Use a dedicated openid client library

[drzraf]

OpenID provides pointers to existing implementations:

• https://github.com/openid/php-openid
  • for both server and client
  • Apache-licensed
  • tests
  • maintained.
• https://github.com/jumbojett/OpenID-Connect-PHP
  • client-only
  • Apache-licensed
  • simple
  • maintained

It may be worth considering whether client code advantageously replace the OpenID-aspects of current one (session refresh, endpoint autodetection, ...)

[daggerhart]

@drzraf Thanks for this. I agree, and will add this consideration to the 4.x roadmap

[spikyjt]

I would second this in principal, but would hardly consider php-openid "maintained" - last release in 2015, last commit over a year ago!

The jumbojett client looks promising, but is not compliant with the standard yet.

OpenId Connect clients for PHP seem to be woefully lacking!

[drzraf]

This is way better https://github.com/thephpleague/oauth2-client

[spikyjt]

That's a very mature library, but important to note that it is OAuth2, not specifically OpenId Connect.

[yrammos]

@spikyjt @drzraf generic OAuth2 support would be doubly good to have.

[spikyjt]

@yrammos is generic OAuth2 a good idea for this plugin? It's title suggests it is specifically OpenId Connect. I think there a plenty of OAuth2 libs and plugins, but OpenId Connect has very specific requirements and is distinctly about authentication, when OAuth2 is just authorization.

@daggerhart would be good to know your thoughts

[yrammos]

@spikyjt I'm sorry for my elliptical comment, which warrants your question. You see, there is no open-source or even reasonably-priced OAuth2 client for WordPress right now and this is the closest project that I was able to locate. If it is outside your purview, of course, I'll have to rest my case… Thanks.

[spikyjt]

@yrammos no apology needed! I wasn't aware Wordpress was lacking this, as there are so many PHP libs for OAuth2, I assumed there must be a plugin. Anyway, the question is really for @daggerhart who owns this project and can decide what his intentions for it are/were.

[timnolte]

https://github.com/openid/php-openid has been updated in the last 4-5 months so it does seem to still be maintained.

[timnolte]

Unfortunately, the openid/php-openid package appears to be no longer maintained. It still seems like https://packagist.org/packages/jumbojett/openid-connect-php is probably the best solution so long as it continues to get updates.

[timnolte]

Doing some general Packagist searching it's possible that this Yii package might be able to be leveraged.

https://github.com/yiisoft/yii2-authclient

It has way more functionality in it beyond what this plugin is intended to provide so I'm not sure it's the right fit or not.

[drzraf]

https://oauth2-client.thephpleague.com/