
     455#: includes/openid-connect-generic-settings-page.php:455
    449456msgid "Notes"
    450457msgstr ""
    451458
    452 #: includes/openid-connect-generic-settings-page.php:442
     459#: includes/openid-connect-generic-settings-page.php:458
    453460msgid "Redirect URI"
    454461msgstr ""
    455462
    456 #: includes/openid-connect-generic-settings-page.php:446
     463#: includes/openid-connect-generic-settings-page.php:462
    457464msgid "Login Button Shortcode"
    458465msgstr ""
    459466
    460 #: includes/openid-connect-generic-settings-page.php:450
     467#: includes/openid-connect-generic-settings-page.php:466
    461468msgid "Authentication URL Shortcode"
    462469msgstr ""
    463470
    464 #: includes/openid-connect-generic-settings-page.php:455
     471#: includes/openid-connect-generic-settings-page.php:471
    465472msgid "Logs"
    466473msgstr ""
    467474
    468 #: includes/openid-connect-generic-settings-page.php:535
     475#: includes/openid-connect-generic-settings-page.php:551
    469476msgid "Example"
    470477msgstr ""
    471478
    472 #: includes/openid-connect-generic-settings-page.php:548
     479#: includes/openid-connect-generic-settings-page.php:564
    473480msgid "Enter your OpenID Connect identity provider settings."
    474481msgstr ""
    475482
    476 #: includes/openid-connect-generic-settings-page.php:557
     483#: includes/openid-connect-generic-settings-page.php:573
    477484msgid "Modify the interaction between OpenID Connect and WordPress users."
    478485msgstr ""
    479486
    480 #: includes/openid-connect-generic-settings-page.php:566
     487#: includes/openid-connect-generic-settings-page.php:582
    481488msgid "Control the authorization mechanics of the site."
    482489msgstr ""
    483490
    484 #: includes/openid-connect-generic-settings-page.php:575
     491#: includes/openid-connect-generic-settings-page.php:591
    485492msgid "Log information about login attempts through OpenID Connect Generic."
    486493msgstr ""
    487494
    488 #: openid-connect-generic.php:202
     495#: openid-connect-generic.php:213
    489496msgid "Private site"
    490497msgstr ""

  • daggerhart-openid-connect-generic/tags/3.9.0/openid-connect-generic.php

    r2516022 r2698055  
    1717 * Plugin URI:        https://github.com/daggerhart/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect generic client using Authorization Code Flow.
    19  * Version:           3.8.5
     19 * Version:           3.9.0
     20 * Requires at least: 4.9
     21 * Requires PHP:      7.2
    2022 * Author:            daggerhart
    2123 * Author URI:        http://www.daggerhart.com
    … …  
    4547
    4648  Actions
    47   - openid-connect-generic-user-create        - 2 args: fires when a new user is created by this plugin
    48   - openid-connect-generic-user-update        - 1 arg: user ID, fires when user is updated by this plugin
    49   - openid-connect-generic-update-user-using-current-claim - 2 args: fires every time an existing user logs
    50   - openid-connect-generic-redirect-user-back - 2 args: $redirect_url, $user. Allows interruption of redirect during login.
    51   - openid-connect-generic-user-logged-in     - 1 arg: $user, fires when user is logged in.
    52   - openid-connect-generic-cron-daily         - daily cron action
    53   - openid-connect-generic-state-not-found    - the given state does not exist in the database, regardless of its expiration.
    54   - openid-connect-generic-state-expired      - the given state exists, but expired before this login attempt.
     49  - openid-connect-generic-user-create                     - 2 args: fires when a new user is created by this plugin
     50  - openid-connect-generic-user-update                     - 1 arg: user ID, fires when user is updated by this plugin
     51  - openid-connect-generic-update-user-using-current-claim - 2 args: fires every time an existing user logs in and the claims are updated.
     52  - openid-connect-generic-redirect-user-back              - 2 args: $redirect_url, $user. Allows interruption of redirect during login.
     53  - openid-connect-generic-user-logged-in                  - 1 arg: $user, fires when user is logged in.
     54  - openid-connect-generic-cron-daily                      - daily cron action
     55  - openid-connect-generic-state-not-found                 - the given state does not exist in the database, regardless of its expiration.
     56  - openid-connect-generic-state-expired                   - the given state exists, but expired before this login attempt.
     57
     58  Callable actions
    5559
    5660  User Meta
    … …  
    7781
    7882    /**
     83     * Singleton instance of self
     84     *
     85     * @var OpenID_Connect_Generic
     86     */
     87    protected static $_instance = null;
     88
     89    /**
    7990     * Plugin version.
    8091     *
    81      * @var
    82      */
    83     const VERSION = '3.8.5';
     92     * @var string
     93     */
     94    const VERSION = '3.9.0';
    8495
    8596    /**
    … …  
    109120     * @var OpenID_Connect_Generic_Client_Wrapper
    110121     */
    111     private $client_wrapper;
     122    public $client_wrapper;
    112123
    113124    /**
    … …  
    122133        $this->settings = $settings;
    123134        $this->logger = $logger;
     135        self::$_instance = $this;
    124136    }
    125137
    … …  
    130142     */
    131143    public function init() {
    132 
    133         wp_enqueue_style( 'daggerhart-openid-connect-generic-admin', plugin_dir_url( __FILE__ ) . 'css/styles-admin.css', array(), self::VERSION, 'all' );
    134144
    135145        $redirect_uri = admin_url( 'admin-ajax.php?action=openid-connect-authorize' );
    … …  
    152162            $this->settings->endpoint_token,
    153163            $redirect_uri,
     164            $this->settings->acr_values,
    154165            $state_time_limit,
    155166            $this->logger
    … …  
    328339            array(
    329340                // OAuth client settings.
    330                 'login_type'           => 'button',
     341                'login_type'           => defined( 'OIDC_LOGIN_TYPE' ) ? OIDC_LOGIN_TYPE : 'button',
    331342                'client_id'            => defined( 'OIDC_CLIENT_ID' ) ? OIDC_CLIENT_ID : '',
    332343                'client_secret'        => defined( 'OIDC_CLIENT_SECRET' ) ? OIDC_CLIENT_SECRET : '',
    333                 'scope'                => '',
     344                'scope'                => defined( 'OIDC_CLIENT_SCOPE' ) ? OIDC_CLIENT_SCOPE : '',
    334345                'endpoint_login'       => defined( 'OIDC_ENDPOINT_LOGIN_URL' ) ? OIDC_ENDPOINT_LOGIN_URL : '',
    335346                'endpoint_userinfo'    => defined( 'OIDC_ENDPOINT_USERINFO_URL' ) ? OIDC_ENDPOINT_USERINFO_URL : '',
    336347                'endpoint_token'       => defined( 'OIDC_ENDPOINT_TOKEN_URL' ) ? OIDC_ENDPOINT_TOKEN_URL : '',
    337348                'endpoint_end_session' => defined( 'OIDC_ENDPOINT_LOGOUT_URL' ) ? OIDC_ENDPOINT_LOGOUT_URL : '',
     349                'acr_values'           => defined( 'OIDC_ACR_VALUES' ) ? OIDC_ACR_VALUES : '',
    338350
    339351                // Non-standard settings.
    … …  
    347359
    348360                // Plugin settings.
    349                 'enforce_privacy' => 0,
     361                'enforce_privacy' => defined( 'OIDC_ENFORCE_PRIVACY' ) ? intval( OIDC_ENFORCE_PRIVACY ) : 0,
    350362                'alternate_redirect_uri' => 0,
    351363                'token_refresh_enable' => 1,
    352                 'link_existing_users' => 0,
    353                 'create_if_does_not_exist' => 1,
    354                 'redirect_user_back' => 0,
    355                 'redirect_on_logout' => 1,
     364                'link_existing_users' => defined( 'OIDC_LINK_EXISTING_USERS' ) ? intval( OIDC_LINK_EXISTING_USERS ) : 0,
     365                'create_if_does_not_exist' => defined( 'OIDC_CREATE_IF_DOES_NOT_EXIST' ) ? intval( OIDC_CREATE_IF_DOES_NOT_EXIST ) : 1,
     366                'redirect_user_back' => defined( 'OIDC_REDIRECT_USER_BACK' ) ? intval( OIDC_REDIRECT_USER_BACK ) : 0,
     367                'redirect_on_logout' => defined( 'OIDC_REDIRECT_ON_LOGOUT' ) ? intval( OIDC_REDIRECT_ON_LOGOUT ) : 1,
    356368                'enable_logging'  => 0,
    357369                'log_limit'       => 1000,
    … …  
    371383        add_filter( 'comment_text_rss', array( $plugin, 'enforce_privacy_feeds' ), 999 );
    372384    }
     385
     386    /**
     387     * Create (if needed) and return a singleton of self.
     388     *
     389     * @return OpenID_Connect_Generic
     390     */
     391    public static function instance() {
     392        if ( null === self::$_instance ) {
     393            self::bootstrap();
     394        }
     395        return self::$_instance;
     396    }
    373397}
    374398
    375 OpenID_Connect_Generic::bootstrap();
     399OpenID_Connect_Generic::instance();
    376400
    377401register_activation_hook( __FILE__, array( 'OpenID_Connect_Generic', 'activation' ) );
    378402register_deactivation_hook( __FILE__, array( 'OpenID_Connect_Generic', 'deactivation' ) );
     403
     404// Provide publicly accessible plugin helper functions.
     405require_once( 'includes/functions.php' );

  • daggerhart-openid-connect-generic/tags/3.9.0/readme.txt

    r2516022 r2698055  
    44Tags: security, login, oauth2, openidconnect, apps, authentication, autologin, sso
    55Requires at least: 4.9
    6 Tested up to: 5.7.1
    7 Stable tag: 3.8.5
    8 Requires PHP: 7.1
     6Tested up to: 5.9.2
     7Stable tag: 3.9.0
     8Requires PHP: 7.2
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    5252== Changelog ==
    5353
    54 = 3.8.5
    55 
    56 * Fix: @timnolte - Fixes missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
    57 * Fix: @timnolte - Fixes Redirect URL Logic to Handle Sub-directory Installs.
    58 * Fix: @timnolte - Fixes to provide proper redirect user back for the openid_connect_generic_auth_url shortcode.
     54= 3.9.0 =
     55
     56* Feature: @matchaxnb - Added support for additional configuration constants.
     57* Feature: @schanzen - Added support for agregated claims.
     58* Fix: @rkcreation - Fixed access token not updating user metadata after login.
     59* Fix: @danc1248 - Fixed user creation issue on Multisite Networks.
     60* Feature: @RobjS - Added plugin singleton to support for more developer customization.
     61* Feature: @jkouris - Added action hook to allow custom handling of session expiration.
     62* Fix: @tommcc - Fixed admin CSS loading only on the plugin settings screen.
     63* Feature: @rkcreation - Added method to refresh the user claim.
     64* Feature: @Glowsome - Added acr_values support & verification checks that it when defined in options is honored.
     65* Fix: @timnolte - Fixed regression which caused improper fallback on missing claims.
     66* Fix: @slykar - Fixed missing query string handling in redirect URL.
     67* Fix: @timnolte - Fixed issue with some user linking and user creation handling.
     68* Improvement: @timnolte - Fixed plugin settings typos and screen formatting.
     69* Security: @timnolte - Updated build tooling security vulnerabilities.
     70* Improvement: @timnolte - Changed build tooling scripts.
     71
     72= 3.8.5 =
     73
     74* Fix: @timnolte - Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
     75* Fix: @timnolte - Fixed Redirect URL Logic to Handle Sub-directory Installs.
     76* Fix: @timnolte - Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.
    5977
    6078= 3.8.4 =

