IndieAuth

What is IndieAuth.com?

Indieauth.com is the reference implementation of the IndieAuth Protocol. If you activate this plugin you do not need to use this site. IndieAuth.com uses rel-me links on your website to determine your identity for authentication, but this is not required to use this plugin which uses your WordPress login to verify your identity.

How does the application know my name and avatar?

As of version 3.2, the endpoints return the display name, avatar, and URL from your user profile.

Does this require each user to have their own unique domain name?

No. When you provide the URL of the WordPress site and authenticate to WordPress, it will return the URL of your author profile as your unique URL. Only one user may use the URL of the site itself. This setting is set in the plugin settings page, or if there is only a single user, it will default to them.

How do I authenticate myself to an Indieauth server?

That, as mentioned, depends on the server. By default, the built-in IndieAuth server uses the WordPress login.

By adding Indieauth support, you can log into sites simply by providing your URL.

How secure is this?

We recommend your site uses HTTPS to ensure your credentials are not sent in cleartext. As of Version 4.5.5, this plugin requires Proof Key for Code Exchange(PKCE), whether or not the client supports it.

What is a token endpoint?

Once you have proven your identity, the token endpoint issues a token, which applications can use to authenticate as you to your site.

You can manage and revoke tokens under User->Manage Tokens. You will only see tokens for the currently logged in user.

How do I incorporate this into my plugin?

The WordPress function, get_current_user_id works to retrieve the current user ID if logged in via IndieAuth. The plugin offers the following functions to assist you in using IndieAuth for your service. We suggest you check on activation for the IndieAuth plugin by asking if ( class_exists( 'IndieAuth_Plugin') )

• indieauth_get_scopes() – Retrieves an array of scopes for the auth request.
• indieauth_check_scope( $scope ) – Checks if the provided scope is in the current available scopes
• indieauth_get_response() – Returns the entire IndieAuth token response
• indieauth_get_client_id() – Returns the client ID
• indieauth_get_me() – Return the me property for the current session.
• new IndieAuth_Client_Discovery( $client_id ) – Class that allows you to discover information about a client $client->get_name() – Once the class is instantiated, retrieve the name
• $client->get_icon() – Once the class is instantiated, retrieve an icon

If any of these return null, the value was not set, and IndieAuth is not being used. A request authenticated with a token only gets the capabilities of the token’s scopes. A profile or email token gets read only. Plugins that need more for a token can add capability names with the indieauth_allowed_caps( $allowed, $scopes ) filter. Anything beyond capabilities must be enforced by whatever is using the scopes. The plugin does contain a list of permission descriptions to display when authorizing, but this is solely to aid the user in understanding what the scope is for.

The scope description can be customized with the filter indieauth_scope_description( $description, $scope )

What if I just want to use the REST API without OAuth exchange?

The plugin allows you to generate a token under User->Manage Tokens with access. You can provide this to an application manually.

I keep getting the response that my request is Unauthorized

Many server configurations will not pass bearer tokens. The plugin attempts to work with this as best possible, but there may be cases we have not encountered. The first step is to try running the diagnostic script linked to in the settings page. It will tell you whether tokens can be passed.

Temporarily enable WP_DEBUG which will surface some errors in your logs.

If you feel comfortable with command line entries, you can request a token under Users->Manage Tokens and use curl or similar to test logins. Replace example.com with your site and TOKEN with your bearer token.

curl -i -H 'Authorization: Bearer TOKEN' 'https://example.com/wp-json/indieauth/1.0/test curl -i -H 'Authorization: Bearer test' 'https://tiny.n9n.us/wp-json/indieauth/1.0/test?access_token=TOKEN'

This will quickly test your ability to authenticate to the server. Additional diagnostic tools may be available in future.

If this does not work, you can add define( 'INDIEAUTH_TOKEN_ERROR', true ); to your wp-config.php file. The INDIEAUTH_TOKEN_ERROR flag will return an error if there is not a token passed allowing you to troubleshoot this issue, however it will require authentication for all REST API functions even those that do not require them, therefore this is off by default.

If your Micropub client includes an Authorization HTTP request header but you still get an HTTP 401 response with body missing access token , your server may be stripping the Authorization header. If you’re on Apache, try adding this line to your .htaccess file :

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

If you are not running the latest version of WordPress, try this line . It is added automatically as of 5.6:

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

You can also try:

CGIPassAuth On

If that doesn’t work either, you may need to ask your hosting provider to whitelist the Authorization header for your account. If they refuse, you can pass it through Apache with an alternate name . The plugin searches for the header in REDIRECT_HTTP_AUTHORIZATION, as some FastCGI implementations store the header in this location.

I get an error that parameter redirect_uri is missing but I see it in the URL

Some hosting providers filter this out using mod_security. For one user, they needed Rule 340162 whitelisted as it detects the use of a URL as an argument.

What is the Ticketing extension and how do I enable it?

Ticketing for IndieAuth is a developing extension to OAuth2/IndieAuth. It creates a ticket endpoint on your site where other sites can send you a ticket, which can be redeemed for a token to access private resources on that other site. You can enable the experimental endpoint functionality by adding the below to your wp-config.php. If this becomes more established, it will be added in the settings page.

define( ‘INDIEAUTH_TICKET_ENDPOINT’, true );

At this time, the functionality is limited to the receiving of tickets, not the sending of same. It enables a new tab under the User called Manage External Tokens, which allows you to see which external tokens are stored. Tokens are stored per user.

Since the extension is developing, there is currently not a specified way to transfer this token to a client to be used.