external=wordpress fails when OAuth2 Client Secret has expired

Strange. In our testing, external=wordpress still works even if the OAuth2 client secret is invalid. However, you may also have to go through the “Lost Password?” process to reset the WordPress password on your admin account so that you can log back in using WordPress credentials. If you can provide more details on what didn’t work here we can explore further!

This is a tough case for us when credentials expire. In our testing of multiple authentication backends, we found that many will emit transient errors (like the user’s session token is out of date), so our solution (in order to cause minimal disruption for client logins) is to redirect back and attempt authentication again. In the case of expired secrets, as you found, this results in the browser eventually flagging “too many redirects” and interrupting the process with a white screen and no details on what caused it. Sadly there is no standard for what error messages are returned from the backends, so it’s hard for us to differentiate between transient “client data is out of date and needs to be refreshed” errors, and “admin credentials are expired/invalid so authentication cannot proceed” errors.