  • daggerhart-openid-connect-generic/trunk/CHANGELOG.md

    r2516022 r2698055  
    11# OpenId Connect Generic Changelog
    22
    3 3.8.5
    4 * Fix: @timnolte - Fixes missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
    5 * Fix: @timnolte - Fixes Redirect URL Logic to Handle Sub-directory Installs.
    6 * Fix: @timnolte - Fixes to provide proper redirect user back for the openid_connect_generic_auth_url shortcode.
     33.9.0
    74
    8 3.8.4
    9 * Fix: @timnolte - Fixed invalid State object access for redirection handling.
    10 * Improvement: @timnolte - Fixed local wp-env Docker development environment.
    11 * Improvement: @timnolte - Fixed Composer scripts for linting and static analysis.
     5- Feature: @matchaxnb - Added support for additional configuration constants.
     6- Feature: @schanzen - Added support for agregated claims.
     7- Fix: @rkcreation - Fixed access token not updating user metadata after login.
     8- Fix: @danc1248 - Fixed user creation issue on Multisite Networks.
     9- Feature: @RobjS - Added plugin singleton to support for more developer customization.
     10- Feature: @jkouris - Added action hook to allow custom handling of session expiration.
     11- Fix: @tommcc - Fixed admin CSS loading only on the plugin settings screen.
     12- Feature: @rkcreation - Added method to refresh the user claim.
     13- Feature: @Glowsome - Added acr_values support & verification checks that it when defined in options is honored.
     14- Fix: @timnolte - Fixed regression which caused improper fallback on missing claims.
     15- Fix: @slykar - Fixed missing query string handling in redirect URL.
     16- Fix: @timnolte - Fixed issue with some user linking and user creation handling.
     17- Improvement: @timnolte - Fixed plugin settings typos and screen formatting.
     18- Security: @timnolte - Updated build tooling security vulnerabilities.
     19- Improvement: @timnolte - Changed build tooling scripts.
    1220
    13 3.8.3
     21  3.8.5
    1422
    15 * Fix: @timnolte - Fixed problems with proper redirect handling.
    16 * Improvement: @timnolte - Changes redirect handling to use State instead of cookies.
    17 * Improvement: @timnolte - Refactored additional code to meet coding standards.
     23- Fix: @timnolte - Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
     24- Fix: @timnolte - Fixed Redirect URL Logic to Handle Sub-directory Installs.
     25- Fix: @timnolte - Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.
    1826
    19 3.8.2
     27  3.8.4
    2028
    21 * Fix: @timnolte - Fixed reported XSS vulnerability on WordPress login screen.
     29- Fix: @timnolte - Fixed invalid State object access for redirection handling.
     30- Improvement: @timnolte - Fixed local wp-env Docker development environment.
     31- Improvement: @timnolte - Fixed Composer scripts for linting and static analysis.
    2232
    23 3.8.1
     33  3.8.3
    2434
    25 * Fix: @timnolte - Prevent SSO redirect on password protected posts.
    26 * Fix: @timnolte - CI/CD build issues.
    27 * Fix: @timnolte - Invalid redirect handling on logout for Auto Login setting.
     35- Fix: @timnolte - Fixed problems with proper redirect handling.
     36- Improvement: @timnolte - Changes redirect handling to use State instead of cookies.
     37- Improvement: @timnolte - Refactored additional code to meet coding standards.
    2838
    29 3.8.0
     39  3.8.2
    3040
    31 * Feature: @timnolte - Ability to use 6 new constants for setting client configuration instead of storing in the DB.
    32 * Improvement: @timnolte - NPM version requirements for development.
    33 * Improvement: @timnolte - Travis CI build fixes.
    34 * Improvement: @timnolte - GrumPHP configuration updates for code contributions.
    35 * Improvement: @timnolte - Refactored to meet WordPress coding standards.
    36 * Improvement: @timnolte - Refactored to provide localization.
    37 * Improvement: @timnolte - Refactored to provide a Docker-based local development environment.
     41- Fix: @timnolte - Fixed reported XSS vulnerability on WordPress login screen.
    3842
    39 3.7.1
     43  3.8.1
    4044
    41 * Fix: Release Version Number.
     45- Fix: @timnolte - Prevent SSO redirect on password protected posts.
     46- Fix: @timnolte - CI/CD build issues.
     47- Fix: @timnolte - Invalid redirect handling on logout for Auto Login setting.
    4248
    43 3.7.0
     49  3.8.0
    4450
    45 * Feature: @timnolte - Ability to enable/disable token refresh. Useful for IDPs that don't support token refresh.
    46 * Feature: @timnolte - Support custom redirect URL(`redirect_to`) with the authentication URL & login button shortcodes.
     51- Feature: @timnolte - Ability to use 6 new constants for setting client configuration instead of storing in the DB.
     52- Improvement: @timnolte - NPM version requirements for development.
     53- Improvement: @timnolte - Travis CI build fixes.
     54- Improvement: @timnolte - GrumPHP configuration updates for code contributions.
     55- Improvement: @timnolte - Refactored to meet WordPress coding standards.
     56- Improvement: @timnolte - Refactored to provide localization.
     57- Improvement: @timnolte - Refactored to provide a Docker-based local development environment.
     58
     59  3.7.1
     60
     61- Fix: Release Version Number.
     62
     63  3.7.0
     64
     65- Feature: @timnolte - Ability to enable/disable token refresh. Useful for IDPs that don't support token refresh.
     66- Feature: @timnolte - Support custom redirect URL(`redirect_to`) with the authentication URL & login button shortcodes.
     67
    4768  - Supports additional attribute overrides including login `button_text`, `endpoint_login`, `scope`, `redirect_uri`.
    4869
    49 3.6.0
     70    3.6.0
    5071
    51 * Improvement: @RobjS - Improved error messages during login state failure.
    52 * Improvement: @RobjS - New developer filter for login form button URL.
    53 * Fix: @cs1m0n - Only increment username during new user creation if the "Link existing user" setting is enabled.
    54 * Fix: @xRy-42 - Allow periods and spaces in usernames to match what WordPress core allows.
    55 * Feature: @benochen - New setting named "Create user if does not exist" determines whether new users are created during login attempts.
    56 * Improvement: @flat235 - Username transliteration and normalization.
     72- Improvement: @RobjS - Improved error messages during login state failure.
     73- Improvement: @RobjS - New developer filter for login form button URL.
     74- Fix: @cs1m0n - Only increment username during new user creation if the "Link existing user" setting is enabled.
     75- Fix: @xRy-42 - Allow periods and spaces in usernames to match what WordPress core allows.
     76- Feature: @benochen - New setting named "Create user if does not exist" determines whether new users are created during login attempts.
     77- Improvement: @flat235 - Username transliteration and normalization.
    5778
    58 3.5.1
     79  3.5.1
    5980
    60 * Fix: @daggerhart - New approach to state management using transients.
     81- Fix: @daggerhart - New approach to state management using transients.
    6182
    62 3.5.0
     83  3.5.0
    6384
    64 * Readme fix: @thijskh - Fix syntax error in example openid-connect-generic-login-button-text
    65 * Feature: @slavicd - Allow override of the plugin by posting credentials to wp-login.php
    66 * Feature: @gassan - New action on use login
    67 * Fix: @daggerhart - Avoid double question marks in auth url query string
    68 * Fix: @drzraf - wp-cli bootstrap must not inhibit custom rewrite rules
    69 * Syntax change: @mullikine - Change PHP keywords to comply with PSR2
     85- Readme fix: @thijskh - Fix syntax error in example openid-connect-generic-login-button-text
     86- Feature: @slavicd - Allow override of the plugin by posting credentials to wp-login.php
     87- Feature: @gassan - New action on use login
     88- Fix: @daggerhart - Avoid double question marks in auth url query string
     89- Fix: @drzraf - wp-cli bootstrap must not inhibit custom rewrite rules
     90- Syntax change: @mullikine - Change PHP keywords to comply with PSR2
    7091
    7192**3.4.1**
    7293
    73 * Minor documentation update and additional error checking.
     94- Minor documentation update and additional error checking.
    7495
    7596**3.4.0**
    7697
    77 * Feature: @drzraf - New filter hook: ability to filter claim and derived user data before user creation.
    78 * Feature: @anttileppa - State time limit can now be changed on the settings page.
    79 * Fix: @drzraf - Fix PHP notice when using traditional login, $token_response may be empty.
    80 * Fix: @drzraf - Fixed a notice when cookie does not contain expected redirect_url
     98- Feature: @drzraf - New filter hook: ability to filter claim and derived user data before user creation.
     99- Feature: @anttileppa - State time limit can now be changed on the settings page.
     100- Fix: @drzraf - Fix PHP notice when using traditional login, $token_response may be empty.
     101- Fix: @drzraf - Fixed a notice when cookie does not contain expected redirect_url
    81102
    82103**3.3.1**
    83104
    84 * Prefixing classes for more efficient autoloading.
    85 * Avoid altering global wp_remote_post() parameters.
    86 * Minor metadata updates for wp.org
     105- Prefixing classes for more efficient autoloading.
     106- Avoid altering global wp_remote_post() parameters.
     107- Minor metadata updates for wp.org
    87108
    88109**3.3.0**
    89110
    90 * Fix: @pjeby - Handle multiple user sessions better by using the `WP_Session_Tokens` object. Predecessor to fixes for multiple other issues: #49, #50, #51
     111- Fix: @pjeby - Handle multiple user sessions better by using the `WP_Session_Tokens` object. Predecessor to fixes for multiple other issues: #49, #50, #51
    91112
    92113**3.2.1**
    93114
    94 * Bug fix: @svenvanhal - Exit after issuing redirect. Fixes #46
     115- Bug fix: @svenvanhal - Exit after issuing redirect. Fixes #46
    95116
    96117**3.2.0**
    97118
    98 * Feature: @robbiepaul - trigger core action `wp_login` when user is logged in through this plugin
    99 * Feature: @moriyoshi - Determine the WP_User display name with replacement tokens on the settings page. Tokens can be any property of the user_claim.
    100 * Feature: New setting to set redirect URL when session expires.
    101 * Feature: @robbiepaul - New filter for modifying authentication URL
    102 * Fix: @cedrox - Adding id_token_hint to logout URL according to spec
    103 * Bug fix: Provide port to the request header when requesting the user_claim
     119- Feature: @robbiepaul - trigger core action `wp_login` when user is logged in through this plugin
     120- Feature: @moriyoshi - Determine the WP_User display name with replacement tokens on the settings page. Tokens can be any property of the user_claim.
     121- Feature: New setting to set redirect URL when session expires.
     122- Feature: @robbiepaul - New filter for modifying authentication URL
     123- Fix: @cedrox - Adding id_token_hint to logout URL according to spec
     124- Bug fix: Provide port to the request header when requesting the user_claim
    104125
    105126**3.1.0**
    106127
    107 * Feature: @rwasef1830 - Refresh tokens
    108 * Feature: @rwasef1830 - Integrated logout support with end_session endpoint
    109 * Feature: May use an alternate redirect_uri that doesn't rely on admin-ajax
    110 * Feature: @ahatherly - Support for IDP behind reverse proxy
    111 * Bug fix: @robertstaddon - case insensitive check for Bearer token
    112 * Bug fix: @rwasef1830 - "redirect to origin when auto-sso" cookie issue
    113 * Bug fix: @rwasef1830 - PHP Warnings headers already sent due to attempts to redirect and set cookies during login form message
    114 * Bug fix: @rwasef1830 - expire session when access_token expires if no refresh token found
    115 * UX fix: @rwasef1830 - Show login button on error redirect when using auto-sso
     128- Feature: @rwasef1830 - Refresh tokens
     129- Feature: @rwasef1830 - Integrated logout support with end_session endpoint
     130- Feature: May use an alternate redirect_uri that doesn't rely on admin-ajax
     131- Feature: @ahatherly - Support for IDP behind reverse proxy
     132- Bug fix: @robertstaddon - case insensitive check for Bearer token
     133- Bug fix: @rwasef1830 - "redirect to origin when auto-sso" cookie issue
     134- Bug fix: @rwasef1830 - PHP Warnings headers already sent due to attempts to redirect and set cookies during login form message
     135- Bug fix: @rwasef1830 - expire session when access_token expires if no refresh token found
     136- UX fix: @rwasef1830 - Show login button on error redirect when using auto-sso
    116137
    117138**3.0.8**
    118139
    119 * Feature: @wgengarelly - Added `openid-connect-generic-update-user-using-current-claim` action hook allowing other plugins/themes
     140- Feature: @wgengarelly - Added `openid-connect-generic-update-user-using-current-claim` action hook allowing other plugins/themes
    120141  to take action using the fresh claims received when an existing user logs in.
    121142
    122143**3.0.7**
    123144
    124 * Bug fix: @wgengarelly - When requesting userinfo, send the access token using the Authorization header field as recommended in
    125 section 5.3.1 of the specs.
     145- Bug fix: @wgengarelly - When requesting userinfo, send the access token using the Authorization header field as recommended in
     146  section 5.3.1 of the specs.
    126147
    127148**3.0.6**
    128149
    129 * Bug fix: @robertstaddon - If "Link Existing Users" is enabled, allow users who login with OpenID Connect to also log in with WordPress credentials
     150- Bug fix: @robertstaddon - If "Link Existing Users" is enabled, allow users who login with OpenID Connect to also log in with WordPress credentials
    130151
    131152**3.0.5**
    132153
    133 * Feature: @robertstaddon - Added `[openid_connect_generic_login_button]` shortcode to allow the login button to be placed anywhere
    134 * Feature: @robertstaddon - Added setting to "Redirect Back to Origin Page" after a successful login instead of redirecting to the home page.
     154- Feature: @robertstaddon - Added `[openid_connect_generic_login_button]` shortcode to allow the login button to be placed anywhere
     155- Feature: @robertstaddon - Added setting to "Redirect Back to Origin Page" after a successful login instead of redirecting to the home page.
    135156
    136157**3.0.4**
    137158
    138 * Feature: @robertstaddon - Added setting to allow linking existing WordPress user accounts with newly-authenticated OpenID Connect login
     159- Feature: @robertstaddon - Added setting to allow linking existing WordPress user accounts with newly-authenticated OpenID Connect login
    139160
    140161**3.0.3**
    141162
    142 * Using WordPresss's is_ssl() for setcookie()'s "secure" parameter
    143 * Bug fix: Incrementing username in case of collision.
    144 * Bug fix: Wrong error sent when missing token body
     163- Using WordPresss's is_ssl() for setcookie()'s "secure" parameter
     164- Bug fix: Incrementing username in case of collision.
     165- Bug fix: Wrong error sent when missing token body
    145166
    146167**3.0.2**
    147168
    148 * Added http_request_timeout setting
     169- Added http_request_timeout setting
    149170
    150171**3.0.1**
    151172
    152 * Finalizing 3.0.x api
     173- Finalizing 3.0.x api
    153174
    154175**3.0**
    155176
    156 * Complete rewrite to separate concerns
    157 * Changed settings keys for clarity (requires updating settings if upgrading from another version)
    158 * Error logging
     177- Complete rewrite to separate concerns
     178- Changed settings keys for clarity (requires updating settings if upgrading from another version)
     179- Error logging
    159180
    160181**2.1**
    161182
    162 * Working my way closer to spec. Possible breaking change. Now checking for preferred_username as priority.
    163 * New username determination to avoid collisions
     183- Working my way closer to spec. Possible breaking change. Now checking for preferred_username as priority.
     184- New username determination to avoid collisions
    164185
    165186**2.0**
    166187
    167188Complete rewrite
    168 

