[Feature Request] Save Additional User Fields from OIDC Provider

[tnlong311]

Current Behavior:

The OpenID Connect Generic plugin currently maps basic user information (like username and email) retrieved from the OIDC provider to the corresponding WordPress user account fields.

Here's an example of the code snippet in openid-connect-generic-client-wrapper.php that creates a new user:

   $user_data = array(
     'user_login' => $username,
     'user_pass' => wp_generate_password( 32, true, true ),
     'user_email' => $email,
     'display_name' => $displayname,
     'nickname' => $nickname,
     'first_name' => isset( $user_claim['given_name'] ) ? $user_claim['given_name'] : '',
     'last_name' => isset( $user_claim['family_name'] ) ? $user_claim['family_name'] : '',
   );
   $user_data = apply_filters( 'openid-connect-generic-alter-user-data', $user_data, $user_claim );


   // Create the new user.
   $uid = wp_insert_user( $user_data );

Desired Feature:

I want to propose a new feature that allows the plugin to save additional user fields obtained during the OIDC login process. This would enable us to store additional custom data within the WordPress user database.
For example, I'd like to capture a user's payment_token from the OIDC provider's user table and save it as a custom user field in WordPress.

Benefits:

• Enhanced User Data: By storing additional user information from the OIDC provider, we can unlock new functionalities or integrations within WordPress.
• Improved Flexibility: This feature would allow us to tailor the plugin to our specific needs by saving custom user fields relevant to our application.

Proposed Implementation:

Introduce a new configuration option within the plugin settings named additional_user_fields. This option would accept data as a key-value map:

• Keys: These represent the OIDC user claim names (attribute names) containing the desired information you want to save.
• Values: These represent the corresponding desired WordPress user meta field names where the data should be saved.

Implementation Flow:

1. During the OIDC login process, the plugin would retrieve user claims from the OIDC provider.
2. The plugin would check for the existence of the configured keys (OIDC claim names) within the retrieved user claims.
3. If a key (OIDC claim name) exists in the user claims and a corresponding value (desired WordPress user meta field name) exists in the additional_user_fields map, the plugin would perform the following steps:

• Extract the value from the corresponding OIDC claim.
• Save the extracted value as a custom user meta field in the WordPress user database using the configured value (user meta field name) from the map.

Example Configuration:

additional_user_fields = {
    "customer_id": "wp_oidc_customer_id",
    "payment_token": "wp_oidc_payment_token"
}

Advantages:

This approach provides a flexible way to define the mapping between OIDC user attributes and WordPress user meta fields. It leverages existing functionalities within the plugin to handle user claims and user meta data.

—

I believe that this feature would significantly enhance the plugin's capabilities and value for users with diverse use cases. I would like to hear the community feedback on the feasibility and potential improvements for this feature request.

[tnlong311]

Since I'm using this plugin for my company's project, I'm willing to contribute by implementing this feature request. Thank you.

[timnolte]

So, while I'm not opposed to considering something like this the plugin can already be used to accomplish this by leveraging the hooks that plugin provides that will allow you to save additional data.

https://github.com/oidc-wp/openid-connect-generic/wiki/Hooks---Actions-&-Filters#openid-connect-generic-update-user-using-current-claim

Additionally, there is a filter which can also be used to create your own plugin settings fields of you want something to be configurable and not hard-coded.

https://github.com/oidc-wp/openid-connect-generic/wiki/Hooks---Actions-&-Filters#openid-connect-generic-settings-fields

You can see an example of using these in a MU Plugin I created that maps IDP groups to WordPress roles here:

https://github.com/timnolte/oidc-keycloak-sso/blob/main/oidc-keycloak-custom.php

[tnlong311]

Thank you @timnolte for your helpful guide!

As I understand, are you suggesting that I can extend the plugin in my own folk, using the hooks and setting fields, to accomplish this feature?

[timnolte]

Yes, there really is no need to change the plugin itself you can just create either your own plugin, or just a Must Use Plugin, with the code using the hooks I mentioned.

[tnlong311]

I got it, thank you!

[tnlong311]

Besides, I'm following this guideline to setup local development environment but it doesn't work. I think that the wiki is outdated since the package.json file has changed. Can you kindly add more guide to this? Thank you.
https://github.com/oidc-wp/openid-connect-generic/wiki/How-to-setup-the-plugin-development-environment

[tnlong311]

How do I continue from here, like how to run the project and see the changes I made to the code? Sorry I'm a junior developer so there are still many things I don't understand clearly

[tnlong311]

Ah I found the wordpress project is running on port localhost:8080.

I logged in to php admin in port 8081 using the user and password in docker-compose.yml file. However, I use the password and user in the wp_users table to login into http://localhost:8080/wp/wp-login.php but it doesn't work

[timnolte]

The local admin user is created here:

https://github.com/oidc-wp/openid-connect-generic/blob/develop/.devcontainer%2Fsetup.sh#L34

You can't use the password value you see in the database as that is hashed.

[tnlong311]

I think i tried to change the password on the php admin so now I cannot log in anymore

[timnolte]

Ah, yeah, you can't edit the table directly like that.

I'd highly recommend you just work on developing your own code for your project with the plugin installed in the site you need this on. I'm not sure how you are managing your WordPress sites but you could get a local copy of your site going and then just create a simple Must Use Plugin to write your code for the site that leverages the hooks we provide.