Integrando com WordPress para Autorização
A segunda parte da série sobre a integração do Logto com o WordPress, focada na autorização.
In the previous article, we discussed how to integrate Logto for authentication in WordPress. This article, as part two, will delve into the authorization process, focusing on the role system in WordPress and how to implement role mapping with Logto, given that the plugin we used in the previous article does not provide authorization capabilities directly.
We'll create a role mapping function that automatically assigns WordPress roles to users based on their roles provided by Logto RBAC (Role-Based Access Control).
Understanding WordPress user roles
WordPress has a built-in user role management system that defines what actions (capabilities) a user can perform on a site. The default user roles include Administrator, Editor, Author, Contributor, and Subscriber, each with its own set of capabilities
These roles are crucial for maintaining the security and efficiency of site operations, as they help ensure that users have appropriate access levels based on their responsibilities.
The solution: custom role mapping
Logto employs Role-Based Access Control (RBAC) as its authorization model, utilizing "scopes" as the smallest unit of permission. These scopes define the specific actions that an authenticated user is allowed to perform within an application. However, WordPress operates on a different principle for managing user permissions, relying on predefined "roles" that bundle various capabilities together.
Given this fundamental difference, we suggest creating special roles within Logto that correspond to the roles defined in WordPress. Thoes roles may not have any scopes, they are only used as a reference for mapping users to WordPress roles.
Prerequisites
Before proceeding, ensure you have the following:
- Finish the previous article on integrating Logto with WordPress for authentication, this includes:
- A WordPress site with administrator access.
- A Logto account with an application set up for your WordPress site.
- The OpenID Connect Generic plugin installed and configured on your WordPress site.
- Setup roles in Logto that correspond to the roles in WordPress. For example, if you have an 'editor' role in WordPress, create a 'group:editors' role in Logto.
Implementing role mapping with custom code
To implement role mapping, we will add custom code to the WordPress theme's functions.php
file. This involves using the wp_login
action hook, which triggers when a user logs in. Here's a step-by-step guide on how to set this up:
Step 1: access your theme's functions.php
Open your theme’s functions.php
file. You can access this file through the WordPress admin panel by navigating to Appearance > Theme Editor and selecting functions.php
from the right-hand side files list. Or in the source code, navigate to your WordPress theme directory and locate the functions.php
file. This file allows you to add custom PHP functions that extend the functionality of your WordPress site.
Step 2: write the role mapping function
Below is a simple example of a function that you might add to functions.php. This function will be triggered upon user login, and it will assign roles based on the user's roles
claim fetched from Logto.
Step 3: understanding the code and customizing it
-
logto_handler
function: This function takes two parameters:$user_login
(username) and$user
(user object). It retrieves roles from Logto which stored in user meta asopenid-connect-generic-last-user-claim
, maps this role to a corresponding WordPress role, and assigns it to the user. -
add_action
: This line hooks thelogto_handler
function to thewp_login
action, which is triggered after a user logs in. The10
is the priority (default), and2
indicates the number of arguments the function accepts.
The example above assigns the 'editor' role to users authenticated via Logto with role name group:editors
. However, in a real-world scenario, you'll likely need to implement more kinds of role mappings.
You can find the list of WordPress roles and their capabilities here.
Step 4: test your setup
Now, let's test the role mapping function by logging in with a user that has the group:editors
role in Logto. After logging in, check the user's role in WordPress to ensure that the mapping is working correctly.
Conclusion
By integrating Logto with WordPress for both authentication and authorization, you can enhance the security and functionality of your site. Remember, while the code provided here is a basic example, you might need to adapt it to fit the roles and permissions structure of your WordPress site.