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client-wrapper.php

    r2516022 r2698055  
    149149     */
    150150    public function get_redirect_to() {
     151        // @var WP $wp WordPress environment setup class.
    151152        global $wp;
    152153
    … …  
    171172        if ( $this->settings->redirect_user_back ) {
    172173            if ( ! empty( $wp->request ) ) {
    173                 if ( ! empty( $wp->did_permalink ) && $wp->did_permalink ) {
    174                     $redirect_url = home_url( trailingslashit( $wp->request ) );
     174                if ( ! empty( $wp->did_permalink ) && boolval( $wp->did_permalink ) === true ) {
     175                    $redirect_url = home_url( add_query_arg( $_GET, trailingslashit( $wp->request ) ) );
    175176                } else {
    176177                    $redirect_url = home_url( add_query_arg( null, null ) );
    … …  
    211212                'redirect_uri' => $this->client->get_redirect_uri(),
    212213                'redirect_to' => $this->get_redirect_to(),
     214                'acr_values' => $this->settings->acr_values,
    213215            ),
    214216            $atts,
    … …  
    225227            $separator = '&';
    226228        }
     229
     230        $url_format = '%1$s%2$sresponse_type=code&scope=%3$s&client_id=%4$s&state=%5$s&redirect_uri=%6$s';
     231        if ( ! empty( $atts['acr_values'] ) ) {
     232            $url_format .= '&acr_values=%7$s';
     233        }
     234
    227235        $url = sprintf(
    228             '%1$s%2$sresponse_type=code&scope=%3$s&client_id=%4$s&state=%5$s&redirect_uri=%6$s',
     236            $url_format,
    229237            $atts['endpoint_login'],
    230238            $separator,
    … …  
    232240            rawurlencode( $atts['client_id'] ),
    233241            $this->client->new_state( $atts['redirect_to'] ),
    234             rawurlencode( $atts['redirect_uri'] )
     242            rawurlencode( $atts['redirect_uri'] ),
     243            rawurlencode( $atts['acr_values'] )
    235244        );
    236245
    … …  
    272281
    273282        if ( ! $refresh_token || ( $refresh_expires && $current_time > $refresh_expires ) ) {
    274             wp_logout();
    275 
    276             if ( $this->settings->redirect_on_logout ) {
    277                 $this->error_redirect( new WP_Error( 'access-token-expired', __( 'Session expired. Please login again.', 'daggerhart-openid-connect-generic' ) ) );
     283            if ( isset( $_SERVER['REQUEST_URI'] ) ) {
     284                do_action( 'openid-connect-generic-session-expired', wp_get_current_user(), esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
     285                wp_logout();
     286
     287                if ( $this->settings->redirect_on_logout ) {
     288                    $this->error_redirect( new WP_Error( 'access-token-expired', __( 'Session expired. Please login again.', 'daggerhart-openid-connect-generic' ) ) );
     289                }
     290
     291                return;
    278292            }
    279 
    280             return;
    281293        }
    282294
    … …  
    295307        }
    296308
     309        update_user_meta( $user_id, 'openid-connect-generic-last-token-response', $token_response );
    297310        $this->save_refresh_token( $manager, $token, $token_response );
    298311    }
    … …  
    511524        $user = $this->get_user_by_identity( $subject_identity );
    512525
     526        // A pre-existing IDP mapped user wasn't found.
    513527        if ( ! $user ) {
    514             if ( $this->settings->create_if_does_not_exist ) {
     528            // If linking existing users or creating new ones call the `create_new_user` method which handles both cases.
     529            if ( $this->settings->link_existing_users || $this->settings->create_if_does_not_exist ) {
    515530                $user = $this->create_new_user( $subject_identity, $user_claim );
    516531                if ( is_wp_error( $user ) ) {
    … …  
    520535                $this->error_redirect( new WP_Error( 'identity-not-map-existing-user', __( 'User identity is not linked to an existing WordPress user.', 'daggerhart-openid-connect-generic' ), $user_claim ) );
    521536            }
    522         } else {
    523             // Allow plugins / themes to take action using current claims on existing user (e.g. update role).
    524             do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    525537        }
    526538
    … …  
    535547        $this->login_user( $user, $token_response, $id_token_claim, $user_claim, $subject_identity );
    536548
     549        // Allow plugins / themes to take action once a user is logged in.
    537550        do_action( 'openid-connect-generic-user-logged-in', $user );
    538551
    … …  
    581594
    582595    /**
     596     * Refresh user claim.
     597     *
     598     * @param WP_User $user             The user object.
     599     * @param array   $token_response   The token response.
     600     *
     601     * @return WP_Error|array
     602     */
     603    public function refresh_user_claim( $user, $token_response ) {
     604        $client = $this->client;
     605
     606        /**
     607         * The id_token is used to identify the authenticated user, e.g. for SSO.
     608         * The access_token must be used to prove access rights to protected
     609         * resources e.g. for the userinfo endpoint
     610         */
     611        $id_token_claim = $client->get_id_token_claim( $token_response );
     612
     613        // Allow for other plugins to alter data before validation.
     614        $id_token_claim = apply_filters( 'openid-connect-modify-id-token-claim-before-validation', $id_token_claim );
     615
     616        if ( is_wp_error( $id_token_claim ) ) {
     617            return $id_token_claim;
     618        }
     619
     620        // Validate our id_token has required values.
     621        $valid = $client->validate_id_token_claim( $id_token_claim );
     622
     623        if ( is_wp_error( $valid ) ) {
     624            return $valid;
     625        }
     626
     627        // If userinfo endpoint is set, exchange the token_response for a user_claim.
     628        if ( ! empty( $this->settings->endpoint_userinfo ) && isset( $token_response['access_token'] ) ) {
     629            $user_claim = $client->get_user_claim( $token_response );
     630        } else {
     631            $user_claim = $id_token_claim;
     632        }
     633
     634        if ( is_wp_error( $user_claim ) ) {
     635            return $user_claim;
     636        }
     637
     638        // Validate our user_claim has required values.
     639        $valid = $client->validate_user_claim( $user_claim, $id_token_claim );
     640
     641        if ( is_wp_error( $valid ) ) {
     642            $this->error_redirect( $valid );
     643            return $valid;
     644        }
     645
     646        // Store the tokens for future reference.
     647        update_user_meta( $user->ID, 'openid-connect-generic-last-token-response', $token_response );
     648        update_user_meta( $user->ID, 'openid-connect-generic-last-id-token-claim', $id_token_claim );
     649        update_user_meta( $user->ID, 'openid-connect-generic-last-user-claim', $user_claim );
     650
     651        return $user_claim;
     652    }
     653
     654    /**
    583655     * Record user meta data, and provide an authorization cookie.
    584656     *
    … …  
    596668        update_user_meta( $user->ID, 'openid-connect-generic-last-id-token-claim', $id_token_claim );
    597669        update_user_meta( $user->ID, 'openid-connect-generic-last-user-claim', $user_claim );
     670        // Allow plugins / themes to take action using current claims on existing user (e.g. update role).
     671        do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    598672
    599673        // Create the WP session, so we know its token.
    … …  
    657731                    ),
    658732                ),
     733                // Override the default blog_id (get_current_blog_id) to find users on different sites of a multisite install.
     734                'blog_id' => 0,
    659735            )
    660736        );
    661737
    662         // If we found an existing users, grab the first one returned.
     738        // If we found existing users, grab the first one returned.
    663739        if ( $user_query->get_total() > 0 ) {
    664740            $users = $user_query->get_results();
    … …  
    674750     * @param array $user_claim The IDP authenticated user claim data.
    675751     *
    676      * @return string|WP_Error|null
     752     * @return string|WP_Error
    677753     */
    678754    private function get_username_from_claim( $user_claim ) {
    … …  
    684760        if ( ! empty( $this->settings->identity_key ) && isset( $user_claim[ $this->settings->identity_key ] ) ) {
    685761            $desired_username = $user_claim[ $this->settings->identity_key ];
    686         } else if ( isset( $user_claim['preferred_username'] ) && ! empty( $user_claim['preferred_username'] ) ) {
     762        }
     763        if ( empty( $desired_username ) && isset( $user_claim['preferred_username'] ) && ! empty( $user_claim['preferred_username'] ) ) {
    687764            $desired_username = $user_claim['preferred_username'];
    688         } else if ( isset( $user_claim['name'] ) && ! empty( $user_claim['name'] ) ) {
     765        }
     766        if ( empty( $desired_username ) && isset( $user_claim['name'] ) && ! empty( $user_claim['name'] ) ) {
    689767            $desired_username = $user_claim['name'];
    690         } else if ( isset( $user_claim['email'] ) && ! empty( $user_claim['email'] ) ) {
     768        }
     769        if ( empty( $desired_username ) && isset( $user_claim['email'] ) && ! empty( $user_claim['email'] ) ) {
    691770            $tmp = explode( '@', $user_claim['email'] );
    692771            $desired_username = $tmp[0];
    693         } else {
     772        }
     773        if ( empty( $desired_username ) ) {
    694774            // Nothing to build a name from.
    695775            return new WP_Error( 'no-username', __( 'No appropriate username found.', 'daggerhart-openid-connect-generic' ), $user_claim );
    696776        }
    697777
    698         // Normalize the data a bit.
    699         // @var string $transliterated_username The username converted to ASCII from UTF-8.
    700         $transliterated_username = iconv( 'UTF-8', 'ASCII//TRANSLIT', $desired_username );
    701         if ( empty( $transliterated_username ) ) {
    702             // translators: $1$s is a username from the IDP.
    703             return new WP_Error( 'username-transliteration-failed', sprintf( __( 'Username %1$s could not be transliterated.', 'daggerhart-openid-connect-generic' ), $desired_username ), $desired_username );
