New install with Oauth2 does not redirect to Authentik

[howardshand]

Good day,

I am using an authentik server as the backend oauth2 server but the login button\link (https://site.com/wp-login.php?external=oauth2&id=1) does not redirect to authentik but rather just reloads the page.

WP Version - 6.7.2
Authorizer Version - 3.10.2

Error logs don't show anything untoward:
"GET /wp-login.php?external=oauth2&id=1 HTTP/1.1" 200 3192 "https://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"

[clemensmach]

i had the same problem when i left Resource Owner URL empty. All three URL settings need to have a working value:

authorizer/src/authorizer/class-authentication.php

Lines 546 to 551 in 112f5c5

	if (
	empty( $auth_settings['oauth2_url_authorize'] ) ||
	empty( $auth_settings['oauth2_url_token'] ) ||
	empty( $auth_settings['oauth2_url_resource'] )
	) {
	return null;

[howardshand]

Thank you, when I set a value for 'Resource Owner URL' I am taken to the Authentik login page but once I login it redirects me to the WordPress login page with the url set as https://wordpress.domain.com/wp-login.php?external=oauth2&code=1234b2ff6d95481fb953fd64791c8173&state=35abc8772e5af077fa9e88376adafc67

The settings I have are:
Authorization URL - https://authentik.domain.com/application/o/authorize/
Access Token URL - https://authentik.domain.com/application/o/token/
Resource Owner URL - https://wordpress.domain.com/user (have also tried https://wordpress.domain.com/wp-admin)

[clemensmach]

the error message for me was error="insufficient_scope", error_description="Missing openid scope" (added some debug output to plugin php code to get it)

had to set openid in keycloak (#16844)
so my Resource URL is https://auth.example.com/realms/<realm>/protocol/openid-connect/userinfo

i guess you have to set an authentik url where you get your user info from

[howardshand]

Thanks, the example link made me think the user link was to come from the app/Wordpress. For Authentik it's https://authentik.domain.com/application/o/userinfo/.

[figureone]

Thanks all for the troubleshooting. Our team doesn't use OAuth2 internally (yet) so the Authorizer integration is very basic, just a wrapper around the OAuth2 2.0 Client from the PHP League. We're happy to expose any additional configuration options from that if needed.
https://packagist.org/packages/league/oauth2-client

[howardshand]

Thanks for following up @figureone. The integration works great and is sufficient so far after setup. Only suggestion I would make would be to change "Example: https://api.example.edu/user" to "Example: https://example.edu/login/oauth/userinfo".

authorizer/src/authorizer/options/external/class-oauth2.php

Line 341 in dafcbe7

<p class="description"><?php esc_html_e( 'Example: https://api.example.edu/user', 'authorizer' ); ?></p>

[figureone]

Thanks for the suggestion! Updated helper text will be included in the next release