WordPress.org
Get WordPress

Plugin Directory

Changeset 3458536


Ignore:
Timestamp:
02/10/2026 10:58:40 PM (7 weeks ago)
Author:
daggerhart
Message:

Update to version 3.10.4 from GitHub

Location:
daggerhart-openid-connect-generic
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • daggerhart-openid-connect-generic/tags/3.10.4/includes/openid-connect-generic-client-wrapper.php

    r3454892 r3458536  
    441441
    442442        if ( is_wp_error( $authentication_request ) ) {
     443            // Check if this is a retryable IDP error (e.g. Safari ITP causing
     444            // Keycloak session cookies to be blocked on cross-site navigation).
     445            $retryable_idp_errors = array(
     446                'temporarily_unavailable',
     447                'authentication_expired',
     448                'login_required',
     449            );
     450
     451            $error_code = $authentication_request->get_error_code();
     452            $is_retryable = in_array( $error_code, $retryable_idp_errors, true );
     453            $already_retried = isset( $_GET['openid-connect-generic-retry'] );
     454
     455            if ( $is_retryable && ! $already_retried ) {
     456                // Log the original error before retrying.
     457                $this->logger->log( $authentication_request, 'retry' );
     458                $this->logger->log( "Retrying authentication due to IDP error: {$error_code}", 'retry' );
     459
     460                // Build a fresh authentication URL and append a retry flag
     461                // to prevent infinite redirect loops (max 1 retry).
     462                $auth_url = $this->get_authentication_url();
     463                $auth_url = add_query_arg( 'openid-connect-generic-retry', '1', $auth_url );
     464
     465                wp_redirect( $auth_url );
     466                exit;
     467            }
     468
    443469            $this->error_redirect( $authentication_request );
    444470        }
    … …  
    727753     */
    728754    public function get_user_by_identity( $subject_identity ) {
     755        global $wpdb;
     756
    729757        // Look for user by their openid-connect-generic-subject-identity value.
    730758        $user_query = new WP_User_Query(
    731759            array(
    732760                'meta_query' => array(
     761                    'relation' => 'OR',
    733762                    array(
    734763                        'key'   => 'openid-connect-generic-subject-identity',
     764                        'value' => $subject_identity,
     765                    ),
     766                    array(
     767                        'key'   => $wpdb->get_blog_prefix() . 'openid-connect-generic-subject-identity',
    735768                        'value' => $subject_identity,
    736769                    ),

  • daggerhart-openid-connect-generic/tags/3.10.4/includes/openid-connect-generic-client.php

    r3454892 r3458536  
    163163        // Look for an existing error of some kind.
    164164        if ( isset( $request['error'] ) ) {
    165             return new WP_Error( 'unknown-error', 'An unknown error occurred.', $request );
     165            $error_code = sanitize_text_field( $request['error'] );
     166            $error_message = 'An unknown error occurred.';
     167
     168            // Use the IDP's error description if available for better diagnostics.
     169            if ( ! empty( $request['error_description'] ) ) {
     170                $error_message = sprintf(
     171                    'IDP error %s: %s',
     172                    $error_code,
     173                    sanitize_text_field( $request['error_description'] )
     174                );
     175            }
     176
     177            return new WP_Error( $error_code, $error_message, $request );
    166178        }
    167179

  • daggerhart-openid-connect-generic/tags/3.10.4/openid-connect-generic.php

    r3454892 r3458536  
    1717 * Plugin URI:        https://github.com/oidc-wp/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect identity provider using Authorization Code Flow.
    19  * Version:           3.10.3
     19 * Version:           3.10.4
    2020 * Requires at least: 5.0
    2121 * Requires PHP:      7.4
    … …  
    6060  Callable actions
    6161
    62   User Meta
    63   - openid-connect-generic-subject-identity    - the identity of the user provided by the idp
    64   - openid-connect-generic-last-id-token-claim - the user's most recent id_token claim, decoded
    65   - openid-connect-generic-last-user-claim     - the user's most recent user_claim
    66   - openid-connect-generic-last-token-response - the user's most recent token response
     62  User Meta (since v3.10.4 prefixed with the blog database prefix, for example wp_2_openid-connect-generic-subject-identity)
     63  - [[BLOG_DB_PREFIX]]openid-connect-generic-subject-identity    - the identity of the user provided by the idp
     64  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-id-token-claim - the user's most recent id_token claim, decoded
     65  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-user-claim     - the user's most recent user_claim
     66  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-token-response - the user's most recent token response
    6767
    6868  Options
    … …  
    9494     * @var string
    9595     */
    96     const VERSION = '3.10.3';
     96    const VERSION = '3.10.4';
    9797
    9898    /**

  • daggerhart-openid-connect-generic/tags/3.10.4/readme.txt

    r3454892 r3458536  
    44Requires at least: 5.0
    55Tested up to: 6.9.0
    6 Stable tag: 3.10.3
     6Stable tag: 3.10.4
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    5050
    5151== Changelog ==
     52
     53= 3.10.4 =
     54
     55* Fix issue with finding users on multisite after switch to user options in place of user meta.
     56* Improvement: Retry logins for some IDP errors to bypass issue with Safari ITP. Also improves display of error messages that come from the IDP.
    5257
    5358= 3.10.3 =