    704         }
    705         $normalized_username = strtolower( preg_replace( '/[^a-zA-Z0-9 _.\-@]/', '', $transliterated_username ) );
    706         if ( empty( $normalized_username ) ) {
    707             // translators: %1$s is the ASCII version of the username from the IDP.
    708             return new WP_Error( 'username-normalization-failed', sprintf( __( 'Username %1$s could not be normalized.', 'daggerhart-openid-connect-generic' ), $transliterated_username ), $transliterated_username );
    709         }
    710 
    711         // Copy the username for incrementing.
    712         $username = ! empty( $normalized_username ) ? $normalized_username : null;
    713 
    714         if ( ! $this->settings->link_existing_users && ! is_null( $username ) ) {
    715             // @example Original user gets "name", second user gets "name2", etc.
    716             $count = 1;
    717             while ( username_exists( $username ) ) {
    718                 $count ++;
    719                 $username = $normalized_username . $count;
    720             }
    721         }
    722 
    723         return $username;
     778        // Don't use the full email address for a username.
     779        $_desired_username = explode( '@', $desired_username );
     780        $desired_username = $_desired_username[0];
     781        // Use WordPress Core to sanitize the IDP username.
     782        $sanitized_username = sanitize_user( $desired_username, true );
     783        if ( empty( $sanitized_username ) ) {
     784            // translators: %1$s is the santitized version of the username from the IDP.
     785            return new WP_Error( 'username-sanitization-failed', sprintf( __( 'Username %1$s could not be sanitized.', 'daggerhart-openid-connect-generic' ), $desired_username ), $desired_username );
     786        }
     787
     788        return $sanitized_username;
    724789    }
    725790
    … …  
    747812
    748813    /**
     814     * Checks if $claimname is in the body or _claim_names of the userinfo.
     815     * If yes, returns the claim value. Otherwise, returns false.
     816     *
     817     * @param string $claimname the claim name to look for.
     818     * @param array  $userinfo the JSON to look in.
     819     * @param string $claimvalue the source claim value ( from the body of the JWT of the claim source).
     820     * @return true|false
     821     */
     822    private function get_claim( $claimname, $userinfo, &$claimvalue ) {
     823        /**
     824         * If we find a simple claim, return it.
     825         */
     826        if ( array_key_exists( $claimname, $userinfo ) ) {
     827            $claimvalue = $userinfo[ $claimname ];
     828            return true;
     829        }
     830        /**
     831         * If there are no aggregated claims, it is over.
     832         */
     833        if ( ! array_key_exists( '_claim_names', $userinfo ) ||
     834            ! array_key_exists( '_claim_sources', $userinfo ) ) {
     835            return false;
     836        }
     837        $claim_src_ptr = $userinfo['_claim_names'];
     838        if ( ! isset( $claim_src_ptr ) ) {
     839            return false;
     840        }
     841        /**
     842         * No reference found
     843         */
     844        if ( ! array_key_exists( $claimname, $claim_src_ptr ) ) {
     845            return false;
     846        }
     847        $src_name = $claim_src_ptr[ $claimname ];
     848        // Reference found, but no corresponding JWT. This is a malformed userinfo.
     849        if ( ! array_key_exists( $src_name, $userinfo['_claim_sources'] ) ) {
     850            return false;
     851        }
     852        $src = $userinfo['_claim_sources'][ $src_name ];
     853        // Source claim is not a JWT. Abort.
     854        if ( ! array_key_exists( 'JWT', $src ) ) {
     855            return false;
     856        }
     857        /**
     858         * Extract claim from JWT.
     859         * FIXME: We probably want to verify the JWT signature/issuer here.
     860         * For example, using JWKS if applicable. For symmetrically signed
     861         * JWTs (HMAC), we need a way to specify the acceptable secrets
     862         * and each possible issuer in the config.
     863         */
     864        $jwt = $src['JWT'];
     865        list ( $header, $body, $rest ) = explode( '.', $jwt, 3 );
     866        $body_str = base64_decode( $body, false );
     867        if ( ! $body_str ) {
     868            return false;
     869        }
     870        $body_json = json_decode( $body_str, true );
     871        if ( ! isset( $body_json ) ) {
     872            return false;
     873        }
     874        if ( ! array_key_exists( $claimname, $body_json ) ) {
     875            return false;
     876        }
     877        $claimvalue = $body_json[ $claimname ];
     878        return true;
     879    }
     880
     881
     882    /**
    749883     * Build a string from the user claim according to the specified format.
    750884     *
    … …  
    758892        $matches = null;
    759893        $string = '';
     894        $info = '';
    760895        $i = 0;
    761896        if ( preg_match_all( '/\{[^}]*\}/u', $format, $matches, PREG_OFFSET_CAPTURE ) ) {
    … …  
    763898                $key = substr( $match[0], 1, -1 );
    764899                $string .= substr( $format, $i, $match[1] - $i );
    765                 if ( ! isset( $user_claim[ $key ] ) ) {
     900                if ( ! $this->get_claim( $key, $user_claim, $info ) ) {
    766901                    if ( $error_on_missing_key ) {
    767902                        return new WP_Error(
    … …  
    777912                    }
    778913                } else {
    779                     $string .= $user_claim[ $key ];
     914                    $string .= $info;
    780915                }
    781916                $i = $match[1] + strlen( $match[0] );
    … …  
    836971        // Allow claim details to determine username, email, nickname and displayname.
    837972        $_email = $this->get_email_from_claim( $user_claim, true );
    838         if ( is_wp_error( $_email ) ) {
     973        if ( is_wp_error( $_email ) || empty( $_email ) ) {
    839974            $values_missing = true;
    840         } else if ( ! is_null( $_email ) ) {
     975        } else {
    841976            $email = $_email;
    842977        }
    843978
    844979        $_username = $this->get_username_from_claim( $user_claim );
    845         if ( is_wp_error( $_username ) ) {
     980        if ( is_wp_error( $_username ) || empty( $_username ) ) {
    846981            $values_missing = true;
    847         } else if ( ! is_null( $_username ) ) {
     982        } else {
    848983            $username = $_username;
    849984        }
    850985
    851986        $_nickname = $this->get_nickname_from_claim( $user_claim );
    852         if ( is_null( $_nickname ) ) {
     987        if ( is_wp_error( $_nickname ) || empty( $_nickname ) ) {
    853988            $values_missing = true;
    854989        } else {
    … …  
    857992
    858993        $_displayname = $this->get_displayname_from_claim( $user_claim, true );
    859         if ( is_wp_error( $_displayname ) ) {
     994        if ( is_wp_error( $_displayname ) || empty( $_displayname ) ) {
    860995            $values_missing = true;
    861         } else if ( ! is_null( $_displayname ) ) {
     996        } else {
    862997            $displayname = $_displayname;
    863998        }
    … …  
    8781013        if ( is_wp_error( $_email ) ) {
    8791014            return $_email;
    880         } else if ( ! is_null( $_email ) ) {
     1015        }
     1016        // Use the email address from the latest userinfo request if not empty.
     1017        if ( ! empty( $_email ) ) {
    8811018            $email = $_email;
    8821019        }
    … …  
    8851022        if ( is_wp_error( $_username ) ) {
    8861023            return $_username;
    887         } else if ( ! is_null( $_username ) ) {
     1024        }
     1025        // Use the username from the latest userinfo request if not empty.
     1026        if ( ! empty( $_username ) ) {
    8881027            $username = $_username;
    8891028        }
    … …  
    8921031        if ( is_wp_error( $_nickname ) ) {
    8931032            return $_nickname;
    894         } else if ( is_null( $_nickname ) ) {
     1033        }
     1034        // Use the username as the nickname if the userinfo request nickname is empty.
     1035        if ( empty( $_nickname ) ) {
    8951036            $nickname = $username;
    8961037        }
    … …  
    8991040        if ( is_wp_error( $_displayname ) ) {
    9001041            return $_displayname;
    901         } else if ( is_null( $_displayname ) ) {
     1042        }
     1043        // Use the nickname as the displayname if the userinfo request displayname is empty.
     1044        if ( empty( $_displayname ) ) {
    9021045            $displayname = $nickname;
    9031046        }
    9041047
    905         // Before trying to create the user, first check if a user with the same email already exists.
     1048        // Before trying to create the user, first check if a matching user exists.
    9061049        if ( $this->settings->link_existing_users ) {
     1050            $uid = null;
    9071051            if ( $this->settings->identify_with_username ) {
    9081052                $uid = username_exists( $username );
    … …  
    9101054                $uid = email_exists( $email );
    9111055            }
    912             if ( $uid ) {
     1056            if ( ! empty( $uid ) ) {
    9131057                $user = $this->update_existing_user( $uid, $subject_identity );
    9141058                do_action( 'openid-connect-generic-update-user-using-current-claim', $user, $user_claim );
    … …  
    9211065         * based on the returned user claim.
    9221066         */
    923         $create_user = apply_filters( 'openid-connect-generic-user-creation-test', true, $user_claim );
     1067        $create_user = apply_filters( 'openid-connect-generic-user-creation-test', $this->settings->create_if_does_not_exist, $user_claim );
    9241068
    9251069        if ( ! $create_user ) {
    9261070            return new WP_Error( 'cannot-authorize', __( 'Can not authorize.', 'daggerhart-openid-connect-generic' ), $create_user );
     1071        }
     1072
     1073        // Copy the username for incrementing.
     1074        $_username = $username;
     1075        // Ensure prevention of linking usernames & collisions by incrementing the username if it exists.
     1076        // @example Original user gets "name", second user gets "name2", etc.
     1077        $count = 1;
     1078        while ( username_exists( $username ) ) {
     1079            $count ++;
     1080            $username = $_username . $count;
    9271081        }
    9281082

