WordPress.org
Get WordPress

Plugin Directory

Changeset 3460486


Ignore:
Timestamp:
02/13/2026 04:36:09 AM (6 weeks ago)
Author:
daggerhart
Message:

Update to version 3.11.3 from GitHub

Location:
daggerhart-openid-connect-generic
Files:
18 edited
1 copied

Legend:

Unmodified
Added
Removed

  • daggerhart-openid-connect-generic/tags/3.11.3/includes/openid-connect-generic-client-wrapper.php

    r3459957 r3460486  
    915915        // Check if JWKS endpoint is configured for JWT signature verification.
    916916        if ( ! empty( $this->settings->endpoint_jwks ) ) {
     917            // Use configured issuer if provided, otherwise derive from endpoint_login.
     918            $issuer = ! empty( $this->settings->issuer ) ?
     919                $this->settings->issuer :
     920                ( ! empty( $this->settings->endpoint_login ) ? $this->client->get_issuer_from_endpoint( $this->settings->endpoint_login ) : '' );
     921
    917922            // Use JWT validator for secure signature verification.
    918923            $jwt_validator = new OpenID_Connect_Generic_JWT_Validator(
    919924                $this->settings->endpoint_jwks,
    920925                $this->settings->client_id,
    921                 $this->client->get_issuer_from_endpoint( $this->settings->endpoint_login ),
     926                $issuer,
    922927                $this->settings->jwks_cache_ttl,
    923928                $this->settings->allow_internal_idp,

  • daggerhart-openid-connect-generic/tags/3.11.3/includes/openid-connect-generic-client.php

    r3459991 r3460486  
    102102
    103103    /**
     104     * The issuer URL for JWT validation.
     105     *
     106     * @see OpenID_Connect_Generic_Option_Settings::issuer
     107     *
     108     * @var string
     109     */
     110    private $issuer;
     111
     112    /**
    104113     * The JWKS cache TTL in seconds.
    105114     *
    … …  
    147156     * @param string                               $acr_values         @see OpenID_Connect_Generic_Option_Settings::acr_values for description.
    148157     * @param string                               $endpoint_jwks      @see OpenID_Connect_Generic_Option_Settings::endpoint_jwks for description.
     158     * @param string                               $issuer             @see OpenID_Connect_Generic_Option_Settings::issuer for description.
    149159     * @param int                                  $jwks_cache_ttl     @see OpenID_Connect_Generic_Option_Settings::jwks_cache_ttl for description.
    150160     * @param int                                  $state_time_limit   @see OpenID_Connect_Generic_Option_Settings::state_time_limit for description.
    … …  
    152162     * @param OpenID_Connect_Generic_Option_Logger $logger             The plugin logging object instance.
    153163     */
    154     public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $endpoint_jwks, $jwks_cache_ttl, $state_time_limit, $allow_internal_idp, $logger ) {
     164    public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $endpoint_jwks, $issuer, $jwks_cache_ttl, $state_time_limit, $allow_internal_idp, $logger ) {
    155165        $this->client_id = $client_id;
    156166        $this->client_secret = $client_secret;
    … …  
    162172        $this->acr_values = $acr_values;
    163173        $this->endpoint_jwks = $endpoint_jwks;
     174        $this->issuer = $issuer;
    164175        $this->jwks_cache_ttl = $jwks_cache_ttl;
    165176        $this->state_time_limit = $state_time_limit;
    … …  
    544555        // Check if JWKS endpoint is configured for JWT signature verification.
    545556        if ( ! empty( $this->endpoint_jwks ) ) {
     557            // Use configured issuer if provided, otherwise derive from endpoint_login.
     558            $issuer = ! empty( $this->issuer )
     559                ? $this->issuer
     560                : $this->get_issuer_from_endpoint( $this->endpoint_login );
     561
    546562            // Use JWT validator for secure signature verification.
    547563            $jwt_validator = new OpenID_Connect_Generic_JWT_Validator(
    548564                $this->endpoint_jwks,
    549565                $this->client_id,
    550                 $this->get_issuer_from_endpoint( $this->endpoint_login ),
     566                $issuer,
    551567                $this->jwks_cache_ttl,
    552568                $this->allow_internal_idp,
    … …  
    672688        }
    673689
    674         // Validate issuer claim if endpoint_login is configured.
    675         if ( ! empty( $this->endpoint_login ) ) {
     690        // Validate issuer claim if configured or endpoint_login is available.
     691        $expected_issuer = ! empty( $this->issuer ) ?
     692            $this->issuer :
     693            ( ! empty( $this->endpoint_login ) ? $this->get_issuer_from_endpoint( $this->endpoint_login ) : '' );
     694
     695        if ( ! empty( $expected_issuer ) ) {
    676696            if ( ! isset( $id_token_claim['iss'] ) ) {
    677697                return new WP_Error( 'missing-iss', __( 'Token missing issuer claim.', 'daggerhart-openid-connect-generic' ), $id_token_claim );
    678698            }
    679699
    680             // Extract expected issuer from endpoint_login (base URL).
    681             $expected_issuer = $this->get_issuer_from_endpoint( $this->endpoint_login );
    682 
    683700            if ( rtrim( $id_token_claim['iss'], '/' ) !== rtrim( $expected_issuer, '/' ) ) {
     701                $this->logger->log(
     702                    sprintf(
     703                        'Issuer mismatch - Expected: "%s", Received: "%s". Configure the correct issuer in Settings > OpenID Connect Client > Issuer field, or via the OIDC_ISSUER constant.',
     704                        $expected_issuer,
     705                        $id_token_claim['iss']
     706                    ),
     707                    'issuer-mismatch'
     708                );
    684709                return new WP_Error(
    685710                    'invalid-iss',

  • daggerhart-openid-connect-generic/tags/3.11.3/includes/openid-connect-generic-jwt-validator.php

    r3460363 r3460486  
    229229
    230230            if ( rtrim( $decoded_jwt->iss, '/' ) !== rtrim( $this->issuer, '/' ) ) {
     231                $this->logger->log(
     232                    sprintf(
     233                        'Issuer mismatch - Expected: "%s", Received: "%s". Configure the correct issuer in Settings > OpenID Connect Client > Issuer field, or via the OIDC_ISSUER constant.',
     234                        $this->issuer,
     235                        $decoded_jwt->iss
     236                    ),
     237                    'issuer-mismatch'
     238                );
    231239                return new WP_Error(
    232240                    'invalid-iss',

  • daggerhart-openid-connect-generic/tags/3.11.3/includes/openid-connect-generic-option-settings.php

    r3459957 r3460486  
    3636 * @property string $endpoint_end_session The IDP logout endpoint URL.
    3737 * @property string $endpoint_jwks        The IDP JWKS endpoint URL for JWT signature verification.
     38 * @property string $issuer               The IDP issuer URL for JWT validation (optional - derived from endpoint_login if not set).
    3839 * @property int    $jwks_cache_ttl       The JWKS cache TTL in seconds.
    3940 * @property string $acr_values           The Authentication contract as defined on the IDP.
    … …  
    99100        'endpoint_userinfo'         => 'OIDC_ENDPOINT_USERINFO_URL',
    100101        'endpoint_jwks'             => 'OIDC_ENDPOINT_JWKS_URL',
     102        'issuer'                    => 'OIDC_ISSUER',
    101103        'login_type'                => 'OIDC_LOGIN_TYPE',
    102104        'scope'                     => 'OIDC_CLIENT_SCOPE',

  • daggerhart-openid-connect-generic/tags/3.11.3/includes/openid-connect-generic-settings-page.php

    r3459957 r3460486  
    309309                'section'     => 'client_settings',
    310310            ),
     311            'issuer' => array(
     312                'title'       => __( 'Issuer', 'daggerhart-openid-connect-generic' ),
     313                'description' => __( 'Identity provider issuer URL for JWT validation. If not set, the issuer will be automatically derived from the Login Endpoint URL. Only configure this if your IDP uses a different issuer than the base URL of the login endpoint.', 'daggerhart-openid-connect-generic' ),
     314                'example'     => 'https://example.com',
     315                'type'        => 'text',
     316                'disabled'    => defined( 'OIDC_ISSUER' ),
     317                'section'     => 'client_settings',
     318            ),
    311319            'jwks_cache_ttl' => array(
    312320                'title'       => __( 'JWKS Cache TTL (seconds)', 'daggerhart-openid-connect-generic' ),
    … …  
    777785            'userinfo_endpoint'      => 'endpoint_userinfo',
    778786            'jwks_uri'               => 'endpoint_jwks',
     787            'issuer'                 => 'issuer',
    779788            'end_session_endpoint'   => 'endpoint_end_session',
    780789        );