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client-wrapper.php

    r3454892 r3458536  
    441441
    442442        if ( is_wp_error( $authentication_request ) ) {
     443            // Check if this is a retryable IDP error (e.g. Safari ITP causing
     444            // Keycloak session cookies to be blocked on cross-site navigation).
     445            $retryable_idp_errors = array(
     446                'temporarily_unavailable',
     447                'authentication_expired',
     448                'login_required',
     449            );
     450
     451            $error_code = $authentication_request->get_error_code();
     452            $is_retryable = in_array( $error_code, $retryable_idp_errors, true );
     453            $already_retried = isset( $_GET['openid-connect-generic-retry'] );
     454
     455            if ( $is_retryable && ! $already_retried ) {
     456                // Log the original error before retrying.
     457                $this->logger->log( $authentication_request, 'retry' );
     458                $this->logger->log( "Retrying authentication due to IDP error: {$error_code}", 'retry' );
     459
     460                // Build a fresh authentication URL and append a retry flag
     461                // to prevent infinite redirect loops (max 1 retry).
     462                $auth_url = $this->get_authentication_url();
     463                $auth_url = add_query_arg( 'openid-connect-generic-retry', '1', $auth_url );
     464
     465                wp_redirect( $auth_url );
     466                exit;
     467            }
     468
    443469            $this->error_redirect( $authentication_request );
    444470        }
    … …  
    727753     */
    728754    public function get_user_by_identity( $subject_identity ) {
     755        global $wpdb;
     756
    729757        // Look for user by their openid-connect-generic-subject-identity value.
    730758        $user_query = new WP_User_Query(
    731759            array(
    732760                'meta_query' => array(
     761                    'relation' => 'OR',
    733762                    array(
    734763                        'key'   => 'openid-connect-generic-subject-identity',
     764                        'value' => $subject_identity,
     765                    ),
     766                    array(
     767                        'key'   => $wpdb->get_blog_prefix() . 'openid-connect-generic-subject-identity',
    735768                        'value' => $subject_identity,
    736769                    ),

  • daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client.php

    r3454892 r3458536  
    163163        // Look for an existing error of some kind.
    164164        if ( isset( $request['error'] ) ) {
    165             return new WP_Error( 'unknown-error', 'An unknown error occurred.', $request );
     165            $error_code = sanitize_text_field( $request['error'] );
     166            $error_message = 'An unknown error occurred.';
     167
     168            // Use the IDP's error description if available for better diagnostics.
     169            if ( ! empty( $request['error_description'] ) ) {
     170                $error_message = sprintf(
     171                    'IDP error %s: %s',
     172                    $error_code,
     173                    sanitize_text_field( $request['error_description'] )
     174                );
     175            }
     176
     177            return new WP_Error( $error_code, $error_message, $request );
    166178        }
    167179

  • daggerhart-openid-connect-generic/trunk/openid-connect-generic.php

    r3454892 r3458536  
    1717 * Plugin URI:        https://github.com/oidc-wp/openid-connect-generic
    1818 * Description:       Connect to an OpenID Connect identity provider using Authorization Code Flow.
    19  * Version:           3.10.3
     19 * Version:           3.10.4
    2020 * Requires at least: 5.0
    2121 * Requires PHP:      7.4
    … …  
    6060  Callable actions
    6161
    62   User Meta
    63   - openid-connect-generic-subject-identity    - the identity of the user provided by the idp
    64   - openid-connect-generic-last-id-token-claim - the user's most recent id_token claim, decoded
    65   - openid-connect-generic-last-user-claim     - the user's most recent user_claim
    66   - openid-connect-generic-last-token-response - the user's most recent token response
     62  User Meta (since v3.10.4 prefixed with the blog database prefix, for example wp_2_openid-connect-generic-subject-identity)
     63  - [[BLOG_DB_PREFIX]]openid-connect-generic-subject-identity    - the identity of the user provided by the idp
     64  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-id-token-claim - the user's most recent id_token claim, decoded
     65  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-user-claim     - the user's most recent user_claim
     66  - [[BLOG_DB_PREFIX]]openid-connect-generic-last-token-response - the user's most recent token response
    6767
    6868  Options
    … …  
    9494     * @var string
    9595     */
    96     const VERSION = '3.10.3';
     96    const VERSION = '3.10.4';
    9797
    9898    /**

  • daggerhart-openid-connect-generic/trunk/readme.txt

    r3454892 r3458536  
    44Requires at least: 5.0
    55Tested up to: 6.9.0
    6 Stable tag: 3.10.3
     6Stable tag: 3.10.4
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    5050
    5151== Changelog ==
     52
     53= 3.10.4 =
     54
     55* Fix issue with finding users on multisite after switch to user options in place of user meta.
     56* Improvement: Retry logins for some IDP errors to bypass issue with Safari ITP. Also improves display of error messages that come from the IDP.
    5257
    5358= 3.10.3 =
Note: See TracChangeset for help on using the changeset viewer.