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client.php

    r2516022 r2698055  
    8484
    8585    /**
     86     * The specifically requested authentication contract at the IDP
     87     *
     88     * @see OpenID_Connect_Generic_Option_Settings::acr_values
     89     *
     90     * @var string
     91     */
     92    private $acr_values;
     93
     94    /**
    8695     * The state time limit. States are only valid for 3 minutes.
    8796     *
    … …  
    109118     * @param string                               $endpoint_token    @see OpenID_Connect_Generic_Option_Settings::endpoint_token for description.
    110119     * @param string                               $redirect_uri      @see OpenID_Connect_Generic_Option_Settings::redirect_uri for description.
     120     * @param string                               $acr_values        @see OpenID_Connect_Generic_Option_Settings::acr_values for description.
    111121     * @param int                                  $state_time_limit  @see OpenID_Connect_Generic_Option_Settings::state_time_limit for description.
    112122     * @param OpenID_Connect_Generic_Option_Logger $logger            The plugin logging object instance.
    113123     */
    114     public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $state_time_limit, $logger ) {
     124    public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $state_time_limit, $logger ) {
    115125        $this->client_id = $client_id;
    116126        $this->client_secret = $client_secret;
    … …  
    120130        $this->endpoint_token = $endpoint_token;
    121131        $this->redirect_uri = $redirect_uri;
     132        $this->acr_values = $acr_values;
    122133        $this->state_time_limit = $state_time_limit;
    123134        $this->logger = $logger;
    … …  
    213224        );
    214225
     226        if ( ! empty( $this->acr_values ) ) {
     227            $request['body'] += array( 'acr_values' => $this->acr_values );
     228        }
     229
    215230        // Allow modifications to the request.
    216231        $request = apply_filters( 'openid-connect-generic-alter-request', $request, 'get-authentication-token' );
    … …  
    465480        }
    466481
     482        // Validate acr values when the option is set in the configuration.
     483        if ( ! empty( $this->acr_values ) && isset( $id_token_claim['acr'] ) ) {
     484            if ( $this->acr_values != $id_token_claim['acr'] ) {
     485                return new WP_Error( 'no-match-acr', __( 'No matching acr values.', 'daggerhart-openid-connect-generic' ), $id_token_claim );
     486            }
     487        }
     488
    467489        return true;
    468490    }

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-option-settings.php

    r2511857 r2698055  
    3434 * @property string $endpoint_token       The IDP token validation endpoint URL.
    3535 * @property string $endpoint_end_session The IDP logout endpoint URL.
     36 * @property string $acr_values           The Authentication contract as defined on the IDP.
    3637 *
    3738 * Non-standard Settings:
    … …  
    8788     */
    8889    private $environment_settings = array(
    89         'client_id'            => 'OIDC_CLIENT_ID',
    90         'client_secret'        => 'OIDC_CLIENT_SECRET',
    91         'endpoint_login'       => 'OIDC_ENDPOINT_LOGIN_URL',
    92         'endpoint_userinfo'    => 'OIDC_ENDPOINT_USERINFO_URL',
    93         'endpoint_token'       => 'OIDC_ENDPOINT_TOKEN_URL',
    94         'endpoint_end_session' => 'OIDC_ENDPOINT_LOGOUT_URL',
     90        'client_id'                 => 'OIDC_CLIENT_ID',
     91        'client_secret'             => 'OIDC_CLIENT_SECRET',
     92        'endpoint_end_session'      => 'OIDC_ENDPOINT_LOGOUT_URL',
     93        'endpoint_login'            => 'OIDC_ENDPOINT_LOGIN_URL',
     94        'endpoint_token'            => 'OIDC_ENDPOINT_TOKEN_URL',
     95        'endpoint_userinfo'         => 'OIDC_ENDPOINT_USERINFO_URL',
     96        'login_type'                => 'OIDC_LOGIN_TYPE',
     97        'scope'                     => 'OIDC_CLIENT_SCOPE',
     98        'create_if_does_not_exist'  => 'OIDC_CREATE_IF_DOES_NOT_EXIST',
     99        'enforce_privacy'           => 'OIDC_ENFORCE_PRIVACY',
     100        'link_existing_users'       => 'OIDC_LINK_EXISTING_USERS',
     101        'redirect_on_logout'        => 'OIDC_REDIRECT_ON_LOGOUT',
     102        'redirect_user_back'        => 'OIDC_REDIRECT_USER_BACK',
     103        'acr_values'                => 'OIDC_ACR_VALUES',
    95104    );
    96105

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-settings-page.php

    r2511857 r2698055  
    217217                    'auto'   => __( 'Auto Login - SSO', 'daggerhart-openid-connect-generic' ),
    218218                ),
     219                'disabled'    => defined( 'OIDC_LOGIN_TYPE' ),
    219220                'section'     => 'client_settings',
    220221            ),
    … …  
    239240                'example'     => 'email profile openid offline_access',
    240241                'type'        => 'text',
     242                'disabled'    => defined( 'OIDC_CLIENT_SCOPE' ),
    241243                'section'     => 'client_settings',
    242244            ),
    … …  
    273275                'section'     => 'client_settings',
    274276            ),
     277            'acr_values'    => array(
     278                'title'       => __( 'ACR values', 'daggerhart-openid-connect-generic' ),
     279                'description' => __( 'Use a specific defined authentication contract from the IDP - optional.', 'daggerhart-openid-connect-generic' ),
     280                'type'        => 'text',
     281                'disabled'    => defined( 'OIDC_ACR_VALUES' ),
     282                'section'     => 'client_settings',
     283            ),
    275284            'identity_key'     => array(
    276285                'title'       => __( 'Identity Key', 'daggerhart-openid-connect-generic' ),
    … …  
    298307                'description' => __( 'Require users be logged in to see the site.', 'daggerhart-openid-connect-generic' ),
    299308                'type'        => 'checkbox',
     309                'disabled'    => defined( 'OIDC_ENFORCE_PRIVACY' ),
    300310                'section'     => 'authorization_settings',
    301311            ),
    … …  
    349359                'description' => __( 'If a WordPress account already exists with the same identity as a newly-authenticated user over OpenID Connect, login as that user instead of generating an error.', 'daggerhart-openid-connect-generic' ),
    350360                'type'        => 'checkbox',
     361                'disabled'    => defined( 'OIDC_LINK_EXISTING_USERS' ),
    351362                'section'     => 'user_settings',
    352363            ),
    353364            'create_if_does_not_exist'   => array(
    354365                'title'       => __( 'Create user if does not exist', 'daggerhart-openid-connect-generic' ),
    355                 'description' => __( 'If the user identity is not link to an existing Wordpress user, it is created. If this setting is not enabled and if the user authenticates with an account which is not link to an existing Wordpress user then the authentication failed', 'daggerhart-openid-connect-generic' ),
    356                 'type'        => 'checkbox',
     366                'description' => __( 'If the user identity is not linked to an existing WordPress user, it is created. If this setting is not enabled, and if the user authenticates with an account which is not linked to an existing WordPress user, then the authentication will fail.', 'daggerhart-openid-connect-generic' ),
     367                'type'        => 'checkbox',
     368                'disabled'    => defined( 'OIDC_CREATE_IF_DOES_NOT_EXIST' ),
    357369                'section'     => 'user_settings',
    358370            ),
    … …  
    361373                'description' => __( 'After a successful OpenID Connect authentication, this will redirect the user back to the page on which they clicked the OpenID Connect login button. This will cause the login process to proceed in a traditional WordPress fashion. For example, users logging in through the default wp-login.php page would end up on the WordPress Dashboard and users logging in through the WooCommerce "My Account" page would end up on their account page.', 'daggerhart-openid-connect-generic' ),
    362374                'type'        => 'checkbox',
     375                'disabled'    => defined( 'OIDC_REDIRECT_USER_BACK' ),
    363376                'section'     => 'user_settings',
    364377            ),
    … …  
    367380                'description' => __( 'When enabled, this will automatically redirect the user back to the WordPress login page if their access token has expired.', 'daggerhart-openid-connect-generic' ),
    368381                'type'        => 'checkbox',
     382                'disabled'    => defined( 'OIDC_REDIRECT_ON_LOGOUT' ),
    369383                'section'     => 'user_settings',
    370384            ),
    … …  
    415429     */
    416430    public function settings_page() {
     431        wp_enqueue_style( 'daggerhart-openid-connect-generic-admin', plugin_dir_url( __DIR__ ) . 'css/styles-admin.css', array(), OpenID_Connect_Generic::VERSION, 'all' );
     432
    417433        $redirect_uri = admin_url( 'admin-ajax.php?action=openid-connect-authorize' );
    418434
    … …  
    473489        ?>
    474490        <input type="<?php print esc_attr( $field['type'] ); ?>"
    475                 <?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) ) ? ' disabled' : ''; ?>
     491                <?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) === true ) ? ' disabled' : ''; ?>
    476492              id="<?php print esc_attr( $field['key'] ); ?>"
    477               class="large-text<?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) ) ? ' disabled' : ''; ?>"
     493              class="large-text<?php echo ( ! empty( $field['disabled'] ) && boolval( $field['disabled'] ) === true ) ? ' disabled' : ''; ?>"
    478494              name="<?php print esc_attr( $field['name'] ); ?>"
    479495              value="<?php print esc_attr( $this->settings->{ $field['key'] } ); ?>">
    … …  
    531547        ?>
    532548        <p class="description">
    533             <?php print esc_html( $field['description'] ); ?>
     549            <?php print wp_kses_post( $field['description'] ); ?>
    534550            <?php if ( isset( $field['example'] ) ) : ?>
    535551                <br/><strong><?php esc_html_e( 'Example', 'daggerhart-openid-connect-generic' ); ?>: </strong>

