SOCA adds single sign-on to WordPress through an OpenID Connect provider that supports OAuth Client ID Metadata Documents (CIMD). It is developed by RESOAuth, starts with RESOAuth settings, and can be configured for another compatible provider. The plugin uses authorization code with PKCE and a signed client assertion. WordPress remains the application that receives the login; SOCA does not turn it into an authorization server.
- Publishes this site's client metadata and public signing keys through self-hosted URLs or a configurable HTTPS metadata proxy.
- Signs client assertions with encrypted, rotating P-256 keys and validates the provider's signed ID token.
- Applies email and domain admission rules to a verified provider email, then selects the matching local WordPress account. Optional creation is limited to Subscriber accounts.
- Provides a login button, a test-login flow, redacted diagnostics, WP-CLI maintenance commands, and a local-login recovery route.
Security decision: A provider that can verify an admitted administrator email can sign in as that administrator. Keep a local administrator login, review the admission rules, and test the provider before enabling automatic redirects. The browser's User-Agent is checked at callback, but it is not proof of the same browser.
Download the simple-oauth-cimd-access-0.2.0.zip release asset when published or build it with python3 tools/build.py. In WordPress, choose Plugins → Add Plugin → Upload Plugin, activate SOCA, then open Settings → SOCA. It requires WordPress 6.8+, PHP 8.1+, OpenSSL, cURL, and a public HTTPS site for self-hosted metadata. The installable ZIP contains its runtime dependency; Composer is not needed on the server.
- Keep a working local administrator password and bookmark
/wp-login.php?soca_local=1. - Review the configured issuer, provider name, client metadata mode, and exact admission rules. Defaults use
https://auth.resoauth.cloud. - Run Validate connection and documents, then Test login. A document check alone does not establish successful provider login.
- Enable automatic redirection only after a successful real login and recovery check.
The initial identity provider is the RESOAuth hosted Smart Access Gateway, operated by RESOAuth Ltd at https://auth.resoauth.cloud. Its connection guide, privacy notice, and terms of service describe the hosted service. Local development defaults to RESOAuth Dynamic CIMD for public client metadata. The live RESOAuth end-user login remains unverified in the recorded test results. Synthetic provider, WordPress integration, and browser flows have been tested; no certification is claimed. See the operator guide for setup, recovery, rotation, proxy behavior, and WP-CLI commands.
- Operator guide
- Local development and build
- Security and protocol decisions
- Interoperability evidence and standards
- Test procedures and results
- WordPress.org Plugin Check review
- Release history
- Directory release notes
- Issues and support
The WordPress.org listing readme describes the default external services and data flow. Site operators are responsible for the configured identity provider's terms and privacy information. The source, tooling, and plugin are licensed under AGPL-3.0-only; the bundled firebase/php-jwt library retains its BSD-3-Clause license.