Redirect Using current_user_can

Hi there

My client is using WordPress as an Intranet on a closed network (no internet access). When a staff member first visits the site, our PKI script adds them automatically as a user and assigns them a role based on their department.

Occasionally the format of the PKI certificate isn’t consistent with what our script is looking for and the user is added to the WordPress ‘New User Default Role’ as defined in the settings. We’ve called this role ‘PKI Error’. This role only has one capability, which we’ve called ‘pki_error_redirect’. We check this group once or twice a week and manually update each user, assigning them to the correct role.

In the meantime, these users are able to view the intranet without too many issues – but I’d like to make the site inaccessible to our default role, redirecting them to a help page (a static page hosted elsewhere) or message.

I had thought that adding a redirect based on current_user_can would be the answer, but I’ve been unsuccessful so far! I’ve tried adding it to the theme’s functions.php and as a custom plugin.

I’ve tried:

function redirect_by_role () {
global $current_user, $wp_roles;
	if( current_user_can ( 'pki_error_redirect' ) ) {
		return 'https://the-help-page-address';
	} else {
		return 'https://the-intranet-address';
	}
}
add_filter('login_redirect', 'plugin_admin_redirect');

and

function wps_login_redirect_contributors() {
  if ( current_user_can('pki_error_redirect') ){
      return 'https://the-intranet-address';
  }
}

add_filter('login_redirect', 'wps_login_redirect_contributors');

And a few more!

I’m slowly pulling my hair out, it’d be so great if somebody could help.

Many thanks,
Karen