  • daggerhart-openid-connect-generic/trunk/languages/openid-connect-generic.pot

    r2516022 r2698055  
    1 # Copyright (C) 2021 daggerhart
     1# Copyright (C) 2022 daggerhart
    22# This file is distributed under the GPL-2.0+.
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: OpenID Connect Generic 3.8.5\n"
     5"Project-Id-Version: OpenID Connect Generic 3.9.0\n"
    66"Report-Msgid-Bugs-To: "
    77"https://github.com/daggerhart/openid-connect-generic/issues\n"
    8 "POT-Creation-Date: 2021-04-16 03:38:39+00:00\n"
     8"POT-Creation-Date: 2022-03-22 03:28:37+00:00\n"
    99"MIME-Version: 1.0\n"
    1010"Content-Type: text/plain; charset=utf-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "PO-Revision-Date: 2021-MO-DA HO:MI+ZONE\n"
     12"PO-Revision-Date: 2022-MO-DA HO:MI+ZONE\n"
    1313"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    1414"Language-Team: LANGUAGE <LL@li.org>\n"
    … …  
    2626"X-Generator: grunt-wp-i18n 1.0.3\n"
    2727
    28 #: includes/openid-connect-generic-client-wrapper.php:277
     28#: includes/openid-connect-generic-client-wrapper.php:288
    2929msgid "Session expired. Please login again."
    3030msgstr ""
    3131
    32 #: includes/openid-connect-generic-client-wrapper.php:520
     32#: includes/openid-connect-generic-client-wrapper.php:535
    3333msgid "User identity is not linked to an existing WordPress user."
    3434msgstr ""
    3535
    36 #: includes/openid-connect-generic-client-wrapper.php:576
     36#: includes/openid-connect-generic-client-wrapper.php:589
    3737msgid "Invalid user."
    3838msgstr ""
    3939
    40 #: includes/openid-connect-generic-client-wrapper.php:695
     40#: includes/openid-connect-generic-client-wrapper.php:775
    4141msgid "No appropriate username found."
    4242msgstr ""
    4343
    44 #: includes/openid-connect-generic-client-wrapper.php:703
    45 #. translators: $1$s is a username from the IDP.
    46 msgid "Username %1$s could not be transliterated."
    47 msgstr ""
    48 
    49 #: includes/openid-connect-generic-client-wrapper.php:708
    50 #. translators: %1$s is the ASCII version of the username from the IDP.
    51 msgid "Username %1$s could not be normalized."
    52 msgstr ""
    53 
    54 #: includes/openid-connect-generic-client-wrapper.php:742
     44#: includes/openid-connect-generic-client-wrapper.php:785
     45#. translators: %1$s is the santitized version of the username from the IDP.
     46msgid "Username %1$s could not be sanitized."
     47msgstr ""
     48
     49#: includes/openid-connect-generic-client-wrapper.php:807
    5550#. translators: %1$s is the configured User Claim nickname key.
    5651msgid "No nickname found in user claim using key: %1$s."
    5752msgstr ""
    5853
    59 #: includes/openid-connect-generic-client-wrapper.php:769
     54#: includes/openid-connect-generic-client-wrapper.php:904
    6055msgid "User claim incomplete."
    6156msgstr ""
    6257
    63 #: includes/openid-connect-generic-client-wrapper.php:871
     58#: includes/openid-connect-generic-client-wrapper.php:1006
    6459msgid "Bad user claim result."
    6560msgstr ""
    6661
    67 #: includes/openid-connect-generic-client-wrapper.php:926
     62#: includes/openid-connect-generic-client-wrapper.php:1070
    6863msgid "Can not authorize."
    6964msgstr ""
    7065
    71 #: includes/openid-connect-generic-client-wrapper.php:945
     66#: includes/openid-connect-generic-client-wrapper.php:1099
    7267msgid "Failed user creation."
    7368msgstr ""
    7469
    75 #: includes/openid-connect-generic-client.php:165
     70#: includes/openid-connect-generic-client.php:176
    7671msgid "Missing state."
    7772msgstr ""
    7873
    79 #: includes/openid-connect-generic-client.php:169
     74#: includes/openid-connect-generic-client.php:180
    8075msgid "Invalid state."
    8176msgstr ""
    8277
    83 #: includes/openid-connect-generic-client.php:184
     78#: includes/openid-connect-generic-client.php:195
    8479msgid "Missing authentication code."
    8580msgstr ""
    8681
    87 #: includes/openid-connect-generic-client.php:223
     82#: includes/openid-connect-generic-client.php:238
    8883msgid "Request for authentication token failed."
    8984msgstr ""
    9085
    91 #: includes/openid-connect-generic-client.php:254
     86#: includes/openid-connect-generic-client.php:269
    9287msgid "Refresh token failed."
    9388msgstr ""
    9489
    95 #: includes/openid-connect-generic-client.php:269
     90#: includes/openid-connect-generic-client.php:284
    9691msgid "Missing token body."
    9792msgstr ""
    9893
    99 #: includes/openid-connect-generic-client.php:277
     94#: includes/openid-connect-generic-client.php:292
    10095msgid "Invalid token."
    10196msgstr ""
    10297
    103 #: includes/openid-connect-generic-client.php:328
     98#: includes/openid-connect-generic-client.php:343
    10499msgid "Request for userinfo failed."
    105100msgstr ""
    106101
    107 #: includes/openid-connect-generic-client.php:388
     102#: includes/openid-connect-generic-client.php:403
    108103msgid "Missing authentication state."
    109104msgstr ""
    110105
    111 #: includes/openid-connect-generic-client.php:425
     106#: includes/openid-connect-generic-client.php:440
    112107msgid "No identity token."
    113108msgstr ""
    114109
    115 #: includes/openid-connect-generic-client.php:432
     110#: includes/openid-connect-generic-client.php:447
    116111msgid "Missing identity token."
    117112msgstr ""
    118113
    119 #: includes/openid-connect-generic-client.php:459
     114#: includes/openid-connect-generic-client.php:474
    120115msgid "Bad ID token claim."
    121116msgstr ""
    122117
    123 #: includes/openid-connect-generic-client.php:464
     118#: includes/openid-connect-generic-client.php:479
    124119msgid "No subject identity."
    125120msgstr ""
    126121
    127 #: includes/openid-connect-generic-client.php:483
     122#: includes/openid-connect-generic-client.php:485
     123msgid "No matching acr values."
     124msgstr ""
     125
     126#: includes/openid-connect-generic-client.php:505
    128127msgid "Bad user claim."
    129128msgstr ""
    130129
    131 #: includes/openid-connect-generic-client.php:503
     130#: includes/openid-connect-generic-client.php:525
    132131msgid "Invalid user claim."
    133132msgstr ""
    134133
    135 #: includes/openid-connect-generic-client.php:508
     134#: includes/openid-connect-generic-client.php:530
    136135msgid "Error from the IDP."
    137136msgstr ""
    138137
    139 #: includes/openid-connect-generic-client.php:517
     138#: includes/openid-connect-generic-client.php:539
    140139msgid "Incorrect user claim."
    141140msgstr ""
    142141
    143 #: includes/openid-connect-generic-client.php:524
     142#: includes/openid-connect-generic-client.php:546
    144143msgid "Unauthorized access."
    145144msgstr ""
    … …  
    210209msgstr ""
    211210
    212 #: includes/openid-connect-generic-settings-page.php:222
     211#: includes/openid-connect-generic-settings-page.php:223
    213212msgid "Client ID"
    214213msgstr ""
    215214
    216 #: includes/openid-connect-generic-settings-page.php:223
     215#: includes/openid-connect-generic-settings-page.php:224
    217216msgid ""
    218217"The ID this client will be recognized as when connecting the to Identity "
    … …  
    220219msgstr ""
    221220
    222 #: includes/openid-connect-generic-settings-page.php:230
     221#: includes/openid-connect-generic-settings-page.php:231
    223222msgid "Client Secret Key"
    224223msgstr ""
    225224
    226 #: includes/openid-connect-generic-settings-page.php:231
     225#: includes/openid-connect-generic-settings-page.php:232
    227226msgid ""
    228227"Arbitrary secret key the server expects from this client. Can be anything, "
    … …  
    230229msgstr ""
    231230
    232 #: includes/openid-connect-generic-settings-page.php:237
     231#: includes/openid-connect-generic-settings-page.php:238
    233232msgid "OpenID Scope"
    234233msgstr ""
    235234
    236 #: includes/openid-connect-generic-settings-page.php:238
     235#: includes/openid-connect-generic-settings-page.php:239
    237236msgid "Space separated list of scopes this client should access."
    238237msgstr ""
    239238
    240 #: includes/openid-connect-generic-settings-page.php:244
     239#: includes/openid-connect-generic-settings-page.php:246
    241240msgid "Login Endpoint URL"
    242241msgstr ""
    243242
    244 #: includes/openid-connect-generic-settings-page.php:245
     243#: includes/openid-connect-generic-settings-page.php:247
    245244msgid "Identify provider authorization endpoint."
    246245msgstr ""
    247246
    248 #: includes/openid-connect-generic-settings-page.php:252
     247#: includes/openid-connect-generic-settings-page.php:254
    249248msgid "Userinfo Endpoint URL"
    250249msgstr ""
    251250
    252 #: includes/openid-connect-generic-settings-page.php:253
     251#: includes/openid-connect-generic-settings-page.php:255
    253252msgid "Identify provider User information endpoint."
    254253msgstr ""
    255254
    256 #: includes/openid-connect-generic-settings-page.php:260
     255#: includes/openid-connect-generic-settings-page.php:262
    257256msgid "Token Validation Endpoint URL"
    258257msgstr ""
    259258
    260 #: includes/openid-connect-generic-settings-page.php:261
     259#: includes/openid-connect-generic-settings-page.php:263
    261260msgid "Identify provider token endpoint."
    262261msgstr ""
    263262
    264 #: includes/openid-connect-generic-settings-page.php:268
     263#: includes/openid-connect-generic-settings-page.php:270
    265264msgid "End Session Endpoint URL"
    266265msgstr ""
    267266
    268 #: includes/openid-connect-generic-settings-page.php:269
     267#: includes/openid-connect-generic-settings-page.php:271
    269268msgid "Identify provider logout endpoint."
    270269msgstr ""
    271270
    272 #: includes/openid-connect-generic-settings-page.php:276
     271#: includes/openid-connect-generic-settings-page.php:278
     272msgid "ACR values"
     273msgstr ""
     274
     275#: includes/openid-connect-generic-settings-page.php:279
     276msgid "Use a specific defined authentication contract from the IDP - optional."
     277msgstr ""
     278
     279#: includes/openid-connect-generic-settings-page.php:285
