Add Entra group restriction, button-only mode and detailed README
Groups: a Graph-backed picker on the Security tab (search by name or paste object IDs) stores allowed group IDs. During sign-in membership is read from the ID token's groups claim when present, otherwise verified through Microsoft Graph checkMemberGroups (transitive). Verification failures refuse the sign-in. Button-only mode: hides the password form and the lost-password link and rejects password sign-ins on wp-login.php via the authenticate filter. A generated, rate-limited fallback key re-enables the form for 30 minutes per browser; M365_LOGIN_DISABLE_BUTTON_ONLY switches the mode off from wp-config.php. Also: new German-language README with sequence diagram, settings reference, troubleshooting and hook examples; readme.txt external services section now covers Microsoft Graph; translations updated. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
This commit is contained in:
parent
1517e7e3bc
commit
1202283eda
20 changed files with 2241 additions and 517 deletions
|
|
@ -14,445 +14,587 @@ msgstr ""
|
|||
"X-Generator: bin/make-pot.py\n"
|
||||
"X-Domain: m365-login\n"
|
||||
|
||||
#: includes/class-m365-login-admin.php:63 includes/class-m365-login-admin.php:64 includes/class-m365-login-admin.php:203
|
||||
#: includes/class-m365-login-admin.php:75 includes/class-m365-login-admin.php:76 includes/class-m365-login-admin.php:248
|
||||
msgid "M365 Login"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:102
|
||||
#: includes/class-m365-login-admin.php:114
|
||||
msgid "M365 Login is active but not connected to Microsoft Entra ID yet."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:104
|
||||
#: includes/class-m365-login-admin.php:116
|
||||
msgid "Open the settings"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:132
|
||||
#: includes/class-m365-login-admin.php:145
|
||||
msgid "Choose button icon"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:133
|
||||
#: includes/class-m365-login-admin.php:146
|
||||
msgid "Use this icon"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:134
|
||||
#: includes/class-m365-login-admin.php:147
|
||||
msgid "Copied!"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:135 includes/class-m365-login-admin.php:427
|
||||
#: includes/class-m365-login-admin.php:148 includes/class-m365-login-admin.php:502 includes/class-m365-login-admin.php:545
|
||||
msgid "Copy"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:136
|
||||
#: includes/class-m365-login-admin.php:149
|
||||
msgid "Testing…"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:137
|
||||
#: includes/class-m365-login-admin.php:150
|
||||
msgid "The tenant could not be reached. Check the tenant ID and the server’s outgoing connections."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:149
|
||||
#: includes/class-m365-login-admin.php:151
|
||||
msgid "No groups found."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:152
|
||||
msgid "Searching…"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:153
|
||||
msgid "Add"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:154 includes/class-m365-login-admin.php:476
|
||||
msgid "Remove"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:155 includes/class-m365-login-admin.php:210 includes/class-m365-login-admin.php:461
|
||||
msgid "Save the connection settings first, then search for groups."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:156
|
||||
msgid "Generate a new fallback key on save? The old link stops working."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:168 includes/class-m365-login-admin.php:207
|
||||
msgid "You are not allowed to do this."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:154
|
||||
#: includes/class-m365-login-admin.php:173
|
||||
msgid "Please enter a valid tenant ID first."
|
||||
msgstr ""
|
||||
|
||||
#. translators: %d: HTTP status code
|
||||
#: includes/class-m365-login-admin.php:168
|
||||
#: includes/class-m365-login-admin.php:187
|
||||
msgid "Microsoft answered with HTTP %d. Is the tenant ID correct?"
|
||||
msgstr ""
|
||||
|
||||
#. translators: %d: HTTP status code
|
||||
#: includes/class-m365-login-admin.php:177
|
||||
#: includes/class-m365-login-admin.php:196
|
||||
msgid "Tenant reachable. The OpenID configuration was loaded successfully."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:187
|
||||
msgid "You are not allowed to access this page."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:204
|
||||
msgid "Let existing users sign in with their Microsoft 365 / Entra ID account."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:209
|
||||
msgid "Connected"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:209
|
||||
msgid "Setup incomplete"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:217
|
||||
msgid "Connection"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:218
|
||||
msgid "Button"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:219
|
||||
msgid "Security"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:228
|
||||
msgid "Microsoft Entra ID app registration"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:229
|
||||
msgid "Enter the values from your app registration in the Microsoft Entra admin center."
