Integrating with WordPress for Authorization
Tags: webdev, wordpress, identity, opensource
Published: 2024-05-24 11:24:08

A second part of the series on integrating Logto with WordPress, focusing on authorization.

---
In the previous [article](https://dev.to/logto/integrating-with-wordpress-4m68), we discussed how to integrate Logto for authentication in WordPress. This article, as part two, will delve into the authorization process, focusing on the role system in WordPress and how to implement role mapping with Logto, given that the plugin we used in the previous article does not provide authorization capabilities directly.

We'll create a role mapping function that automatically assigns WordPress roles to users based on their roles provided by Logto RBAC (Role-Based Access Control).

# Understanding WordPress user roles

WordPress has a built-in user role management system that defines what actions (capabilities) a user can perform on a site. The default user roles include Administrator, Editor, Author, Contributor, and Subscriber, each with its own set of capabilities

These roles are crucial for maintaining the security and efficiency of site operations, as they help ensure that users have appropriate access levels based on their responsibilities.

# The solution: custom role mapping

Logto employs Role-Based Access Control (RBAC) as its authorization model, utilizing "scopes" as the smallest unit of permission. These scopes define the specific actions that an authenticated user is allowed to perform within an application. However, WordPress operates on a different principle for managing user permissions, relying on predefined "roles" that bundle various capabilities together.

Given this fundamental difference, we suggest creating special roles within Logto that correspond to the roles defined in WordPress. Thoes roles may not have any scopes, they are only used as a reference for mapping users to WordPress roles.

# Prerequisites

Before proceeding, ensure you have the following:

- Finish the previous [article](https://dev.to/logto/integrating-with-wordpress-4m68) on integrating Logto with WordPress for authentication, this includes:
 - A WordPress site with administrator access.
 - A Logto account with an application set up for your WordPress site.
 - The [OpenID Connect Generic plugin](https://wordpress.org/plugins/search/openid-connect-generic/) installed and configured on your WordPress site.
- Setup roles in Logto that correspond to the roles in WordPress. For example, if you have an 'editor' role in WordPress, create a 'group:editors' role in Logto.

# Implementing role mapping with custom code

To implement role mapping, we will add custom code to the WordPress theme's `functions.php` file. This involves using the `wp_login` action hook, which triggers when a user logs in. Here's a step-by-step guide on how to set this up:

### Step 1: access your theme's functions.php

Open your theme’s `functions.php` file. You can access this file through the WordPress admin panel by navigating to Appearance > Theme Editor and selecting `functions.php` from the right-hand side files list. Or in the source code, navigate to your WordPress theme directory and locate the `functions.php` file. This file allows you to add custom PHP functions that extend the functionality of your WordPress site.

### Step 2: write the role mapping function

Below is a simple example of a function that you might add to functions.php. This function will be triggered upon user login, and it will assign roles based on the user's `roles` claim fetched from Logto.

```
function logto_handler($user_login, $user = null) {
	if (!$user) {
		$user = get_user_by('login', $user_login);
	}

	$oidc_claims = get_user_meta($user->ID, 'openid-connect-generic-last-user-claim', true);

	if (in_array('group:editors', $oidc_claims['roles'])) {
		$user->set_role('editor');
	} else {
		$user->set_role('subscriber');
	}
}

add_action('wp_login', 'logto_handler', 10, 2);
```


### Step 3: understanding the code and customizing it

- `logto_handler` function: This function takes two parameters: `$user_login` (username) and `$user` (user object). It retrieves roles from Logto which stored in user meta as `openid-connect-generic-last-user-claim`, maps this role to a corresponding WordPress role, and assigns it to the user.
- `add_action`: This line hooks the `logto_handler` function to the `wp_login` action, which is triggered after a user logs in. The `10` is the priority (default), and `2` indicates the number of arguments the function accepts.

The example above assigns the 'editor' role to users authenticated via Logto with role name `group:editors`. However, in a real-world scenario, you'll likely need to implement more kinds of role mappings.

You can find the list of WordPress roles and their capabilities [here](https://wordpress.org/documentation/article/roles-and-capabilities/).

### Step 4: test your setup
Now, let's test the role mapping function by logging in with a user that has the `group:editors` role in Logto. After logging in, check the user's role in WordPress to ensure that the mapping is working correctly.

# Conclusion
By integrating Logto with WordPress for both authentication and authorization, you can enhance the security and functionality of your site. Remember, while the code provided here is a basic example, you might need to adapt it to fit the roles and permissions structure of your WordPress site.

{% cta https://logto.io/?ref=dev %} Try Logto Cloud for free {% endcta %}