  • daggerhart-openid-connect-generic/tags/3.11.3/languages/openid-connect-generic.pot

    r3460363 r3460486  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: OpenID Connect Generic 3.11.2\n"
     5"Project-Id-Version: OpenID Connect Generic 3.11.3\n"
    66"Report-Msgid-Bugs-To: "
    77"https://github.com/oidc-wp/openid-connect-generic/issues\n"
    8 "POT-Creation-Date: 2026-02-12 21:27:15+00:00\n"
     8"POT-Creation-Date: 2026-02-13 04:19:17+00:00\n"
    99"MIME-Version: 1.0\n"
    1010"Content-Type: text/plain; charset=utf-8\n"
    … …  
    4848msgstr ""
    4949
    50 #: includes/openid-connect-generic-client-wrapper.php:987
     50#: includes/openid-connect-generic-client-wrapper.php:992
    5151msgid "User claim incomplete."
    5252msgstr ""
    5353
    54 #: includes/openid-connect-generic-client-wrapper.php:1090
     54#: includes/openid-connect-generic-client-wrapper.php:1095
    5555msgid "Bad user claim result."
    5656msgstr ""
    5757
    58 #: includes/openid-connect-generic-client-wrapper.php:1156
     58#: includes/openid-connect-generic-client-wrapper.php:1161
    5959msgid "Can not authorize."
    6060msgstr ""
    6161
    62 #: includes/openid-connect-generic-client-wrapper.php:1185
     62#: includes/openid-connect-generic-client-wrapper.php:1190
    6363msgid "Failed user creation."
    6464msgstr ""
    6565
    66 #: includes/openid-connect-generic-client.php:259
     66#: includes/openid-connect-generic-client.php:270
    6767msgid "Missing state."
    6868msgstr ""
    6969
    70 #: includes/openid-connect-generic-client.php:263
     70#: includes/openid-connect-generic-client.php:274
    7171msgid "Invalid state."
    7272msgstr ""
    7373
    74 #: includes/openid-connect-generic-client.php:278
     74#: includes/openid-connect-generic-client.php:289
    7575msgid "Missing authentication code."
    7676msgstr ""
    7777
    78 #: includes/openid-connect-generic-client.php:323
     78#: includes/openid-connect-generic-client.php:334
    7979msgid "Request for authentication token failed."
    8080msgstr ""
    8181
    82 #: includes/openid-connect-generic-client.php:356
     82#: includes/openid-connect-generic-client.php:367
    8383msgid "Refresh token failed."
    8484msgstr ""
    8585
    86 #: includes/openid-connect-generic-client.php:371
     86#: includes/openid-connect-generic-client.php:382
    8787msgid "Missing token body."
    8888msgstr ""
    8989
    90 #: includes/openid-connect-generic-client.php:379
     90#: includes/openid-connect-generic-client.php:390
    9191msgid "Invalid token."
    9292msgstr ""
    9393
    94 #: includes/openid-connect-generic-client.php:440
     94#: includes/openid-connect-generic-client.php:451
    9595msgid "Request for userinfo failed."
    9696msgstr ""
    9797
    98 #: includes/openid-connect-generic-client.php:504
     98#: includes/openid-connect-generic-client.php:515
    9999msgid "Missing authentication state."
    100100msgstr ""
    101101
    102 #: includes/openid-connect-generic-client.php:541
     102#: includes/openid-connect-generic-client.php:552
    103103msgid "No identity token."
    104104msgstr ""
    105105
    106 #: includes/openid-connect-generic-client.php:576
     106#: includes/openid-connect-generic-client.php:592
    107107msgid "Missing identity token."
    108108msgstr ""
    109109
    110 #: includes/openid-connect-generic-client.php:635
     110#: includes/openid-connect-generic-client.php:651
    111111msgid "Bad ID token claim."
    112112msgstr ""
    113113
    114 #: includes/openid-connect-generic-client.php:640
     114#: includes/openid-connect-generic-client.php:656
    115115msgid "No subject identity."
    116116msgstr ""
    117117
    118 #: includes/openid-connect-generic-client.php:645
     118#: includes/openid-connect-generic-client.php:661
    119119#: includes/openid-connect-generic-jwt-validator.php:184
    120120msgid "Token missing expiration claim."
    121121msgstr ""
    122122
    123 #: includes/openid-connect-generic-client.php:648
     123#: includes/openid-connect-generic-client.php:664
    124124msgid "Token has expired."
    125125msgstr ""
    126126
    127 #: includes/openid-connect-generic-client.php:653
     127#: includes/openid-connect-generic-client.php:669
    128128#: includes/openid-connect-generic-jwt-validator.php:192
    129129msgid "Token missing issued at claim."
    130130msgstr ""
    131131
    132 #: includes/openid-connect-generic-client.php:658
     132#: includes/openid-connect-generic-client.php:674
    133133#: includes/openid-connect-generic-jwt-validator.php:200
    134134msgid "Token missing audience claim."
    135135msgstr ""
    136136
    137 #: includes/openid-connect-generic-client.php:671
     137#: includes/openid-connect-generic-client.php:687
    138138#: includes/openid-connect-generic-jwt-validator.php:217
    139139msgid "Token audience does not match client."
    140140msgstr ""
    141141
    142 #: includes/openid-connect-generic-client.php:677
     142#: includes/openid-connect-generic-client.php:697
    143143#: includes/openid-connect-generic-jwt-validator.php:226
    144144msgid "Token missing issuer claim."
    145145msgstr ""
    146146
    147 #: includes/openid-connect-generic-client.php:687
    148 #: includes/openid-connect-generic-jwt-validator.php:233
     147#: includes/openid-connect-generic-client.php:712
     148#: includes/openid-connect-generic-jwt-validator.php:241
    149149msgid "Token issuer does not match expected issuer."
    150150msgstr ""
    151151
    152 #: includes/openid-connect-generic-client.php:697
     152#: includes/openid-connect-generic-client.php:722
    153153msgid "No matching acr values."
    154154msgstr ""
    155155
    156 #: includes/openid-connect-generic-client.php:717
     156#: includes/openid-connect-generic-client.php:742
    157157msgid "Bad user claim."
    158158msgstr ""
    159159
    160 #: includes/openid-connect-generic-client.php:737
     160#: includes/openid-connect-generic-client.php:762
    161161msgid "Invalid user claim."
    162162msgstr ""
    163163
    164 #: includes/openid-connect-generic-client.php:742
     164#: includes/openid-connect-generic-client.php:767
    165165msgid "Error from the IDP."
    166166msgstr ""
    167167
    168 #: includes/openid-connect-generic-client.php:751
     168#: includes/openid-connect-generic-client.php:776
    169169msgid "Incorrect user claim."
    170170msgstr ""
    171171
    172 #: includes/openid-connect-generic-client.php:758
     172#: includes/openid-connect-generic-client.php:783
    173173msgid "Unauthorized access."
    174174msgstr ""
    … …  
    191191msgstr ""
    192192
    193 #: includes/openid-connect-generic-jwt-validator.php:307
     193#: includes/openid-connect-generic-jwt-validator.php:315
    194194msgid "JWKS URI not configured. JWT signature verification requires JWKS endpoint."
    195195msgstr ""
    196196
    197 #: includes/openid-connect-generic-jwt-validator.php:338
     197#: includes/openid-connect-generic-jwt-validator.php:346
    198198#. translators: %s is the error message
    199199msgid "JWT verification failed: %s"
    … …  
    358358
    359359#: includes/openid-connect-generic-settings-page.php:312
     360msgid "Issuer"
     361msgstr ""
     362
     363#: includes/openid-connect-generic-settings-page.php:313
     364msgid ""
     365"Identity provider issuer URL for JWT validation. If not set, the issuer "
     366"will be automatically derived from the Login Endpoint URL. Only configure "
     367"this if your IDP uses a different issuer than the base URL of the login "
     368"endpoint."
     369msgstr ""
     370
     371#: includes/openid-connect-generic-settings-page.php:320
    360372msgid "JWKS Cache TTL (seconds)"
    361373msgstr ""
    362374
    363 #: includes/openid-connect-generic-settings-page.php:313
     375#: includes/openid-connect-generic-settings-page.php:321
    364376msgid "Time in seconds to cache JWKS keys. Default: 3600 (1 hour)"
    365377msgstr ""
    366378
    367 #: includes/openid-connect-generic-settings-page.php:319
     379#: includes/openid-connect-generic-settings-page.php:327
    368380msgid "ACR values"
    369381msgstr ""
    370382
    371 #: includes/openid-connect-generic-settings-page.php:320
     383#: includes/openid-connect-generic-settings-page.php:328
    372384msgid "Use a specific defined authentication contract from the IDP - optional."
    373385msgstr ""
    374386
    375 #: includes/openid-connect-generic-settings-page.php:326
     387#: includes/openid-connect-generic-settings-page.php:334
    376388msgid "Identity Key"
    377389msgstr ""
    378390
    379 #: includes/openid-connect-generic-settings-page.php:327
     391#: includes/openid-connect-generic-settings-page.php:335
    380392msgid ""
    381393"Where in the user claim array to find the user's identification data. "
    … …  
    384396msgstr ""
    385397
    386 #: includes/openid-connect-generic-settings-page.php:333
     398#: includes/openid-connect-generic-settings-page.php:341
    387399msgid "HTTP Request Timeout"
    388400msgstr ""
    389401
    390 #: includes/openid-connect-generic-settings-page.php:334
     402#: includes/openid-connect-generic-settings-page.php:342
    391403msgid "Set the timeout for requests made to the IDP. Default value is 5."
    392404msgstr ""
    393405
    394 #: includes/openid-connect-generic-settings-page.php:340
     406#: includes/openid-connect-generic-settings-page.php:348
    395407msgid "Enforce Privacy"
    396408msgstr ""
    397409
    398 #: includes/openid-connect-generic-settings-page.php:341
     410#: includes/openid-connect-generic-settings-page.php:349
    399411msgid "Require users be logged in to see the site."
    400412msgstr ""
    401413
    402 #: includes/openid-connect-generic-settings-page.php:347
     414#: includes/openid-connect-generic-settings-page.php:355
    403415msgid "Alternate Redirect URI"
    404416msgstr ""
    405417
    406 #: includes/openid-connect-generic-settings-page.php:348
     418#: includes/openid-connect-generic-settings-page.php:356
    407419msgid ""
    408420"Provide an alternative redirect route. Useful if your server is causing "
    … …  
    412424msgstr ""
    413425
    414 #: includes/openid-connect-generic-settings-page.php:353
     426#: includes/openid-connect-generic-settings-page.php:361
    415427msgid "Nickname Key"
    416428msgstr ""
    417429
    418 #: includes/openid-connect-generic-settings-page.php:354
     430#: includes/openid-connect-generic-settings-page.php:362
    419431msgid ""
    420432"Where in the user claim array to find the user's nickname. Possible "
    … …  
    422434msgstr ""
    423435
    424 #: includes/openid-connect-generic-settings-page.php:360
     436#: includes/openid-connect-generic-settings-page.php:368
    425437msgid "Email Formatting"
    426438msgstr ""
    427439
    428 #: includes/openid-connect-generic-settings-page.php:361
     440#: includes/openid-connect-generic-settings-page.php:369
    429441msgid ""
    430442"String from which the user's email address is built. Specify \"{email}\" as "
    … …  
    432444msgstr ""
    433445
    434 #: includes/openid-connect-generic-settings-page.php:367
     446#: includes/openid-connect-generic-settings-page.php:375
    435447msgid "Display Name Formatting"
    436448msgstr ""
    437449
    438 #: includes/openid-connect-generic-settings-page.php:368
     450#: includes/openid-connect-generic-settings-page.php:376
    439451msgid "String from which the user's display name is built."
    440452msgstr ""
    441453