|
||||
msgid "Microsoft Graph refused the request. Grant the application permission \"GroupMember.Read.All\" (or \"Directory.Read.All\") with admin consent in Entra ID."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:232
|
||||
msgid "Directory (tenant) ID"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:235
|
||||
msgid "Test tenant"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:237
|
||||
msgid "Recommended: the GUID of your tenant. Only sign-ins from this tenant are accepted. \"organizations\" allows any work or school account."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:242
|
||||
msgid "Application (client) ID"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:247
|
||||
msgid "Client secret"
|
||||
msgid "You are not allowed to access this page."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:249
|
||||
msgid "•••••••••••• (stored, leave empty to keep)"
|
||||
msgid "Let existing users sign in with their Microsoft 365 / Entra ID account."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:249
|
||||
msgid "Paste the secret value"
|
||||
#: includes/class-m365-login-admin.php:254
|
||||
msgid "Connected"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:250
|
||||
msgid "Show secret"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:255
|
||||
msgid "Remove the stored secret"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:258
|
||||
msgid "Stored encrypted (AES-256-GCM, key derived from your WordPress salts) and never displayed again. Client secrets expire – note the expiry date in Entra ID."
|
||||
#: includes/class-m365-login-admin.php:254
|
||||
msgid "Setup incomplete"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:262
|
||||
msgid "Account prompt"
|
||||
msgid "Connection"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:263
|
||||
msgid "Button"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:264
|
||||
msgid "Always let the user pick an account (recommended)"
|
||||
msgid "Security"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:265
|
||||
msgid "Use the current Microsoft session if available"
|
||||
#: includes/class-m365-login-admin.php:273
|
||||
msgid "Microsoft Entra ID app registration"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:266
|
||||
msgid "Always require re-entering credentials"
|
||||
#: includes/class-m365-login-admin.php:274
|
||||
msgid "Enter the values from your app registration in the Microsoft Entra admin center."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:275
|
||||
msgid "Appearance"
|
||||
#: includes/class-m365-login-admin.php:277
|
||||
msgid "Directory (tenant) ID"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:278
|
||||
msgid "Live preview"
|
||||
#: includes/class-m365-login-admin.php:280
|
||||
msgid "Test tenant"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:282
|
||||
msgid "Recommended: the GUID of your tenant. Only sign-ins from this tenant are accepted. \"organizations\" allows any work or school account."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:287
|
||||
msgid "Application (client) ID"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:292
|
||||
msgid "Button text"
|
||||
msgid "Client secret"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:296
|
||||
msgid "Divider text"
|
||||
#: includes/class-m365-login-admin.php:294
|
||||
msgid "•••••••••••• (stored, leave empty to keep)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:298
|
||||
msgid "Leave empty to hide the divider line."
|
||||
#: includes/class-m365-login-admin.php:294
|
||||
msgid "Paste the secret value"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:295
|
||||
msgid "Show secret"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:300
|
||||
msgid "Remove the stored secret"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:303
|
||||
msgid "Icon"
|
||||
msgid "Stored encrypted (AES-256-GCM, key derived from your WordPress salts) and never displayed again. Client secrets expire – note the expiry date in Entra ID."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:306
|
||||
msgid "Show an icon on the button"
|
||||
#: includes/class-m365-login-admin.php:307
|
||||
msgid "Account prompt"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:317
|
||||
msgid "Default: Microsoft logo"
|
||||
#: includes/class-m365-login-admin.php:309
|
||||
msgid "Always let the user pick an account (recommended)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:319
|
||||
msgid "Choose from media library"
|
||||
#: includes/class-m365-login-admin.php:310
|
||||
msgid "Use the current Microsoft session if available"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:311
|
||||
msgid "Always require re-entering credentials"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:320
|
||||
msgid "Use Microsoft logo"
|
||||
msgid "Appearance"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:322
|
||||
msgid "PNG, SVG, JPG or WebP. Square images (e.g. 64×64 px) work best."
|
||||
#: includes/class-m365-login-admin.php:323
|
||||
msgid "Live preview"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:330
|
||||
msgid "Background"
|
||||
#: includes/class-m365-login-admin.php:337
|
||||
msgid "Button text"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:331
|
||||
msgid "Background (hover)"
|
||||
#: includes/class-m365-login-admin.php:341
|
||||
msgid "Divider text"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:332
|
||||
msgid "Text colour"
|
||||
#: includes/class-m365-login-admin.php:343
|
||||
msgid "Leave empty to hide the divider line."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:333
|
||||
msgid "Border"
|
||||
#: includes/class-m365-login-admin.php:348
|
||||
msgid "Icon"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:346
|
||||
msgid "Corner radius"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:350
|
||||
msgid "Position on the login page"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:352
|
||||
msgid "Below the login form"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:353
|
||||
msgid "Above the login form"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:359
|
||||
msgid "Quick presets"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:360
|
||||
msgid "Microsoft dark"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:361
|
||||
msgid "Microsoft light"
|
||||
#: includes/class-m365-login-admin.php:351
|
||||
msgid "Show an icon on the button"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:362
|
||||
msgid "Azure blue"
|
||||
msgid "Default: Microsoft logo"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:363
|
||||
msgid "WordPress blue"
|
||||
#: includes/class-m365-login-admin.php:364
|
||||
msgid "Choose from media library"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:371
|
||||
msgid "User matching & hardening"
|
||||
#: includes/class-m365-login-admin.php:365
|
||||
msgid "Use Microsoft logo"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:372
|
||||
msgid "Users are never created automatically. A Microsoft sign-in only succeeds when a WordPress user with the same e-mail address already exists."
