custom redirects and override

[prasadajith]

Context:
(i) I am using keycloak for SSO
(ii) my wordpress website has both public and private areas

Current Behaviour:
(i) from public area if i click on sign in > sso login form > Keycloak authenticates> Redirects back to mydomain.in/wp-admin
(ii) if user tries to access private area of site > sso login form > Keycloack authenticates > Redirects back to mydomain.in/slug user was trying to access

Desired Behaviour:
(i) from public area if i click on sign in > sso login form > Keycloak authenticates> Redirects back to mydomain.in/mypage
not to wp-admin

What i have tried and failed:

(i) redirect code in functions php of child theme
(ii) redirect plugins (if i disable openid connect plugin, the redirect plugins work as expected)
(iii) both enabled and disabled states for default wordpress in openid connect settings (there is no change in behaviour)
(iv) tried custom redirect url option in the settings of openid connect (no change in behaviour)

Observation:
Openid connect settings overrides all other redirect for logged in users

how can i achieve this?
(i) from public area if i click on sign in > sso login form > Keycloak authenticates> Redirects back to mydomain.in/mypage
not to wp-admin

Is there a way to give custom redirect url other than pointing it to wp-admin on login?

thanks

[prasadajith]

i solved the issue by editing line 162 and 158 .. changed it to $redirect_url = home_url('mypage')

A suggestion for next version of the plugin... make this a configurable attribute in the settings page...

hope this will be a useful info

[timnolte]

You shouldn't be editing the plugin. Did you try using the intended hook as I mentioned?

[timnolte]

I'm not quite clear on why someone would be logging in if it is a public area? The intention of the plugin for SSO when you go to the WordPress login form is that you are logging into the WordPress Dashboard. All of that aside have you tried using the ...redirect-user-back hook? https://github.com/oidc-wp/openid-connect-generic/blob/dev/HOWTO.md#openid-connect-generic-redirect-user-back

That hook should allow you to send the users where you want them to go based on where their original redirect was set to.

[timnolte]

Also, another note about 8t not working with other redirect plugins, that is typical as rarely are you going to find multiple plugins that are managing any sort of redirects to play well with each other. In the case of this plugin the redirection is rightly coupled with the IDP authentication.

[prasadajith]

i generally do not use redirect plugins... role based redirections and authentication flows are managed from keycloak... i was trying to use redirect plugin for the problem i was facing... i also prefer not to add filters and actions in function.php of child themes.. prefer configurations be done through a UI..

There might be scenarios redirections from within applications are needed... example: role + users action choice / input will create a unique context, which may require a redirect which cannot be determined by IDP authentication... in such scenarios sign on process cannot override redirects within application

[timnolte]

So let my clarify a couple of things.

First custom code, like the hooks this plugin provides, should never go in the theme functions.php. This is where there is a ton of incorrect information out on the internet. This sort of code would be in a Must Use Plugin. That is a special kind of plugin that also can't just be disabled by a user. I will caution that simply building sites through configuration via a UI is rarely going to give you the best results. And as I've mentioned this plugin provides a basic set of settings through a UI but then also provides that capability for developers to further enhance those setting using their own customization. We could possibly start building up the hooks and filters documentation to help provide more examples of using these capabilities based in questions that have already been asked. Perhaps even setup a set of contribution "add-ons" that you might easily drop into your site as a starting point to add the extra UI settings that you would like.

The second point is that the redirection is being maintained along with the state that is generated when the user uses a login button. This state is sent to the IDP and then back to the WordPress site for verification. This change is a standard best practice for the OpenID Connect spec. However, the need to be able to adjust where users end up is why we provide the hooks and filters to allow changing these based on whatever business logic is needed. The way you are using the plugin and need the redirection changed is not necessarily going to be how someone else expects or wants it to work.

[timnolte]

@prasadajith if I put together an add-on module to assist with adding the functionality you need in the UI would you be willing to test it out for me to see if it works as you would expect?

[prasadajith]

agree that plugins are not supposed to be edited (aware it will affect updates)... i never do that.. this was an urgent situation.. so did it..

my plan is to modify the settings and make default url configurable through UI and maintain it... without changing anything else in the plugin... once done will share it with you... might be it can be part of next update... (my context demands the admin be a non developer and keep the parameters that need change from time to time be kept doable through a UI, i myself is not a developer :) )

@timnolte i am willing and happy to test the addon module, it will also be good to see if the plugin will work with redirect plugins such as

1. https://wordpress.org/plugins/peters-login-redirect/
2. https://wordpress.org/plugins/redirection/
3. https://wordpress.org/plugins/wp-login-and-logout-redirect/
4. https://wordpress.org/plugins/login-and-logout-redirect/