    442 #: includes/openid-connect-generic-settings-page.php:374
     454#: includes/openid-connect-generic-settings-page.php:382
    443455msgid "Identify with User Name"
    444456msgstr ""
    445457
    446 #: includes/openid-connect-generic-settings-page.php:375
     458#: includes/openid-connect-generic-settings-page.php:383
    447459msgid ""
    448460"If checked, the user's identity will be determined by the user name instead "
    … …  
    450462msgstr ""
    451463
    452 #: includes/openid-connect-generic-settings-page.php:380
     464#: includes/openid-connect-generic-settings-page.php:388
    453465msgid "State time limit"
    454466msgstr ""
    455467
    456 #: includes/openid-connect-generic-settings-page.php:381
     468#: includes/openid-connect-generic-settings-page.php:389
    457469msgid "State valid time in seconds. Defaults to 180"
    458470msgstr ""
    459471
    460 #: includes/openid-connect-generic-settings-page.php:386
     472#: includes/openid-connect-generic-settings-page.php:394
    461473msgid "Enable Refresh Token"
    462474msgstr ""
    463475
    464 #: includes/openid-connect-generic-settings-page.php:387
     476#: includes/openid-connect-generic-settings-page.php:395
    465477msgid ""
    466478"If checked, support refresh tokens used to obtain access tokens from "
    … …  
    468480msgstr ""
    469481
    470 #: includes/openid-connect-generic-settings-page.php:392
     482#: includes/openid-connect-generic-settings-page.php:400
    471483msgid "Disable SSL Verify"
    472484msgstr ""
    473485
    474 #: includes/openid-connect-generic-settings-page.php:394
     486#: includes/openid-connect-generic-settings-page.php:402
    475487#. translators: %1$s HTML tags for layout/styles (strong tag start with warning
    476488#. class), %2$s closing HTML tag for styles.
    … …  
    482494msgstr ""
    483495
    484 #: includes/openid-connect-generic-settings-page.php:399
     496#: includes/openid-connect-generic-settings-page.php:407
    485497msgid "Allow Internal IDP"
    486498msgstr ""
    487499
    488 #: includes/openid-connect-generic-settings-page.php:401
     500#: includes/openid-connect-generic-settings-page.php:409
    489501#. translators: %1$s HTML tags for layout/styles (strong tag start with warning
    490502#. class), %2$s closing HTML tag for styles.
    … …  
    496508msgstr ""
    497509
    498 #: includes/openid-connect-generic-settings-page.php:406
     510#: includes/openid-connect-generic-settings-page.php:414
    499511msgid "Link Existing Users"
    500512msgstr ""
    501513
    502 #: includes/openid-connect-generic-settings-page.php:407
     514#: includes/openid-connect-generic-settings-page.php:415
    503515msgid ""
    504516"If a WordPress account already exists with the same identity as a "
    … …  
    507519msgstr ""
    508520
    509 #: includes/openid-connect-generic-settings-page.php:413
     521#: includes/openid-connect-generic-settings-page.php:421
    510522msgid "Create user if does not exist"
    511523msgstr ""
    512524
    513 #: includes/openid-connect-generic-settings-page.php:414
     525#: includes/openid-connect-generic-settings-page.php:422
    514526msgid ""
    515527"If the user identity is not linked to an existing WordPress user, it is "
    … …  
    519531msgstr ""
    520532
    521 #: includes/openid-connect-generic-settings-page.php:420
     533#: includes/openid-connect-generic-settings-page.php:428
    522534msgid "Redirect Back to Origin Page"
    523535msgstr ""
    524536
    525 #: includes/openid-connect-generic-settings-page.php:421
     537#: includes/openid-connect-generic-settings-page.php:429
    526538msgid ""
    527539"After a successful OpenID Connect authentication, this will redirect the "
    … …  
    534546msgstr ""
    535547
    536 #: includes/openid-connect-generic-settings-page.php:427
     548#: includes/openid-connect-generic-settings-page.php:435
    537549msgid "Redirect to the login screen when session is expired"
    538550msgstr ""
    539551
    540 #: includes/openid-connect-generic-settings-page.php:428
     552#: includes/openid-connect-generic-settings-page.php:436
    541553msgid ""
    542554"When enabled, this will automatically redirect the user back to the "
    … …  
    544556msgstr ""
    545557
    546 #: includes/openid-connect-generic-settings-page.php:434
     558#: includes/openid-connect-generic-settings-page.php:442
    547559msgid "Enable Logging"
    548560msgstr ""
    549561
    550 #: includes/openid-connect-generic-settings-page.php:435
     562#: includes/openid-connect-generic-settings-page.php:443
    551563msgid "Very simple log messages for debugging purposes."
    552564msgstr ""
    553565
    554 #: includes/openid-connect-generic-settings-page.php:441
     566#: includes/openid-connect-generic-settings-page.php:449
    555567msgid "Log Limit"
    556568msgstr ""
    557569
    558 #: includes/openid-connect-generic-settings-page.php:442
     570#: includes/openid-connect-generic-settings-page.php:450
    559571msgid ""
    560572"Number of items to keep in the log. These logs are stored as an option in "
    … …  
    562574msgstr ""
    563575
    564 #: includes/openid-connect-generic-settings-page.php:507
     576#: includes/openid-connect-generic-settings-page.php:515
    565577msgid "Notes"
    566578msgstr ""
    567579
    568 #: includes/openid-connect-generic-settings-page.php:510
     580#: includes/openid-connect-generic-settings-page.php:518
    569581msgid "Redirect URI"
    570582msgstr ""
    571583
    572 #: includes/openid-connect-generic-settings-page.php:514
     584#: includes/openid-connect-generic-settings-page.php:522
    573585msgid "Login Button Shortcode"
    574586msgstr ""
    575587
    576 #: includes/openid-connect-generic-settings-page.php:518
     588#: includes/openid-connect-generic-settings-page.php:526
    577589msgid "Authentication URL Shortcode"
    578590msgstr ""
    579591
    580 #: includes/openid-connect-generic-settings-page.php:523
     592#: includes/openid-connect-generic-settings-page.php:531
    581593msgid "Logs"
    582594msgstr ""
    583595
    584 #: includes/openid-connect-generic-settings-page.php:612
     596#: includes/openid-connect-generic-settings-page.php:620
    585597msgid "Example"
    586598msgstr ""
    587599
    588 #: includes/openid-connect-generic-settings-page.php:625
     600#: includes/openid-connect-generic-settings-page.php:633
    589601msgid "Enter your OpenID Connect identity provider settings."
    590602msgstr ""
    591603
    592 #: includes/openid-connect-generic-settings-page.php:634
     604#: includes/openid-connect-generic-settings-page.php:642
    593605msgid "Modify the interaction between OpenID Connect and WordPress users."
    594606msgstr ""
    595607
    596 #: includes/openid-connect-generic-settings-page.php:643
     608#: includes/openid-connect-generic-settings-page.php:651
    597609msgid "Control the authorization mechanics of the site."
    598610msgstr ""
    599611
    600 #: includes/openid-connect-generic-settings-page.php:652
     612#: includes/openid-connect-generic-settings-page.php:660
    601613msgid "Log information about login attempts through OpenID Connect Generic."
    602614msgstr ""
    603615
    604 #: includes/openid-connect-generic-settings-page.php:667
     616#: includes/openid-connect-generic-settings-page.php:675
    605617msgid "Please enter a discovery URL."
    606618msgstr ""
    607619
    608 #: includes/openid-connect-generic-settings-page.php:676
     620#: includes/openid-connect-generic-settings-page.php:684
    609621msgid "Invalid discovery URL format."
    610622msgstr ""
    611623
    612 #: includes/openid-connect-generic-settings-page.php:687
     624#: includes/openid-connect-generic-settings-page.php:695
    613625msgid "Discovery URL must use HTTPS in production environments."
    614626msgstr ""
    615627
    616 #: includes/openid-connect-generic-settings-page.php:707
     628#: includes/openid-connect-generic-settings-page.php:715
    617629#. translators: %s: error message
    618630msgid "Failed to fetch discovery document: %s"
    619631msgstr ""
    620632
    621 #: includes/openid-connect-generic-settings-page.php:719
     633#: includes/openid-connect-generic-settings-page.php:727
    622634#. translators: %d: HTTP status code
    623635msgid "Discovery document request returned HTTP %d."
    624636msgstr ""
    625637
    626 #: includes/openid-connect-generic-settings-page.php:732
     638#: includes/openid-connect-generic-settings-page.php:740
    627639msgid "Discovery document is not valid JSON."
    628640msgstr ""
    629641
    630 #: includes/openid-connect-generic-settings-page.php:751
     642#: includes/openid-connect-generic-settings-page.php:759
    631643#. translators: %s: comma-separated list of missing fields
    632644msgid "Discovery document is missing required fields: %s"
    633645msgstr ""
    634646
    635 #: includes/openid-connect-generic-settings-page.php:815
     647#: includes/openid-connect-generic-settings-page.php:824
    636648msgid "Security check failed. Please try again."
    637649msgstr ""
    638650
    639 #: includes/openid-connect-generic-settings-page.php:859
     651#: includes/openid-connect-generic-settings-page.php:868
    640652#. translators: %d: number of fields populated
    641653msgid ""
    … …  
    648660msgstr[1] ""
    649661
    650 #: includes/openid-connect-generic-settings-page.php:886
     662#: includes/openid-connect-generic-settings-page.php:895
    651663msgid "Quick Setup: Import from Discovery Document"
    652664msgstr ""
    653665
    654 #: includes/openid-connect-generic-settings-page.php:890
     666#: includes/openid-connect-generic-settings-page.php:899
    655667msgid ""
    656668"Auto-populate endpoint settings from your identity provider's OpenID "
    … …  
    659671msgstr ""
    660672
    661 #: includes/openid-connect-generic-settings-page.php:898
     673#: includes/openid-connect-generic-settings-page.php:907
    662674msgid "Discovery URL"
    663675msgstr ""
    664676
    665 #: includes/openid-connect-generic-settings-page.php:910
     677#: includes/openid-connect-generic-settings-page.php:919
    666678msgid "Enter your identity provider's OpenID Connect discovery endpoint URL."
    667679msgstr ""
    668680
    669 #: includes/openid-connect-generic-settings-page.php:912
     681#: includes/openid-connect-generic-settings-page.php:921
    670682msgid "Examples:"
    671683msgstr ""
    672684
    673 #: includes/openid-connect-generic-settings-page.php:923
     685#: includes/openid-connect-generic-settings-page.php:932
    674686msgid "Load Configuration"
    675687msgstr ""
    676688
    677 #: openid-connect-generic.php:251
     689#: openid-connect-generic.php:252
    678690msgid "Private site"
    679691msgstr ""
    680692
    681 #: openid-connect-generic.php:281
     693#: openid-connect-generic.php:282
    682694msgid "OpenID Connect Generic - Security Configuration Required"
    683695msgstr ""
    684696
    685 #: openid-connect-generic.php:288
     697#: openid-connect-generic.php:289
    686698#. translators: %s is a link to the settings page
    687699msgid ""
    … …  
    691703msgstr ""
    692704
    693 #: openid-connect-generic.php:295
     705#: openid-connect-generic.php:296
    694706msgid ""
    695707"The current insecure fallback will be removed in version 3.12.0. After that "
    … …  
    697709msgstr ""
    698710
    699 #: openid-connect-generic.php:298
     711#: openid-connect-generic.php:299
    700712msgid "Common JWKS endpoints:"
    701713msgstr ""