    273280msgid "Identity Key"
    274281msgstr ""
    275282
    276 #: includes/openid-connect-generic-settings-page.php:277
     283#: includes/openid-connect-generic-settings-page.php:286
    277284msgid ""
    278285"Where in the user claim array to find the user's identification data. "
    … …  
    281288msgstr ""
    282289
    283 #: includes/openid-connect-generic-settings-page.php:283
     290#: includes/openid-connect-generic-settings-page.php:292
    284291msgid "Disable SSL Verify"
    285292msgstr ""
    286293
    287 #: includes/openid-connect-generic-settings-page.php:285
     294#: includes/openid-connect-generic-settings-page.php:294
    288295#. translators: %1$s HTML tags for layout/styles, %2$s closing HTML tag for
    289296#. styles.
    … …  
    296303msgstr ""
    297304
    298 #: includes/openid-connect-generic-settings-page.php:290
     305#: includes/openid-connect-generic-settings-page.php:299
    299306msgid "HTTP Request Timeout"
    300307msgstr ""
    301308
    302 #: includes/openid-connect-generic-settings-page.php:291
     309#: includes/openid-connect-generic-settings-page.php:300
    303310msgid "Set the timeout for requests made to the IDP. Default value is 5."
    304311msgstr ""
    305312
    306 #: includes/openid-connect-generic-settings-page.php:297
     313#: includes/openid-connect-generic-settings-page.php:306
    307314msgid "Enforce Privacy"
    308315msgstr ""
    309316
    310 #: includes/openid-connect-generic-settings-page.php:298
     317#: includes/openid-connect-generic-settings-page.php:307
    311318msgid "Require users be logged in to see the site."
    312319msgstr ""
    313320
    314 #: includes/openid-connect-generic-settings-page.php:303
     321#: includes/openid-connect-generic-settings-page.php:313
    315322msgid "Alternate Redirect URI"
    316323msgstr ""
    317324
    318 #: includes/openid-connect-generic-settings-page.php:304
     325#: includes/openid-connect-generic-settings-page.php:314
    319326msgid ""
    320327"Provide an alternative redirect route. Useful if your server is causing "
    … …  
    324331msgstr ""
    325332
    326 #: includes/openid-connect-generic-settings-page.php:309
     333#: includes/openid-connect-generic-settings-page.php:319
    327334msgid "Nickname Key"
    328335msgstr ""
    329336
    330 #: includes/openid-connect-generic-settings-page.php:310
     337#: includes/openid-connect-generic-settings-page.php:320
    331338msgid ""
    332339"Where in the user claim array to find the user's nickname. Possible "
    … …  
    334341msgstr ""
    335342
    336 #: includes/openid-connect-generic-settings-page.php:316
     343#: includes/openid-connect-generic-settings-page.php:326
    337344msgid "Email Formatting"
    338345msgstr ""
    339346
    340 #: includes/openid-connect-generic-settings-page.php:317
     347#: includes/openid-connect-generic-settings-page.php:327
    341348msgid ""
    342349"String from which the user's email address is built. Specify \"{email}\" as "
    … …  
    344351msgstr ""
    345352
    346 #: includes/openid-connect-generic-settings-page.php:323
     353#: includes/openid-connect-generic-settings-page.php:333
    347354msgid "Display Name Formatting"
    348355msgstr ""
    349356
    350 #: includes/openid-connect-generic-settings-page.php:324
     357#: includes/openid-connect-generic-settings-page.php:334
    351358msgid "String from which the user's display name is built."
    352359msgstr ""
    353360
    354 #: includes/openid-connect-generic-settings-page.php:330
     361#: includes/openid-connect-generic-settings-page.php:340
    355362msgid "Identify with User Name"
    356363msgstr ""
    357364
    358 #: includes/openid-connect-generic-settings-page.php:331
     365#: includes/openid-connect-generic-settings-page.php:341
    359366msgid ""
    360367"If checked, the user's identity will be determined by the user name instead "
    … …  
    362369msgstr ""
    363370
    364 #: includes/openid-connect-generic-settings-page.php:336
     371#: includes/openid-connect-generic-settings-page.php:346
    365372msgid "State time limit"
    366373msgstr ""
    367374
    368 #: includes/openid-connect-generic-settings-page.php:337
     375#: includes/openid-connect-generic-settings-page.php:347
    369376msgid "State valid time in seconds. Defaults to 180"
    370377msgstr ""
    371378
    372 #: includes/openid-connect-generic-settings-page.php:342
     379#: includes/openid-connect-generic-settings-page.php:352
    373380msgid "Enable Refresh Token"
    374381msgstr ""
    375382
    376 #: includes/openid-connect-generic-settings-page.php:343
     383#: includes/openid-connect-generic-settings-page.php:353
    377384msgid ""
    378385"If checked, support refresh tokens used to obtain access tokens from "
    … …  
    380387msgstr ""
    381388
    382 #: includes/openid-connect-generic-settings-page.php:348
     389#: includes/openid-connect-generic-settings-page.php:358
    383390msgid "Link Existing Users"
    384391msgstr ""
    385392
    386 #: includes/openid-connect-generic-settings-page.php:349
     393#: includes/openid-connect-generic-settings-page.php:359
    387394msgid ""
    388395"If a WordPress account already exists with the same identity as a "
    … …  
    391398msgstr ""
    392399
    393 #: includes/openid-connect-generic-settings-page.php:354
     400#: includes/openid-connect-generic-settings-page.php:365
    394401msgid "Create user if does not exist"
    395402msgstr ""
    396403
    397 #: includes/openid-connect-generic-settings-page.php:355
    398 msgid ""
    399 "If the user identity is not link to an existing Wordpress user, it is "
    400 "created. If this setting is not enabled and if the user authenticates with "
    401 "an account which is not link to an existing Wordpress user then the "
    402 "authentication failed"
    403 msgstr ""
    404 
    405 #: includes/openid-connect-generic-settings-page.php:360
     404#: includes/openid-connect-generic-settings-page.php:366
     405msgid ""
     406"If the user identity is not linked to an existing WordPress user, it is "
     407"created. If this setting is not enabled, and if the user authenticates with "
     408"an account which is not linked to an existing WordPress user, then the "
     409"authentication will fail."
     410msgstr ""
     411
     412#: includes/openid-connect-generic-settings-page.php:372
    406413msgid "Redirect Back to Origin Page"
    407414msgstr ""
    408415
    409 #: includes/openid-connect-generic-settings-page.php:361
     416#: includes/openid-connect-generic-settings-page.php:373
    410417msgid ""
    411418"After a successful OpenID Connect authentication, this will redirect the "
    … …  
    418425msgstr ""
    419426
    420 #: includes/openid-connect-generic-settings-page.php:366
     427#: includes/openid-connect-generic-settings-page.php:379
    421428msgid "Redirect to the login screen when session is expired"
    422429msgstr ""
    423430
    424 #: includes/openid-connect-generic-settings-page.php:367
     431#: includes/openid-connect-generic-settings-page.php:380
    425432msgid ""
    426433"When enabled, this will automatically redirect the user back to the "
    … …  
    428435msgstr ""
    429436
    430 #: includes/openid-connect-generic-settings-page.php:372
     437#: includes/openid-connect-generic-settings-page.php:386
    431438msgid "Enable Logging"
    432439msgstr ""
    433440
    434 #: includes/openid-connect-generic-settings-page.php:373
     441#: includes/openid-connect-generic-settings-page.php:387
    435442msgid "Very simple log messages for debugging purposes."
    436443msgstr ""
    437444
    438 #: includes/openid-connect-generic-settings-page.php:378
     445#: includes/openid-connect-generic-settings-page.php:392
    439446msgid "Log Limit"
    440447msgstr ""
    441448
    442 #: includes/openid-connect-generic-settings-page.php:379
     449#: includes/openid-connect-generic-settings-page.php:393
    443450msgid ""
    444451"Number of items to keep in the log. These logs are stored as an option in "
    … …  
    446453msgstr ""
    447454
    448 #: includes/openid-connect-generic-settings-page.php:439
     455#: includes/openid-connect-generic-settings-page.php:455
    449456msgid "Notes"
    450457msgstr ""
    451458
    452 #: includes/openid-connect-generic-settings-page.php:442
     459#: includes/openid-connect-generic-settings-page.php:458
    453460msgid "Redirect URI"
    454461msgstr ""
    455462
    456 #: includes/openid-connect-generic-settings-page.php:446
     463#: includes/openid-connect-generic-settings-page.php:462
    457464msgid "Login Button Shortcode"
    458465msgstr ""
    459466
    460 #: includes/openid-connect-generic-settings-page.php:450
     467#: includes/openid-connect-generic-settings-page.php:466
    461468msgid "Authentication URL Shortcode"
    462469msgstr ""
    463470
    464 #: includes/openid-connect-generic-settings-page.php:455
     471#: includes/openid-connect-generic-settings-page.php:471
    465472msgid "Logs"
    466473msgstr ""
    467474
    468 #: includes/openid-connect-generic-settings-page.php:535
     475#: includes/openid-connect-generic-settings-page.php:551
    469476msgid "Example"
    470477msgstr ""
    471478
    472 #: includes/openid-connect-generic-settings-page.php:548
     479#: includes/openid-connect-generic-settings-page.php:564
    473480msgid "Enter your OpenID Connect identity provider settings."
    474481msgstr ""
    475482
    476 #: includes/openid-connect-generic-settings-page.php:557
     483#: includes/openid-connect-generic-settings-page.php:573
    477484msgid "Modify the interaction between OpenID Connect and WordPress users."
    478485msgstr ""
    479486
    480 #: includes/openid-connect-generic-settings-page.php:566
     487#: includes/openid-connect-generic-settings-page.php:582
    481488msgid "Control the authorization mechanics of the site."
    482489msgstr ""
    483490
    484 #: includes/openid-connect-generic-settings-page.php:575
     491#: includes/openid-connect-generic-settings-page.php:591
    485492msgid "Log information about login attempts through OpenID Connect Generic."
    486493msgstr ""
    487494
    488 #: openid-connect-generic.php:202
     495#: openid-connect-generic.php:213
    489496msgid "Private site"
    490497msgstr ""

