描述
Dorvis Auth allows your WordPress users to log in using the Dorvis OIDC provider. It supports the Authorization Code Flow with PKCE for secure authentication.
Features:
* “Authenticate with Dorvis” button on the login form.
* Automatic account creation on first sign-in, or link-only mode where users attach a Dorvis identity to an account they already have.
* Maps First Name and Last Name from OIDC claims.
* Optionally rejects username and password sign-in once everyone has linked.
* Configurable Client ID, Secret, Issuer URI and Redirect URI via Settings.
Privacy
安装
- Upload the
dorvis_authfolder to the/wp-content/plugins/directory. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- Go to Settings > Dorvis Auth.
- Enter your Client ID and Client Secret.
- Set the Issuer URI and the Redirect URI (must match your Dorvis OIDC configuration).
- Save changes.
The Redirect URI path must be routed to WordPress, so the site needs a permalink structure other than Plain.
常见问题
-
Where do I get my Client ID?
-
You must contact Dorvis support or use the demo credentials provided in the documentation.
-
How do I move an existing site to Dorvis sign-in?
-
Turn off Create accounts automatically. Existing users sign in with their password, open their profile and click Link Dorvis identity. The Users list shows who has linked. Once everyone has, turn on Disable password sign-in.
-
Can I link accounts in bulk instead of asking everyone to click?
-
Turn on Match accounts by personal code, then set the
dorvis_personal_codeuser meta field on each account to that person’s code, digits only with no dashes or spaces. Those users can sign in with Dorvis straight away. The Users list shows them as Pending until they first sign in, so a mistyped code is visible before anyone is locked out.Accounts that were already linked before the setting was turned on keep working, and their personal code is filled in the next time they sign in.
dorvis_personal_code is the only user meta field meant to be written by hand. Setting `dorvis_sub` directly also links an account, but the plugin then treats it as one it created and overwrites its name and public URL slug from Dorvis on the next sign-in. -
What if Dorvis is unreachable and password sign-in is disabled?
-
Define
DORVIS_AUTH_ALLOW_PASSWORD_LOGINas true inwp-config.php. -
Does this work alongside a two-factor authentication plugin?
-
No. Signing in with Dorvis establishes the WordPress session directly, so plugins that add a second factor to the username and password form are not part of that path. The second factor is whatever the Dorvis identity provider asks for.
-
What claims are mapped?
-
given_name and
family_namebecome the user’s name fields and display name, and the name also becomes the public URL slug.person_codeis stored as thedorvis_personal_codeuser meta field; it is never used as the username.This mapping is applied on every sign-in to accounts the plugin created. An account that already existed on the site when it was linked keeps the name and public URL slug the site gave it.
评价
此插件暂无评价。
贡献者及开发者
更新日志
0.3.0
- Added link-only mode and a link/unlink control on the user profile screen. Unlinking your own identity requires a password sign-in, so it cannot lock you out; an administrator can unlink another account either way.
- Added an option to reject password and application password sign-in, with a
wp-config.phpescape hatch. - Added a “Dorvis” column to the Users list.
- Added an option to identify accounts by personal code, which allows linking them in bulk. Off by default; while it is off the personal code is neither stored nor matched on.
- The ID token is validated and discarded rather than kept in user meta. Signing out clears the WordPress session, which is all there is to clear.
- The
personal_codeuser meta field written by 0.2.0 is renamed todorvis_personal_codeon upgrade, so it is read again and removed on uninstall rather than left behind. - Deleting the plugin now removes its settings, the user meta it wrote and its cached discovery data.
0.2.0
- Account usernames and profile URL slugs are now derived from the OIDC subject and the name claims.
- Discovery documents are cached per issuer, signing keys are cached and refreshed when validation fails, and token endpoint errors are surfaced to the user.
- The Issuer URI must now use https.
0.1.0
- Added PKCE, state and nonce protection to the authorization request.
- Added callback handling with state verification.
- Added ID token validation, discovery caching and logout.
0.0.2
- Added settings page.
- Improved user mapping logic.
0.0.1
- Initial release.