  • daggerhart-openid-connect-generic/tags/3.11.3/openid-connect-generic.php

    r3460363 r3460486  
    1717 * Plugin URI:        https://github.com/oidc-wp/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect identity provider using Authorization Code Flow.
    19  * Version:           3.11.2
     19 * Version:           3.11.3
    2020 * Requires at least: 5.0
    2121 * Requires PHP:      7.4
    … …  
    9494     * @var string
    9595     */
    96     const VERSION = '3.11.2';
     96    const VERSION = '3.11.3';
    9797
    9898    /**
    … …  
    160160            $this->settings->acr_values,
    161161            $this->settings->endpoint_jwks,
     162            $this->settings->issuer ?? '',
    162163            $this->settings->jwks_cache_ttl,
    163164            $this->get_state_time_limit( $this->settings ),

  • daggerhart-openid-connect-generic/tags/3.11.3/readme.txt

    r3460363 r3460486  
    44Requires at least: 5.0
    55Tested up to: 6.9.0
    6 Stable tag: 3.11.2
     6Stable tag: 3.11.3
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    5050== Upgrade Notice ==
    5151
    52 = 3.11.2 =
     52= 3.11.3 =
    5353
    5454SECURITY UPDATE: 3.11.x branch - Fixes authentication vulnerabilities including JWT signature bypass and SSRF protection. Update immediately and configure JWKS endpoint in settings.
    5555
    5656== Changelog ==
     57
     58= 3.11.3 =
     59
     60* Feature/improvement: Added configurable issuer setting for JWT validation.
    5761
    5862= 3.11.2 =

  • daggerhart-openid-connect-generic/tags/3.11.3/vendor/composer/installed.php

    r3460363 r3460486  
    22    'root' => array(
    33        'name' => 'daggerhart/openid-connect-generic',
    4         'pretty_version' => '3.11.2',
    5         'version' => '3.11.2.0',
    6         'reference' => '1810fffbabb261cd81108575ccfd186bd2495d86',
     4        'pretty_version' => '3.11.3',
     5        'version' => '3.11.3.0',
     6        'reference' => '0ef442c0f61bda837bddacec37b96035176bee27',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    2121        ),
    2222        'daggerhart/openid-connect-generic' => array(
    23             'pretty_version' => '3.11.2',
    24             'version' => '3.11.2.0',
    25             'reference' => '1810fffbabb261cd81108575ccfd186bd2495d86',
     23            'pretty_version' => '3.11.3',
     24            'version' => '3.11.3.0',
     25            'reference' => '0ef442c0f61bda837bddacec37b96035176bee27',
    2626            'type' => 'wordpress-plugin',
    2727            'install_path' => __DIR__ . '/../../',

