Oidc - lightweight OAuth 2.0 / OpenID Connect login

[maximus]

Hi everyone,

I’ve released a new ProcessWire module: Oidc.

Oidc adds lightweight OAuth 2.0 and OpenID Connect login to ProcessWire sites. It is meant for projects that need social login or company SSO without a full front-end account-management suite.

Repository: https://github.com/mxmsmnv/Oidc

What it does

• Adds OAuth/OIDC login buttons to ProcessWire templates
• Supports Google, GitHub, LinkedIn, Microsoft, Yandex and Yahoo out of the box
• Supports custom OIDC providers via discovery URL
• Works with providers such as Okta, Auth0, Keycloak, authentik, Azure AD and Dex
• Handles callbacks automatically on frontend pages
• Supports auto-registration of new ProcessWire users
• Preserves return URLs through the login flow
• Includes silent mode for SSO-only sites and intranets
• Provides hooks for identity resolution, login, registration and provider definitions
• Verifies OIDC id_token claims with nonce, issuer, audience, expiry and RS256/JWKS checks when available

Basic usage

After installing and configuring providers, render login buttons in a template:

$oidc = $modules->get('Oidc');
echo $oidc->renderButtons();

The page that renders the buttons is also the callback page. Set that URL in the module settings and register the same URL in your OAuth/OIDC provider app.

Example use cases

• Add “Continue with Google” or “Continue with GitHub” to a member area
• Use Okta/Auth0/Keycloak for company SSO
• Protect an intranet or private section with silent SSO
• Auto-create ProcessWire users after successful provider login
• Add custom rules through hooks, for example restricting registration to a company email domain

Documentation

The README gives the overview, and the repository includes detailed documentation and agent-readable integration notes:

• README: https://github.com/mxmsmnv/Oidc
• Documentation: https://github.com/mxmsmnv/Oidc/blob/main/DOCUMENTATION.md
• Agent guide: https://github.com/mxmsmnv/Oidc/blob/main/AGENTS.md

Requirements

• ProcessWire 3.0.200+
• PHP 8.1+
• curl
• openssl

The module is MIT licensed.

Feedback, bug reports and suggestions are very welcome.

[Stix]

Hi @maximus, thanks! I've already been looking for something like this (and was actually just about to start writing it myself).

I noticed two things:

• When I logged in, the complete settings were partially reset.
• Some HookAfter (on login/register user) didn't work because the session redirect is terminated with an exit.

I've submitted a PR for both of them. Hope it's okay 🙂

[maximus]

Hi @Stix

Thank you very much for catching these and for the PRs.

Both issues were absolutely valid:

• the identity-link save path could overwrite the rest of the module config;
• redirects inside the login/register flow could prevent HookAfter callbacks from running.

I’ve reviewed and merged both PRs. The module should now preserve settings correctly and allow after-hooks on login/register to run as expected.

Really appreciate the careful testing and the clean fixes. 🙂