This plugin enables a site to use an external OpenID Connect identity provider for user authentication. It is designed for administrators who need to centralize user logins using an existing corporate or third-party identity service, such as Keycloak or Okta. The plugin handles the authentication flow, user creation, and attribute mapping, removing the need to manage separate passwords.

Attribute Mapping: Administrators can define how user data from the identity provider maps to standard user profile fields, such as email, first name, and last name. This ensures user information is populated correctly upon login.

Tested Compatibility: The plugin is confirmed to work with Keycloak and Okta, and supports any OpenID Connect provider that uses the Authorization Code flow with PKCE, a modern and secure standard.

User Matching & Creation: The system automatically matches returning users by their unique identifier or email. If a user does not exist, a new account is created using the mapped attributes, streamlining the onboarding process.

Configuration Options: Settings can be managed through the admin interface or defined as constants in the site's configuration file for improved security and deployment consistency.

Focused Functionality: The plugin is purpose-built solely for authentication. It does not include extra features, keeping it simple to configure and maintain for its specific use case.