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client-wrapper.php

    r3459957 r3460486  
    915915        // Check if JWKS endpoint is configured for JWT signature verification.
    916916        if ( ! empty( $this->settings->endpoint_jwks ) ) {
     917            // Use configured issuer if provided, otherwise derive from endpoint_login.
     918            $issuer = ! empty( $this->settings->issuer ) ?
     919                $this->settings->issuer :
     920                ( ! empty( $this->settings->endpoint_login ) ? $this->client->get_issuer_from_endpoint( $this->settings->endpoint_login ) : '' );
     921
    917922            // Use JWT validator for secure signature verification.
    918923            $jwt_validator = new OpenID_Connect_Generic_JWT_Validator(
    919924                $this->settings->endpoint_jwks,
    920925                $this->settings->client_id,
    921                 $this->client->get_issuer_from_endpoint( $this->settings->endpoint_login ),
     926                $issuer,
    922927                $this->settings->jwks_cache_ttl,
    923928                $this->settings->allow_internal_idp,

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client.php

    r3459991 r3460486  
    102102
    103103    /**
     104     * The issuer URL for JWT validation.
     105     *
     106     * @see OpenID_Connect_Generic_Option_Settings::issuer
     107     *
     108     * @var string
     109     */
     110    private $issuer;
     111
     112    /**
    104113     * The JWKS cache TTL in seconds.
    105114     *
    … …  
    147156     * @param string                               $acr_values         @see OpenID_Connect_Generic_Option_Settings::acr_values for description.
    148157     * @param string                               $endpoint_jwks      @see OpenID_Connect_Generic_Option_Settings::endpoint_jwks for description.
     158     * @param string                               $issuer             @see OpenID_Connect_Generic_Option_Settings::issuer for description.
    149159     * @param int                                  $jwks_cache_ttl     @see OpenID_Connect_Generic_Option_Settings::jwks_cache_ttl for description.
    150160     * @param int                                  $state_time_limit   @see OpenID_Connect_Generic_Option_Settings::state_time_limit for description.
    … …  
    152162     * @param OpenID_Connect_Generic_Option_Logger $logger             The plugin logging object instance.
    153163     */
    154     public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $endpoint_jwks, $jwks_cache_ttl, $state_time_limit, $allow_internal_idp, $logger ) {
     164    public function __construct( $client_id, $client_secret, $scope, $endpoint_login, $endpoint_userinfo, $endpoint_token, $redirect_uri, $acr_values, $endpoint_jwks, $issuer, $jwks_cache_ttl, $state_time_limit, $allow_internal_idp, $logger ) {
    155165        $this->client_id = $client_id;
    156166        $this->client_secret = $client_secret;
    … …  
    162172        $this->acr_values = $acr_values;
    163173        $this->endpoint_jwks = $endpoint_jwks;
     174        $this->issuer = $issuer;
    164175        $this->jwks_cache_ttl = $jwks_cache_ttl;
    165176        $this->state_time_limit = $state_time_limit;
    … …  
    544555        // Check if JWKS endpoint is configured for JWT signature verification.
    545556        if ( ! empty( $this->endpoint_jwks ) ) {
     557            // Use configured issuer if provided, otherwise derive from endpoint_login.
     558            $issuer = ! empty( $this->issuer )
     559                ? $this->issuer
     560                : $this->get_issuer_from_endpoint( $this->endpoint_login );
     561
    546562            // Use JWT validator for secure signature verification.
    547563            $jwt_validator = new OpenID_Connect_Generic_JWT_Validator(
    548564                $this->endpoint_jwks,
    549565                $this->client_id,
    550                 $this->get_issuer_from_endpoint( $this->endpoint_login ),
     566                $issuer,
    551567                $this->jwks_cache_ttl,
    552568                $this->allow_internal_idp,
    … …  
    672688        }
    673689
    674         // Validate issuer claim if endpoint_login is configured.
    675         if ( ! empty( $this->endpoint_login ) ) {
     690        // Validate issuer claim if configured or endpoint_login is available.
     691        $expected_issuer = ! empty( $this->issuer ) ?
     692            $this->issuer :
     693            ( ! empty( $this->endpoint_login ) ? $this->get_issuer_from_endpoint( $this->endpoint_login ) : '' );
     694
     695        if ( ! empty( $expected_issuer ) ) {
    676696            if ( ! isset( $id_token_claim['iss'] ) ) {
    677697                return new WP_Error( 'missing-iss', __( 'Token missing issuer claim.', 'daggerhart-openid-connect-generic' ), $id_token_claim );
    678698            }
    679699
    680             // Extract expected issuer from endpoint_login (base URL).
    681             $expected_issuer = $this->get_issuer_from_endpoint( $this->endpoint_login );
    682 
    683700            if ( rtrim( $id_token_claim['iss'], '/' ) !== rtrim( $expected_issuer, '/' ) ) {
     701                $this->logger->log(
     702                    sprintf(
     703                        'Issuer mismatch - Expected: "%s", Received: "%s". Configure the correct issuer in Settings > OpenID Connect Client > Issuer field, or via the OIDC_ISSUER constant.',
     704                        $expected_issuer,
     705                        $id_token_claim['iss']
     706                    ),
     707                    'issuer-mismatch'
     708                );
    684709                return new WP_Error(
    685710                    'invalid-iss',

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-jwt-validator.php

    r3460363 r3460486  
    229229
    230230            if ( rtrim( $decoded_jwt->iss, '/' ) !== rtrim( $this->issuer, '/' ) ) {
     231                $this->logger->log(
     232                    sprintf(
     233                        'Issuer mismatch - Expected: "%s", Received: "%s". Configure the correct issuer in Settings > OpenID Connect Client > Issuer field, or via the OIDC_ISSUER constant.',
     234                        $this->issuer,
     235                        $decoded_jwt->iss
     236                    ),
     237                    'issuer-mismatch'
     238                );
    231239                return new WP_Error(
    232240                    'invalid-iss',

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-option-settings.php

    r3459957 r3460486  
    3636 * @property string $endpoint_end_session The IDP logout endpoint URL.
    3737 * @property string $endpoint_jwks        The IDP JWKS endpoint URL for JWT signature verification.
     38 * @property string $issuer               The IDP issuer URL for JWT validation (optional - derived from endpoint_login if not set).
    3839 * @property int    $jwks_cache_ttl       The JWKS cache TTL in seconds.
    3940 * @property string $acr_values           The Authentication contract as defined on the IDP.
    … …  
    99100        'endpoint_userinfo'         => 'OIDC_ENDPOINT_USERINFO_URL',
    100101        'endpoint_jwks'             => 'OIDC_ENDPOINT_JWKS_URL',
     102        'issuer'                    => 'OIDC_ISSUER',
    101103        'login_type'                => 'OIDC_LOGIN_TYPE',
    102104        'scope'                     => 'OIDC_CLIENT_SCOPE',

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-settings-page.php

    r3459957 r3460486  
    309309                'section'     => 'client_settings',
    310310            ),
     311            'issuer' => array(
     312                'title'       => __( 'Issuer', 'daggerhart-openid-connect-generic' ),
     313                'description' => __( 'Identity provider issuer URL for JWT validation. If not set, the issuer will be automatically derived from the Login Endpoint URL. Only configure this if your IDP uses a different issuer than the base URL of the login endpoint.', 'daggerhart-openid-connect-generic' ),
     314                'example'     => 'https://example.com',
     315                'type'        => 'text',
     316                'disabled'    => defined( 'OIDC_ISSUER' ),
     317                'section'     => 'client_settings',
     318            ),
    311319            'jwks_cache_ttl' => array(
    312320                'title'       => __( 'JWKS Cache TTL (seconds)', 'daggerhart-openid-connect-generic' ),
    … …  
    777785            'userinfo_endpoint'      => 'endpoint_userinfo',
    778786            'jwks_uri'               => 'endpoint_jwks',
     787            'issuer'                 => 'issuer',
    779788            'end_session_endpoint'   => 'endpoint_end_session',
    780789        );

