miniOrange Configuration:

1. Go to Settings → miniOrange OAuth → Configure OAuth
2. Select “Keycloak” from the application dropdown
3. Enter your configuration:
   • Client ID: Your Keycloak client ID
   • Client Secret: From Keycloak credentials tab
   • Scope: openid email profile roles
4. Configure endpoints (auto-populated for Keycloak)
5. Set up attribute mapping:
   • Username: preferred_username
   • Email: email
   • First Name: given_name
   • Last Name: family_name
6. Configure role mapping in the Role Mapping tab

Redirect URI for Keycloak:

https://your-site.com/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/mo_oauth_callback.php

Add this URL to your application’s Redirect URIs in Skycloak’s Applications page.

OpenID Connect Generic Configuration:

1. Go to Settings → OpenID Connect Generic
2. Enter your configuration:
   • Client ID: Your Keycloak client ID
   • Client Secret: From Keycloak credentials tab
   • OpenID Scope: openid email profile
3. Configure endpoints:
   • Login Endpoint: https://your-keycloak/realms/your-realm/protocol/openid-connect/auth
   • Userinfo Endpoint: https://your-keycloak/realms/your-realm/protocol/openid-connect/userinfo
   • Token Endpoint: https://your-keycloak/realms/your-realm/protocol/openid-connect/token
   • End Session Endpoint: https://your-keycloak/realms/your-realm/protocol/openid-connect/logout

Redirect URIs — Add to Skycloak:

The OpenID Connect Generic plugin uses two possible callback URLs. Add both to your application’s Redirect URIs in Skycloak to avoid invalid_redirect_uri errors:

Important: Add both URIs to be safe. If you only add one, make sure it matches the mode your plugin is using. The most common mistake is adding only the alternate URI while the plugin is still using the default.

Production Configuration:

For production environments, use constants in wp-config.php:

// OpenID Connect Generic Plugin
define('OPENID_CONNECT_CLIENT_ID', 'your-client-id');
define('OPENID_CONNECT_CLIENT_SECRET', 'your-client-secret');
define('OPENID_CONNECT_SCOPE', 'openid email profile');
define('OPENID_CONNECT_LOGIN_ENDPOINT_URL', 'https://keycloak/realms/realm/protocol/openid-connect/auth');
define('OPENID_CONNECT_USERINFO_ENDPOINT_URL', 'https://keycloak/realms/realm/protocol/openid-connect/userinfo');
define('OPENID_CONNECT_TOKEN_VALIDATION_ENDPOINT_URL', 'https://keycloak/realms/realm/protocol/openid-connect/token');
define('OPENID_CONNECT_END_SESSION_ENDPOINT_URL', 'https://keycloak/realms/realm/protocol/openid-connect/logout');

// Security hardening
define('FORCE_SSL_ADMIN', true);
define('FORCE_SSL_LOGIN', true);

miniOrange Plugin:

Role mapping is handled through the plugin’s UI:

1. Go to Settings → miniOrange OAuth → Role Mapping
2. Map Keycloak roles to WordPress roles:
   • admin → Administrator
   • editor → Editor
   • author → Author
   • user → Subscriber

OpenID Connect Generic:

Add this code to your theme’s functions.php:

add_action('openid-connect-generic-update-user-using-current-claim', function($user, $user_claim) {
    if (!empty($user_claim['realm_access']['roles'])) {
        $roles = $user_claim['realm_access']['roles'];
        
        if (in_array('wordpress-admin', $roles)) {
            $user->set_role('administrator');
        } elseif (in_array('wordpress-editor', $roles)) {
            $user->set_role('editor');
        } elseif (in_array('wordpress-author', $roles)) {
            $user->set_role('author');
        } elseif (in_array('wordpress-contributor', $roles)) {
            $user->set_role('contributor');
        } else {
            $user->set_role('subscriber');
        }
    }
}, 10, 2);

Shortcode Integration:

Add SSO login to any page or post:

<!-- OpenID Connect Generic -->
[openid_connect_generic_login_button]

<!-- miniOrange (use plugin's shortcode generator) -->
[miniorange_sso_login]

PHP Integration:

Add to your theme templates:

<?php if (function_exists('openid_connect_generic_login_button')): ?>
    <div class="sso-login">
        <h3>Login with SSO</h3>
        <?php echo openid_connect_generic_login_button(); ?>
    </div>
<?php endif; ?>

Direct URL:

Create custom login links:

<a href="/wp-admin/admin-ajax.php?action=openid-connect-authorize" class="sso-login-btn">
    Login with Keycloak
</a>

“Invalid Client” Error:

• ✅ Verify client ID and secret are correct
• ✅ Check client authentication is enabled in Keycloak
• ✅ Ensure no extra spaces in credentials
• ✅ Verify client exists in the correct realm
• ✅ Check client is not disabled

Debug Steps:

# Test client credentials
curl -X POST \
  https://your-keycloak/realms/your-realm/protocol/openid-connect/token \
  -d "grant_type=client_credentials" \
  -d "client_id=your-client-id" \
  -d "client_secret=your-client-secret"

Redirect URI Mismatch:

• ✅ Copy exact callback URL from WordPress plugin settings
• ✅ Add it to Keycloak’s Valid Redirect URIs
• ✅ Check for HTTP vs HTTPS mismatches
• ✅ Verify URL path is exactly correct
• ✅ Include both callback and logout URLs

Common Callback URLs:

# miniOrange
https://your-site.com/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/mo_oauth_callback.php

# OpenID Connect Generic
https://your-site.com/wp-admin/admin-ajax.php?action=openid-connect-authorize
https://your-site.com/openid-connect-authorize

Most common cause: Adding only one redirect URI when the plugin expects another. For the OpenID Connect Generic plugin, the default callback URL includes query parameters (?action=openid-connect-authorize). If you enabled “Alternate Redirect URI” in the plugin but didn’t update your Skycloak redirect URIs (or vice versa), the URLs won’t match.

Quick fix: Add both redirect URIs to your application in Skycloak:

https://your-site.com/wp-admin/admin-ajax.php?action=openid-connect-authorize
https://your-site.com/openid-connect-authorize

SSL Certificate Issues:

• ✅ Ensure complete certificate chain is installed
• ✅ Check WordPress can reach Keycloak HTTPS endpoints
• ✅ Verify system time synchronization
• ✅ Test certificate validity

Debug Commands:

# Test SSL connection
openssl s_client -connect your-keycloak:443 -servername your-keycloak

# Check certificate
curl -I https://your-keycloak/auth/realms/your-realm/.well-known/openid-configuration

# Test from WordPress server
wp eval "echo file_get_contents('https://your-keycloak/auth/realms/your-realm/.well-known/openid-configuration');"

Missing User Attributes:

• ✅ Verify required scopes are configured (openid, email, profile)
• ✅ Check Keycloak user has all attributes populated
• ✅ Review attribute mappings in both systems
• ✅ Test with token introspection

Attribute Mapping:

Keycloak → WordPress
preferred_username → user_login
email → user_email
given_name → first_name
family_name → last_name
name → display_name

Security Review:

• ✅ All credentials stored securely (not in database)
• ✅ SSL/TLS properly configured
• ✅ Role mappings audited and tested
• ✅ Redirect URIs restricted to necessary paths
• ✅ Security headers enabled
• ✅ WordPress and plugins updated
• ✅ Monitoring and alerting configured

// Security hardening checklist
define('FORCE_SSL_ADMIN', true);
define('FORCE_SSL_LOGIN', true);
define('DISALLOW_FILE_EDIT', true);
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', false);
define('WP_DEBUG_DISPLAY', false);

Performance Optimization:

• ✅ Caching configured (Redis/Memcached)
• ✅ Database queries optimized
• ✅ CDN configured for static assets
• ✅ Session storage optimized
• ✅ Token lifetimes configured appropriately

// Performance settings
define('WP_CACHE', true);
define('WP_REDIS_HOST', 'localhost');
define('WP_REDIS_PORT', 6379);

// Session configuration
ini_set('session.gc_maxlifetime', 1800); // 30 minutes

Backup Strategy:

• ✅ WordPress files and database backed up
• ✅ Configuration files backed up
• ✅ Keycloak realm configuration exported
• ✅ Rollback procedures documented
• ✅ Emergency access plan created

# Backup WordPress
wp db export backup.sql
tar -czf wp-backup.tar.gz wp-content/

# Backup Keycloak realm
./kcadm.sh get realms/your-realm > realm-backup.json

Testing Checklist:

• ✅ SSO login works for all user types
• ✅ Role mapping functions correctly
• ✅ User attributes sync properly
• ✅ Logout works (single logout)
• ✅ Error handling works correctly
• ✅ Performance under load tested

# Load testing
ab -n 1000 -c 10 https://your-site.com/wp-login.php

# Security testing
nmap -sS -sV your-site.com