  • daggerhart-openid-connect-generic/trunk/openid-connect-generic.php

    r2516022 r2698055  
    1717 * Plugin URI:        https://github.com/daggerhart/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect generic client using Authorization Code Flow.
    19  * Version:           3.8.5
     19 * Version:           3.9.0
     20 * Requires at least: 4.9
     21 * Requires PHP:      7.2
    2022 * Author:            daggerhart
    2123 * Author URI:        http://www.daggerhart.com
    … …  
    4547
    4648  Actions
    47   - openid-connect-generic-user-create        - 2 args: fires when a new user is created by this plugin
    48   - openid-connect-generic-user-update        - 1 arg: user ID, fires when user is updated by this plugin
    49   - openid-connect-generic-update-user-using-current-claim - 2 args: fires every time an existing user logs
    50   - openid-connect-generic-redirect-user-back - 2 args: $redirect_url, $user. Allows interruption of redirect during login.
    51   - openid-connect-generic-user-logged-in     - 1 arg: $user, fires when user is logged in.
    52   - openid-connect-generic-cron-daily         - daily cron action
    53   - openid-connect-generic-state-not-found    - the given state does not exist in the database, regardless of its expiration.
    54   - openid-connect-generic-state-expired      - the given state exists, but expired before this login attempt.
     49  - openid-connect-generic-user-create                     - 2 args: fires when a new user is created by this plugin
     50  - openid-connect-generic-user-update                     - 1 arg: user ID, fires when user is updated by this plugin
     51  - openid-connect-generic-update-user-using-current-claim - 2 args: fires every time an existing user logs in and the claims are updated.
     52  - openid-connect-generic-redirect-user-back              - 2 args: $redirect_url, $user. Allows interruption of redirect during login.
     53  - openid-connect-generic-user-logged-in                  - 1 arg: $user, fires when user is logged in.
     54  - openid-connect-generic-cron-daily                      - daily cron action
     55  - openid-connect-generic-state-not-found                 - the given state does not exist in the database, regardless of its expiration.
     56  - openid-connect-generic-state-expired                   - the given state exists, but expired before this login attempt.
     57
     58  Callable actions
    5559
    5660  User Meta
    … …  
    7781
    7882    /**
     83     * Singleton instance of self
     84     *
     85     * @var OpenID_Connect_Generic
     86     */
     87    protected static $_instance = null;
     88
     89    /**
    7990     * Plugin version.
    8091     *
    81      * @var
    82      */
    83     const VERSION = '3.8.5';
     92     * @var string
     93     */
     94    const VERSION = '3.9.0';
    8495
    8596    /**
    … …  
    109120     * @var OpenID_Connect_Generic_Client_Wrapper
    110121     */
    111     private $client_wrapper;
     122    public $client_wrapper;
    112123
    113124    /**
    … …  
    122133        $this->settings = $settings;
    123134        $this->logger = $logger;
     135        self::$_instance = $this;
    124136    }
    125137
    … …  
    130142     */
    131143    public function init() {
    132 
    133         wp_enqueue_style( 'daggerhart-openid-connect-generic-admin', plugin_dir_url( __FILE__ ) . 'css/styles-admin.css', array(), self::VERSION, 'all' );
    134144
    135145        $redirect_uri = admin_url( 'admin-ajax.php?action=openid-connect-authorize' );
    … …  
    152162            $this->settings->endpoint_token,
    153163            $redirect_uri,
     164            $this->settings->acr_values,
    154165            $state_time_limit,
    155166            $this->logger
    … …  
    328339            array(
    329340                // OAuth client settings.
    330                 'login_type'           => 'button',
     341                'login_type'           => defined( 'OIDC_LOGIN_TYPE' ) ? OIDC_LOGIN_TYPE : 'button',
    331342                'client_id'            => defined( 'OIDC_CLIENT_ID' ) ? OIDC_CLIENT_ID : '',
    332343                'client_secret'        => defined( 'OIDC_CLIENT_SECRET' ) ? OIDC_CLIENT_SECRET : '',
    333                 'scope'                => '',
     344                'scope'                => defined( 'OIDC_CLIENT_SCOPE' ) ? OIDC_CLIENT_SCOPE : '',
    334345                'endpoint_login'       => defined( 'OIDC_ENDPOINT_LOGIN_URL' ) ? OIDC_ENDPOINT_LOGIN_URL : '',
    335346                'endpoint_userinfo'    => defined( 'OIDC_ENDPOINT_USERINFO_URL' ) ? OIDC_ENDPOINT_USERINFO_URL : '',
    336347                'endpoint_token'       => defined( 'OIDC_ENDPOINT_TOKEN_URL' ) ? OIDC_ENDPOINT_TOKEN_URL : '',
    337348                'endpoint_end_session' => defined( 'OIDC_ENDPOINT_LOGOUT_URL' ) ? OIDC_ENDPOINT_LOGOUT_URL : '',
     349                'acr_values'           => defined( 'OIDC_ACR_VALUES' ) ? OIDC_ACR_VALUES : '',
    338350
    339351                // Non-standard settings.
    … …  
    347359
    348360                // Plugin settings.
    349                 'enforce_privacy' => 0,
     361                'enforce_privacy' => defined( 'OIDC_ENFORCE_PRIVACY' ) ? intval( OIDC_ENFORCE_PRIVACY ) : 0,
    350362                'alternate_redirect_uri' => 0,
    351363                'token_refresh_enable' => 1,
    352                 'link_existing_users' => 0,
    353                 'create_if_does_not_exist' => 1,
    354                 'redirect_user_back' => 0,
    355                 'redirect_on_logout' => 1,
     364                'link_existing_users' => defined( 'OIDC_LINK_EXISTING_USERS' ) ? intval( OIDC_LINK_EXISTING_USERS ) : 0,
     365                'create_if_does_not_exist' => defined( 'OIDC_CREATE_IF_DOES_NOT_EXIST' ) ? intval( OIDC_CREATE_IF_DOES_NOT_EXIST ) : 1,
     366                'redirect_user_back' => defined( 'OIDC_REDIRECT_USER_BACK' ) ? intval( OIDC_REDIRECT_USER_BACK ) : 0,
     367                'redirect_on_logout' => defined( 'OIDC_REDIRECT_ON_LOGOUT' ) ? intval( OIDC_REDIRECT_ON_LOGOUT ) : 1,
    356368                'enable_logging'  => 0,
    357369                'log_limit'       => 1000,
    … …  
    371383        add_filter( 'comment_text_rss', array( $plugin, 'enforce_privacy_feeds' ), 999 );
    372384    }
     385
     386    /**
     387     * Create (if needed) and return a singleton of self.
     388     *
     389     * @return OpenID_Connect_Generic
     390     */
     391    public static function instance() {
     392        if ( null === self::$_instance ) {
     393            self::bootstrap();
     394        }
     395        return self::$_instance;
     396    }
    373397}
    374398
    375 OpenID_Connect_Generic::bootstrap();
     399OpenID_Connect_Generic::instance();
    376400
    377401register_activation_hook( __FILE__, array( 'OpenID_Connect_Generic', 'activation' ) );
    378402register_deactivation_hook( __FILE__, array( 'OpenID_Connect_Generic', 'deactivation' ) );
     403
     404// Provide publicly accessible plugin helper functions.
     405require_once( 'includes/functions.php' );

  • daggerhart-openid-connect-generic/trunk/readme.txt

    r2516022 r2698055  
    44Tags: security, login, oauth2, openidconnect, apps, authentication, autologin, sso
    55Requires at least: 4.9
    6 Tested up to: 5.7.1
    7 Stable tag: 3.8.5
    8 Requires PHP: 7.1
     6Tested up to: 5.9.2
     7Stable tag: 3.9.0
     8Requires PHP: 7.2
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    5252== Changelog ==
    5353
    54 = 3.8.5
    55 
    56 * Fix: @timnolte - Fixes missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
    57 * Fix: @timnolte - Fixes Redirect URL Logic to Handle Sub-directory Installs.
    58 * Fix: @timnolte - Fixes to provide proper redirect user back for the openid_connect_generic_auth_url shortcode.
     54= 3.9.0 =
     55
     56* Feature: @matchaxnb - Added support for additional configuration constants.
     57* Feature: @schanzen - Added support for agregated claims.
     58* Fix: @rkcreation - Fixed access token not updating user metadata after login.
     59* Fix: @danc1248 - Fixed user creation issue on Multisite Networks.
     60* Feature: @RobjS - Added plugin singleton to support for more developer customization.
     61* Feature: @jkouris - Added action hook to allow custom handling of session expiration.
     62* Fix: @tommcc - Fixed admin CSS loading only on the plugin settings screen.
     63* Feature: @rkcreation - Added method to refresh the user claim.
     64* Feature: @Glowsome - Added acr_values support & verification checks that it when defined in options is honored.
     65* Fix: @timnolte - Fixed regression which caused improper fallback on missing claims.
     66* Fix: @slykar - Fixed missing query string handling in redirect URL.
     67* Fix: @timnolte - Fixed issue with some user linking and user creation handling.
     68* Improvement: @timnolte - Fixed plugin settings typos and screen formatting.
     69* Security: @timnolte - Updated build tooling security vulnerabilities.
     70* Improvement: @timnolte - Changed build tooling scripts.
     71
     72= 3.8.5 =
     73
     74* Fix: @timnolte - Fixed missing URL request validation before use & ensure proper current page URL is setup for Redirect Back.
     75* Fix: @timnolte - Fixed Redirect URL Logic to Handle Sub-directory Installs.
     76* Fix: @timnolte - Fixed issue with redirecting user back when the openid_connect_generic_auth_url shortcode is used.
    5977
    6078= 3.8.4 =
Note: See TracChangeset for help on using the changeset viewer.