  • daggerhart-openid-connect-generic/trunk/languages/openid-connect-generic.pot

    r3460363 r3460486  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: OpenID Connect Generic 3.11.2\n"
     5"Project-Id-Version: OpenID Connect Generic 3.11.3\n"
    66"Report-Msgid-Bugs-To: "
    77"https://github.com/oidc-wp/openid-connect-generic/issues\n"
    8 "POT-Creation-Date: 2026-02-12 21:27:15+00:00\n"
     8"POT-Creation-Date: 2026-02-13 04:19:17+00:00\n"
    99"MIME-Version: 1.0\n"
    1010"Content-Type: text/plain; charset=utf-8\n"
    … …  
    4848msgstr ""
    4949
    50 #: includes/openid-connect-generic-client-wrapper.php:987
     50#: includes/openid-connect-generic-client-wrapper.php:992
    5151msgid "User claim incomplete."
    5252msgstr ""
    5353
    54 #: includes/openid-connect-generic-client-wrapper.php:1090
     54#: includes/openid-connect-generic-client-wrapper.php:1095
    5555msgid "Bad user claim result."
    5656msgstr ""
    5757
    58 #: includes/openid-connect-generic-client-wrapper.php:1156
     58#: includes/openid-connect-generic-client-wrapper.php:1161
    5959msgid "Can not authorize."
    6060msgstr ""
    6161
    62 #: includes/openid-connect-generic-client-wrapper.php:1185
     62#: includes/openid-connect-generic-client-wrapper.php:1190
    6363msgid "Failed user creation."
    6464msgstr ""
    6565
    66 #: includes/openid-connect-generic-client.php:259
     66#: includes/openid-connect-generic-client.php:270
    6767msgid "Missing state."
    6868msgstr ""
    6969
    70 #: includes/openid-connect-generic-client.php:263
     70#: includes/openid-connect-generic-client.php:274
    7171msgid "Invalid state."
    7272msgstr ""
    7373
    74 #: includes/openid-connect-generic-client.php:278
     74#: includes/openid-connect-generic-client.php:289
    7575msgid "Missing authentication code."
    7676msgstr ""
    7777
    78 #: includes/openid-connect-generic-client.php:323
     78#: includes/openid-connect-generic-client.php:334
    7979msgid "Request for authentication token failed."
    8080msgstr ""
    8181
    82 #: includes/openid-connect-generic-client.php:356
     82#: includes/openid-connect-generic-client.php:367
    8383msgid "Refresh token failed."
    8484msgstr ""
    8585
    86 #: includes/openid-connect-generic-client.php:371
     86#: includes/openid-connect-generic-client.php:382
    8787msgid "Missing token body."
    8888msgstr ""
    8989
    90 #: includes/openid-connect-generic-client.php:379
     90#: includes/openid-connect-generic-client.php:390
    9191msgid "Invalid token."
    9292msgstr ""
    9393
    94 #: includes/openid-connect-generic-client.php:440
     94#: includes/openid-connect-generic-client.php:451
    9595msgid "Request for userinfo failed."
    9696msgstr ""
    9797
    98 #: includes/openid-connect-generic-client.php:504
     98#: includes/openid-connect-generic-client.php:515
    9999msgid "Missing authentication state."
    100100msgstr ""
    101101
    102 #: includes/openid-connect-generic-client.php:541
     102#: includes/openid-connect-generic-client.php:552
    103103msgid "No identity token."
    104104msgstr ""
    105105
    106 #: includes/openid-connect-generic-client.php:576
     106#: includes/openid-connect-generic-client.php:592
    107107msgid "Missing identity token."
    108108msgstr ""
    109109
    110 #: includes/openid-connect-generic-client.php:635
     110#: includes/openid-connect-generic-client.php:651
    111111msgid "Bad ID token claim."
    112112msgstr ""
    113113
    114 #: includes/openid-connect-generic-client.php:640
     114#: includes/openid-connect-generic-client.php:656
    115115msgid "No subject identity."
    116116msgstr ""
    117117
    118 #: includes/openid-connect-generic-client.php:645
     118#: includes/openid-connect-generic-client.php:661
    119119#: includes/openid-connect-generic-jwt-validator.php:184
    120120msgid "Token missing expiration claim."
    121121msgstr ""
    122122
    123 #: includes/openid-connect-generic-client.php:648
     123#: includes/openid-connect-generic-client.php:664
    124124msgid "Token has expired."
    125125msgstr ""
    126126
    127 #: includes/openid-connect-generic-client.php:653
     127#: includes/openid-connect-generic-client.php:669
    128128#: includes/openid-connect-generic-jwt-validator.php:192
    129129msgid "Token missing issued at claim."
    130130msgstr ""
    131131
    132 #: includes/openid-connect-generic-client.php:658
     132#: includes/openid-connect-generic-client.php:674
    133133#: includes/openid-connect-generic-jwt-validator.php:200
    134134msgid "Token missing audience claim."
    135135msgstr ""
    136136
    137 #: includes/openid-connect-generic-client.php:671
     137#: includes/openid-connect-generic-client.php:687
    138138#: includes/openid-connect-generic-jwt-validator.php:217
    139139msgid "Token audience does not match client."
    140140msgstr ""
    141141
    142 #: includes/openid-connect-generic-client.php:677
     142#: includes/openid-connect-generic-client.php:697
    143143#: includes/openid-connect-generic-jwt-validator.php:226
    144144msgid "Token missing issuer claim."
    145145msgstr ""
    146146
    147 #: includes/openid-connect-generic-client.php:687
    148 #: includes/openid-connect-generic-jwt-validator.php:233
     147#: includes/openid-connect-generic-client.php:712
     148#: includes/openid-connect-generic-jwt-validator.php:241
    149149msgid "Token issuer does not match expected issuer."
    150150msgstr ""
    151151
    152 #: includes/openid-connect-generic-client.php:697
     152#: includes/openid-connect-generic-client.php:722
    153153msgid "No matching acr values."
    154154msgstr ""
    155155
    156 #: includes/openid-connect-generic-client.php:717
     156#: includes/openid-connect-generic-client.php:742
    157157msgid "Bad user claim."
    158158msgstr ""
    159159
    160 #: includes/openid-connect-generic-client.php:737
     160#: includes/openid-connect-generic-client.php:762
    161161msgid "Invalid user claim."
    162162msgstr ""
    163163
    164 #: includes/openid-connect-generic-client.php:742
     164#: includes/openid-connect-generic-client.php:767
    165165msgid "Error from the IDP."
    166166msgstr ""
    167167
    168 #: includes/openid-connect-generic-client.php:751
     168#: includes/openid-connect-generic-client.php:776
    169169msgid "Incorrect user claim."
    170170msgstr ""
    171171
    172 #: includes/openid-connect-generic-client.php:758
     172#: includes/openid-connect-generic-client.php:783
    173173msgid "Unauthorized access."
    174174msgstr ""
    … …  
    191191msgstr ""
    192192
    193 #: includes/openid-connect-generic-jwt-validator.php:307
     193#: includes/openid-connect-generic-jwt-validator.php:315
    194194msgid "JWKS URI not configured. JWT signature verification requires JWKS endpoint."
    195195msgstr ""
    196196
    197 #: includes/openid-connect-generic-jwt-validator.php:338
     197#: includes/openid-connect-generic-jwt-validator.php:346
    198198#. translators: %s is the error message
    199199msgid "JWT verification failed: %s"
    … …  
    358358
    359359#: includes/openid-connect-generic-settings-page.php:312
     360msgid "Issuer"
     361msgstr ""
     362
     363#: includes/openid-connect-generic-settings-page.php:313
     364msgid ""
     365"Identity provider issuer URL for JWT validation. If not set, the issuer "
     366"will be automatically derived from the Login Endpoint URL. Only configure "
     367"this if your IDP uses a different issuer than the base URL of the login "
     368"endpoint."
     369msgstr ""
     370
     371#: includes/openid-connect-generic-settings-page.php:320
    360372msgid "JWKS Cache TTL (seconds)"
    361373msgstr ""
    362374
    363 #: includes/openid-connect-generic-settings-page.php:313
     375#: includes/openid-connect-generic-settings-page.php:321
    364376msgid "Time in seconds to cache JWKS keys. Default: 3600 (1 hour)"
    365377msgstr ""
    366378
    367 #: includes/openid-connect-generic-settings-page.php:319
     379#: includes/openid-connect-generic-settings-page.php:327
    368380msgid "ACR values"
    369381msgstr ""
    370382
    371 #: includes/openid-connect-generic-settings-page.php:320
     383#: includes/openid-connect-generic-settings-page.php:328
    372384msgid "Use a specific defined authentication contract from the IDP - optional."
    373385msgstr ""
    374386
    375 #: includes/openid-connect-generic-settings-page.php:326
     387#: includes/openid-connect-generic-settings-page.php:334
    376388msgid "Identity Key"
    377389msgstr ""
    378390
    379 #: includes/openid-connect-generic-settings-page.php:327
     391#: includes/openid-connect-generic-settings-page.php:335
    380392msgid ""
    381393"Where in the user claim array to find the user's identification data. "
    … …  
    384396msgstr ""
    385397
    386 #: includes/openid-connect-generic-settings-page.php:333
     398#: includes/openid-connect-generic-settings-page.php:341
    387399msgid "HTTP Request Timeout"
    388400msgstr ""
    389401
    390 #: includes/openid-connect-generic-settings-page.php:334
     402#: includes/openid-connect-generic-settings-page.php:342
    391403msgid "Set the timeout for requests made to the IDP. Default value is 5."
    392404msgstr ""
    393405
    394 #: includes/openid-connect-generic-settings-page.php:340
     406#: includes/openid-connect-generic-settings-page.php:348
    395407msgid "Enforce Privacy"
    396408msgstr ""
    397409
    398 #: includes/openid-connect-generic-settings-page.php:341
     410#: includes/openid-connect-generic-settings-page.php:349
    399411msgid "Require users be logged in to see the site."
    400412msgstr ""
    401413
    402 #: includes/openid-connect-generic-settings-page.php:347
     414#: includes/openid-connect-generic-settings-page.php:355
    403415msgid "Alternate Redirect URI"
    404416msgstr ""
    405417
    406 #: includes/openid-connect-generic-settings-page.php:348
     418#: includes/openid-connect-generic-settings-page.php:356
    407419msgid ""
    408420"Provide an alternative redirect route. Useful if your server is causing "
    … …  
    412424msgstr ""
    413425
    414 #: includes/openid-connect-generic-settings-page.php:353
     426#: includes/openid-connect-generic-settings-page.php:361
    415427msgid "Nickname Key"
    416428msgstr ""
    417429
    418 #: includes/openid-connect-generic-settings-page.php:354
     430#: includes/openid-connect-generic-settings-page.php:362
    419431msgid ""
    420432"Where in the user claim array to find the user's nickname. Possible "
    … …  
    422434msgstr ""
    423435
    424 #: includes/openid-connect-generic-settings-page.php:360
     436#: includes/openid-connect-generic-settings-page.php:368
    425437msgid "Email Formatting"
    426438msgstr ""
    427439
    428 #: includes/openid-connect-generic-settings-page.php:361
     440#: includes/openid-connect-generic-settings-page.php:369
    429441msgid ""
    430442"String from which the user's email address is built. Specify \"{email}\" as "
    … …  
    432444msgstr ""
    433445
    434 #: includes/openid-connect-generic-settings-page.php:367
     446#: includes/openid-connect-generic-settings-page.php:375
    435447msgid "Display Name Formatting"
    436448msgstr ""
    437449
    438 #: includes/openid-connect-generic-settings-page.php:368
     450#: includes/openid-connect-generic-settings-page.php:376
    439451msgid "String from which the user's display name is built."
    440452msgstr ""
    441453
