Question: extracting the OAuth2 feature into a generic WP OAuth plugin

[kasparsd]

This plugin has proved that regular WP instances can easily handle the OAuth2 authentication layer and provide modern authorization flow for third-party apps interested in talking to WP.

I'm wondering if there have been discussions of extracting the OAuth2 parts into a standalone plugin similar to how Application Passwords were extracted from the two-factor plugin and eventually merged into WP core.

OAuth2 is now required for proper MCP flows and the mcp-adapter plugin (eventually the official AI plugin) could really benefit from having this functionality.

I'm seeing parallel activity happening across multiple vendors building the OAuth2 components in different ways for their implementations and having an official WP core solution would really help with centralizing and securing those efforts.

[pfefferle]

Hey @kasparsd 👋

I am with you when it comes to the need of a global OAuth2 implementation! I think we are at a point where too many plugins come with their own version of OAuth2 (I myself work on at least 4 of them, so I feel the pain). This brings a lot of potential for collisions and opens the door for security issues.

I am not sure about the way to solve it though. I am happy to contribute to such a project, but I do think this has to be part of core (as part of the REST-API), not a plugin. WordPress does provide a way to require other plugins, but the usability is a bit clunky.

I am also happy to provide code, the issue is, that OAuth2 is more like a framework than a single spec, so we would have to take care that it is extensible and that we allow support for all the different Auth types. The current implementation in ActivityPub is very basic with a strong focus on the minimum requirements of the ActivityPub API Spec.

Maybe it is the right time to file a trac issue, to then start working on a feature plugin? https://core.trac.wordpress.org/

[kasparsd]

Thanks for your sharing your thoughts on this @pfefferle! Great to hear that you're getting the same feel for the overlap in implementations.

I agree that having this in core would be ideal (just like application passwords). With a standalone plugin I was thinking of a canonical plugin (just like you're suggesting) since we would need to iterate on it before proposing anything for core.

Indeed, OAuth is a range of things. And agreeing on the implementation and extension points might be the most challenging part. That said, I noticed that there is a lot of overlap with what is needed for ActivityPub and MCP so that would give us at least two major use-cases to start with.

I've found the following maintained implementations of OAuth across the ecosystem (most of which you're involved with, if I'm not mistaken):

• ActivityPub https://github.com/Automattic/wordpress-activitypub
• IndieAuth https://github.com/indieweb/wordpress-indieauth
• ATmosphere https://github.com/Automattic/wordpress-atmosphere
• https://github.com/akirk/enable-mastodon-apps (by @akirk)
• https://github.com/Automattic/wp-openid-connect-server
• https://github.com/WP-API/OAuth2 (by HumanMade @rmccue and @joehoyle)
• https://github.com/wpelevator/oauth-pilot (mine)
• https://github.com/wenisch-tech/wordpress-keystone-oidc

I wonder if @jeffpaul, @georgestephanis, @masteradhoc or @dd32 have any insight into prior discussions around this for core?

[georgestephanis]

It always came down to .org not being willing to own a broker for app registration and there not being a good consensus of whether to accept the tradeoffs of open app registration per site (and the ux of registering an app, copying the secrets, authenticating the app, then authenticating the user .... being crap.)

This was last examined circa 2019-2020-ish though, so maybe there's A Better Way (tm) now.