Skip to main content
Version: v1

Integrate Beyond Identity Passwordless Authentication into Wordpress

This guide provides information on how to set up Beyond Identity as a passwordless authentication provider for a Wordpress site.

This guide will cover:

  • How to configure Beyond Identity as an Identity Provider
  • How to install the required Wordpress plugins to support an OpenID Connect (OIDC) integration
  • How to configure the OIDC Wordpress plugin

Prerequisites​

Before continuing, make sure that the following prerequisites have been met:

  • Ensure that you have a live Wordpress site running and administrator privileges to install and configure a plugin
  • Access to a Beyond Identity tenant and its admin console. If necessary, sign up for a tenant at https://www.beyondidentity.com/developers/signup

Set up Beyond Identity as an Identity Provider​

Create a Realm and Application in Beyond Identity​

Create a Realm​

We need to create a new Realm to hold identities and configuration:

From the Admin Console:

  1. Click the Realm selector on the top-left.
  2. Click Create New Realm.
  3. Type the name of your new realm. Click Create Realm.
  4. Click Switch to Realm.
  5. From the Realm's Home page, click Edit.

Create an Application​

Next, we we'll create a new Application that contains the configuration for your end users:

From the Admin Console:

  1. From the navigation bar, click Applications, then click Add app.
  2. Type a name for your new Application.
  3. Scroll to Redirect URIs, type http://localhost/dummy_url.
  4. Ensure "Token Endpoint Auth Method" is set to "Client Secret Post".
  5. Ensure "Subject" is set to "id".
  6. Verify that "PKCE" is disabled.
  7. Click on the Authenticator Config tab, change the Configuration Type to Hosted Web.
  8. Click Submit to save your changes.

We will overwrite the Redirect URI value later in this process, so you can use the dummy value for now.

At this point, your Beyond Identity Admin Console should be configured with a realm and an application set up.

Application

application-config

Authenticator

authenticator-config

Create an Identity in the BI console​

We will create identities that can login to the Wordpress site here, and enroll them with a BI credential bound to their device.

  1. In the BI Admin console, click "Identities"
  2. If the user you wish to use already exists, skip to step 5.
  3. Click "Add identity"
  4. Input the desired Name, Username, and Email (All three are required)
  5. Next, we will send the user an enrollment email to bind a credential to their device.
  6. Follow the steps at Send Enrollment Emails for each new identity. In the near future, this will become a push-button operation, but for now it involves sending commands via CURL.
  7. Each new identity will receive an Enrollment email, which they click on to bind a credential to their device (desktop, laptop, mobile, etc).

Configure Wordpress for OIDC​

Install the free Plugin​

This guide is based on the popular OpenID Connect Generic Client which is regularly updated and has many thousands of Active installations.

This will require administrative privileges on your Wordpress installation.

Follow the installation steps specified in the OpenID Connect Generic Client Installation Guide

Configure the plugin​

These steps will help you configure the plugin to use with Beyond Identity.

  1. Log into you Wordpress admin console
  2. Keep the Beyond Identity Admin Console open in another tab or window to copy and paste values in
  3. In the Wordpress admin console, go to Settings -> OpenID Connect Client
  4. For "Login Type", set "OpenID Connect button on login form"
  5. For "Client ID", copy and paste the value from Applications -> Your New Application -> External Protocol -> Client ID
  6. For "Client Secret Key", copy and paste the value from Applications -> Your New Application -> External Protocol -> Client Secret
  7. For "OpenID Scope", paste in "email profile openid"
  8. For "Login Endpoint URL", copy and paste the value from Applications -> Your New Application -> External Protocol -> Authorization Endpoint
  9. For "Userinfo Endpoint URL", copy and paste the value from Applications -> Your New Application -> External Protocol -> User Info Endpoint
  10. For "Token Validation Endpoint URL", copy and paste the value from Applications -> Your New Application -> External Protocol -> Token Endpoint
  11. Leave "End Session Endpoint URL" blank
  12. Leave "ACR values" blank
  13. For "Identity Key", use 'sub'
  14. For "Nickname Key", use 'sub'
  15. Click the checkbox beside "Enable Logging" to give a better ability to debug any issues.
  16. Leave all other settings with the defaults. You are free to change them, but ymmv as some may have unpredictable results.
  17. Click "Save Changes"

plugin-configuration

Add the redirect URL to the BI console​

The Beyond Identity web authenticator needs to know where to redirect the user after a successful authentication.

  1. From the Wordpress admin console -> Settings -> OpenID Connect Client , under the "Notes" section, copy the Redirect UI
  2. On the BI Admin console, under Applications -> Your new application -> Redirect URIs, paste the URL from the first step
  3. Hit "Submit" at the bottom of the page.

Congratulations, you have configured the BI console and the OIDC client plugin.

Try logging in​

We will now attempt to log in and verify successful authentication.

  1. Using a device where you have created an identity and then enrolled a credential, Visit http://your_hostname/wp-login.php to login
  2. You will see a "Login with OpenID Connect" button. Click it.
  3. You will be redirected to the Beyond Identity Web Authenticator.
  4. You may see a step-up authentication prompt, depending on how Policy is set up for your tenant.
  5. At the conclusion of a successful authentication, you will be redirected to your wordpress console, and
  6. You will see several successful authentication events in BI Admin Console -> Events