    442 #: includes/openid-connect-generic-settings-page.php:374
     454#: includes/openid-connect-generic-settings-page.php:382
    443455msgid "Identify with User Name"
    444456msgstr ""
    445457
    446 #: includes/openid-connect-generic-settings-page.php:375
     458#: includes/openid-connect-generic-settings-page.php:383
    447459msgid ""
    448460"If checked, the user's identity will be determined by the user name instead "
    … …  
    450462msgstr ""
    451463
    452 #: includes/openid-connect-generic-settings-page.php:380
     464#: includes/openid-connect-generic-settings-page.php:388
    453465msgid "State time limit"
    454466msgstr ""
    455467
    456 #: includes/openid-connect-generic-settings-page.php:381
     468#: includes/openid-connect-generic-settings-page.php:389
    457469msgid "State valid time in seconds. Defaults to 180"
    458470msgstr ""
    459471
    460 #: includes/openid-connect-generic-settings-page.php:386
     472#: includes/openid-connect-generic-settings-page.php:394
    461473msgid "Enable Refresh Token"
    462474msgstr ""
    463475
    464 #: includes/openid-connect-generic-settings-page.php:387
     476#: includes/openid-connect-generic-settings-page.php:395
    465477msgid ""
    466478"If checked, support refresh tokens used to obtain access tokens from "
    … …  
    468480msgstr ""
    469481
    470 #: includes/openid-connect-generic-settings-page.php:392
     482#: includes/openid-connect-generic-settings-page.php:400
    471483msgid "Disable SSL Verify"
    472484msgstr ""
    473485
    474 #: includes/openid-connect-generic-settings-page.php:394
     486#: includes/openid-connect-generic-settings-page.php:402
    475487#. translators: %1$s HTML tags for layout/styles (strong tag start with warning
    476488#. class), %2$s closing HTML tag for styles.
    … …  
    482494msgstr ""
    483495
    484 #: includes/openid-connect-generic-settings-page.php:399
     496#: includes/openid-connect-generic-settings-page.php:407
    485497msgid "Allow Internal IDP"
    486498msgstr ""
    487499
    488 #: includes/openid-connect-generic-settings-page.php:401
     500#: includes/openid-connect-generic-settings-page.php:409
    489501#. translators: %1$s HTML tags for layout/styles (strong tag start with warning
    490502#. class), %2$s closing HTML tag for styles.
    … …  
    496508msgstr ""
    497509
    498 #: includes/openid-connect-generic-settings-page.php:406
     510#: includes/openid-connect-generic-settings-page.php:414
    499511msgid "Link Existing Users"
    500512msgstr ""
    501513
    502 #: includes/openid-connect-generic-settings-page.php:407
     514#: includes/openid-connect-generic-settings-page.php:415
    503515msgid ""
    504516"If a WordPress account already exists with the same identity as a "
    … …  
    507519msgstr ""
    508520
    509 #: includes/openid-connect-generic-settings-page.php:413
     521#: includes/openid-connect-generic-settings-page.php:421
    510522msgid "Create user if does not exist"
    511523msgstr ""
    512524
    513 #: includes/openid-connect-generic-settings-page.php:414
     525#: includes/openid-connect-generic-settings-page.php:422
    514526msgid ""
    515527"If the user identity is not linked to an existing WordPress user, it is "
    … …  
    519531msgstr ""
    520532
    521 #: includes/openid-connect-generic-settings-page.php:420
     533#: includes/openid-connect-generic-settings-page.php:428
    522534msgid "Redirect Back to Origin Page"
    523535msgstr ""
    524536
    525 #: includes/openid-connect-generic-settings-page.php:421
     537#: includes/openid-connect-generic-settings-page.php:429
    526538msgid ""
    527539"After a successful OpenID Connect authentication, this will redirect the "
    … …  
    534546msgstr ""
    535547
    536 #: includes/openid-connect-generic-settings-page.php:427
     548#: includes/openid-connect-generic-settings-page.php:435
    537549msgid "Redirect to the login screen when session is expired"
    538550msgstr ""
    539551
    540 #: includes/openid-connect-generic-settings-page.php:428
     552#: includes/openid-connect-generic-settings-page.php:436
    541553msgid ""
    542554"When enabled, this will automatically redirect the user back to the "
    … …  
    544556msgstr ""
    545557
    546 #: includes/openid-connect-generic-settings-page.php:434
     558#: includes/openid-connect-generic-settings-page.php:442
    547559msgid "Enable Logging"
    548560msgstr ""
    549561
    550 #: includes/openid-connect-generic-settings-page.php:435
     562#: includes/openid-connect-generic-settings-page.php:443
    551563msgid "Very simple log messages for debugging purposes."
    552564msgstr ""
    553565
    554 #: includes/openid-connect-generic-settings-page.php:441
     566#: includes/openid-connect-generic-settings-page.php:449
    555567msgid "Log Limit"
    556568msgstr ""
    557569
    558 #: includes/openid-connect-generic-settings-page.php:442
     570#: includes/openid-connect-generic-settings-page.php:450
    559571msgid ""
    560572"Number of items to keep in the log. These logs are stored as an option in "
    … …  
    562574msgstr ""
    563575
    564 #: includes/openid-connect-generic-settings-page.php:507
     576#: includes/openid-connect-generic-settings-page.php:515
    565577msgid "Notes"
    566578msgstr ""
    567579
    568 #: includes/openid-connect-generic-settings-page.php:510
     580#: includes/openid-connect-generic-settings-page.php:518
    569581msgid "Redirect URI"
    570582msgstr ""
    571583
    572 #: includes/openid-connect-generic-settings-page.php:514
     584#: includes/openid-connect-generic-settings-page.php:522
    573585msgid "Login Button Shortcode"
    574586msgstr ""
    575587
    576 #: includes/openid-connect-generic-settings-page.php:518
     588#: includes/openid-connect-generic-settings-page.php:526
    577589msgid "Authentication URL Shortcode"
    578590msgstr ""
    579591
    580 #: includes/openid-connect-generic-settings-page.php:523
     592#: includes/openid-connect-generic-settings-page.php:531
    581593msgid "Logs"
    582594msgstr ""
    583595
    584 #: includes/openid-connect-generic-settings-page.php:612
     596#: includes/openid-connect-generic-settings-page.php:620
    585597msgid "Example"
    586598msgstr ""
    587599
    588 #: includes/openid-connect-generic-settings-page.php:625
     600#: includes/openid-connect-generic-settings-page.php:633
    589601msgid "Enter your OpenID Connect identity provider settings."
    590602msgstr ""
    591603
    592 #: includes/openid-connect-generic-settings-page.php:634
     604#: includes/openid-connect-generic-settings-page.php:642
    593605msgid "Modify the interaction between OpenID Connect and WordPress users."
    594606msgstr ""
    595607
    596 #: includes/openid-connect-generic-settings-page.php:643
     608#: includes/openid-connect-generic-settings-page.php:651
    597609msgid "Control the authorization mechanics of the site."
    598610msgstr ""
    599611
    600 #: includes/openid-connect-generic-settings-page.php:652
     612#: includes/openid-connect-generic-settings-page.php:660
    601613msgid "Log information about login attempts through OpenID Connect Generic."
    602614msgstr ""
    603615
    604 #: includes/openid-connect-generic-settings-page.php:667
     616#: includes/openid-connect-generic-settings-page.php:675
    605617msgid "Please enter a discovery URL."
    606618msgstr ""
    607619
    608 #: includes/openid-connect-generic-settings-page.php:676
     620#: includes/openid-connect-generic-settings-page.php:684
    609621msgid "Invalid discovery URL format."
    610622msgstr ""
    611623
    612 #: includes/openid-connect-generic-settings-page.php:687
     624#: includes/openid-connect-generic-settings-page.php:695
    613625msgid "Discovery URL must use HTTPS in production environments."
    614626msgstr ""
    615627
    616 #: includes/openid-connect-generic-settings-page.php:707
     628#: includes/openid-connect-generic-settings-page.php:715
    617629#. translators: %s: error message
    618630msgid "Failed to fetch discovery document: %s"
    619631msgstr ""
    620632
    621 #: includes/openid-connect-generic-settings-page.php:719
     633#: includes/openid-connect-generic-settings-page.php:727
    622634#. translators: %d: HTTP status code
    623635msgid "Discovery document request returned HTTP %d."
    624636msgstr ""
    625637
    626 #: includes/openid-connect-generic-settings-page.php:732
     638#: includes/openid-connect-generic-settings-page.php:740
    627639msgid "Discovery document is not valid JSON."
    628640msgstr ""
    629641
    630 #: includes/openid-connect-generic-settings-page.php:751
     642#: includes/openid-connect-generic-settings-page.php:759
    631643#. translators: %s: comma-separated list of missing fields
    632644msgid "Discovery document is missing required fields: %s"
    633645msgstr ""
    634646
    635 #: includes/openid-connect-generic-settings-page.php:815
     647#: includes/openid-connect-generic-settings-page.php:824
    636648msgid "Security check failed. Please try again."
    637649msgstr ""
    638650
    639 #: includes/openid-connect-generic-settings-page.php:859
     651#: includes/openid-connect-generic-settings-page.php:868
    640652#. translators: %d: number of fields populated
    641653msgid ""
    … …  
    648660msgstr[1] ""
    649661
    650 #: includes/openid-connect-generic-settings-page.php:886
     662#: includes/openid-connect-generic-settings-page.php:895
    651663msgid "Quick Setup: Import from Discovery Document"
    652664msgstr ""
    653665
    654 #: includes/openid-connect-generic-settings-page.php:890
     666#: includes/openid-connect-generic-settings-page.php:899
    655667msgid ""
    656668"Auto-populate endpoint settings from your identity provider's OpenID "
    … …  
    659671msgstr ""
    660672
    661 #: includes/openid-connect-generic-settings-page.php:898
     673#: includes/openid-connect-generic-settings-page.php:907
    662674msgid "Discovery URL"
    663675msgstr ""
    664676
    665 #: includes/openid-connect-generic-settings-page.php:910
     677#: includes/openid-connect-generic-settings-page.php:919
    666678msgid "Enter your identity provider's OpenID Connect discovery endpoint URL."
    667679msgstr ""
    668680
    669 #: includes/openid-connect-generic-settings-page.php:912
     681#: includes/openid-connect-generic-settings-page.php:921
    670682msgid "Examples:"
    671683msgstr ""
    672684
    673 #: includes/openid-connect-generic-settings-page.php:923
     685#: includes/openid-connect-generic-settings-page.php:932
    674686msgid "Load Configuration"
    675687msgstr ""
    676688
    677 #: openid-connect-generic.php:251
     689#: openid-connect-generic.php:252
    678690msgid "Private site"
    679691msgstr ""
    680692
    681 #: openid-connect-generic.php:281
     693#: openid-connect-generic.php:282
    682694msgid "OpenID Connect Generic - Security Configuration Required"
    683695msgstr ""
    684696
    685 #: openid-connect-generic.php:288
     697#: openid-connect-generic.php:289
    686698#. translators: %s is a link to the settings page
    687699msgid ""
    … …  
    691703msgstr ""
    692704
    693 #: openid-connect-generic.php:295
     705#: openid-connect-generic.php:296
    694706msgid ""
    695707"The current insecure fallback will be removed in version 3.12.0. After that "
    … …  
    697709msgstr ""
    698710
    699 #: openid-connect-generic.php:298
     711#: openid-connect-generic.php:299
    700712msgid "Common JWKS endpoints:"
    701713msgstr ""

  • daggerhart-openid-connect-generic/trunk/openid-connect-generic.php

    r3460363 r3460486  
    1717 * Plugin URI:        https://github.com/oidc-wp/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect identity provider using Authorization Code Flow.
    19  * Version:           3.11.2
     19 * Version:           3.11.3
    2020 * Requires at least: 5.0
    2121 * Requires PHP:      7.4
    … …  
    9494     * @var string
    9595     */
    96     const VERSION = '3.11.2';
     96    const VERSION = '3.11.3';
    9797
    9898    /**
    … …  
    160160            $this->settings->acr_values,
    161161            $this->settings->endpoint_jwks,
     162            $this->settings->issuer ?? '',
    162163            $this->settings->jwks_cache_ttl,
    163164            $this->get_state_time_limit( $this->settings ),

  • daggerhart-openid-connect-generic/trunk/readme.txt

    r3460363 r3460486  
    44Requires at least: 5.0
    55Tested up to: 6.9.0
    6 Stable tag: 3.11.2
     6Stable tag: 3.11.3
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    5050== Upgrade Notice ==
    5151
    52 = 3.11.2 =
     52= 3.11.3 =
    5353
    5454SECURITY UPDATE: 3.11.x branch - Fixes authentication vulnerabilities including JWT signature bypass and SSRF protection. Update immediately and configure JWKS endpoint in settings.
    5555
    5656== Changelog ==
     57
     58= 3.11.3 =
     59
     60* Feature/improvement: Added configurable issuer setting for JWT validation.
    5761
    5862= 3.11.2 =

  • daggerhart-openid-connect-generic/trunk/vendor/composer/installed.php

    r3460363 r3460486  
    22    'root' => array(
    33        'name' => 'daggerhart/openid-connect-generic',
    4         'pretty_version' => '3.11.2',
    5         'version' => '3.11.2.0',
    6         'reference' => '1810fffbabb261cd81108575ccfd186bd2495d86',
     4        'pretty_version' => '3.11.3',
     5        'version' => '3.11.3.0',
     6        'reference' => '0ef442c0f61bda837bddacec37b96035176bee27',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    2121        ),
    2222        'daggerhart/openid-connect-generic' => array(
    23             'pretty_version' => '3.11.2',
    24             'version' => '3.11.2.0',
    25             'reference' => '1810fffbabb261cd81108575ccfd186bd2495d86',
     23            'pretty_version' => '3.11.3',
     24            'version' => '3.11.3.0',
     25            'reference' => '0ef442c0f61bda837bddacec37b96035176bee27',
    2626            'type' => 'wordpress-plugin',
    2727            'install_path' => __DIR__ . '/../../',
Note: See TracChangeset for help on using the changeset viewer.