|
||||
#: includes/class-m365-login-admin.php:367
|
||||
msgid "PNG, SVG, JPG or WebP. Square images (e.g. 64×64 px) work best."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:375
|
||||
msgid "Background"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:376
|
||||
msgid "Background (hover)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:377
|
||||
msgid "Bind WordPress accounts to the Microsoft object ID"
|
||||
msgid "Text colour"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:378
|
||||
msgid "On first sign-in the immutable Microsoft object ID is stored with the user. Later sign-ins with the same e-mail but a different Microsoft identity are rejected. Strongly recommended."
|
||||
msgid "Border"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:385
|
||||
msgid "Fall back to the user principal name (UPN)"
|
||||
#: includes/class-m365-login-admin.php:391
|
||||
msgid "Corner radius"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:386
|
||||
msgid "If the token contains no \"email\" claim, use the UPN (e.g. jane@contoso.com) when it is a valid e-mail address. Usually required for work accounts."
|
||||
#: includes/class-m365-login-admin.php:395
|
||||
msgid "Position on the login page"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:393
|
||||
msgid "Keep users signed in (\"Remember me\")"
|
||||
#: includes/class-m365-login-admin.php:397
|
||||
msgid "Below the login form"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:394
|
||||
msgid "Issues a 14-day WordPress session instead of a browser session."
|
||||
#: includes/class-m365-login-admin.php:398
|
||||
msgid "Above the login form"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:399
|
||||
msgid "Allowed e-mail domains (optional)"
|
||||
#: includes/class-m365-login-admin.php:404
|
||||
msgid "Quick presets"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:401
|
||||
msgid "One or more domains separated by commas or new lines. Leave empty to allow any domain of your tenant."
|
||||
#: includes/class-m365-login-admin.php:405
|
||||
msgid "Microsoft dark"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:406
|
||||
msgid "What the plugin does to keep sign-ins safe"
|
||||
msgid "Microsoft light"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:407
|
||||
msgid "Azure blue"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:408
|
||||
msgid "OpenID Connect authorization code flow with PKCE (S256) – no tokens ever pass through the browser."
|
||||
msgid "WordPress blue"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:409
|
||||
msgid "Single-use state and nonce values bound to the browser via an HttpOnly cookie (CSRF and replay protection)."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:410
|
||||
msgid "ID token signature verified against Microsoft’s published signing keys; issuer, audience, tenant, expiry and nonce are checked."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:411
|
||||
msgid "Client secret encrypted at rest; no accounts are created, no passwords are changed."
|
||||
#: includes/class-m365-login-admin.php:416
|
||||
msgid "User matching & hardening"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:417
|
||||
msgid "Save changes"
|
||||
msgid "Users are never created automatically. A Microsoft sign-in only succeeds when a WordPress user with the same e-mail address already exists."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:422
|
||||
msgid "Bind WordPress accounts to the Microsoft object ID"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:423
|
||||
msgid "Redirect URI"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:424
|
||||
msgid "Register this URI in your app registration under Authentication → Web → Redirect URIs:"
|
||||
msgid "On first sign-in the immutable Microsoft object ID is stored with the user. Later sign-ins with the same e-mail but a different Microsoft identity are rejected. Strongly recommended."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:430
|
||||
msgid "Plain permalinks are active, so the callback uses a query string. If you enable pretty permalinks later, the redirect URI changes and must be updated in Entra ID."
|
||||
msgid "Fall back to the user principal name (UPN)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:433
|
||||
msgid "Your site does not use HTTPS. Microsoft only accepts http:// redirect URIs for localhost; production sites must use HTTPS."
|
||||
#: includes/class-m365-login-admin.php:431
|
||||
msgid "If the token contains no \"email\" claim, use the UPN (e.g. jane@contoso.com) when it is a valid e-mail address. Usually required for work accounts."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:438
|
||||
msgid "Setup in 5 steps"
|
||||
msgid "Keep users signed in (\"Remember me\")"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:440
|
||||
msgid "Open the Microsoft Entra admin center → App registrations → New registration."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:441
|
||||
msgid "Choose \"Accounts in this organizational directory only\", set the platform to Web and paste the redirect URI above."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:442
|
||||
msgid "Copy the Application (client) ID and Directory (tenant) ID from the overview page."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:443
|
||||
msgid "Under Certificates & secrets create a client secret and copy its value (not the ID)."
|
||||
#: includes/class-m365-login-admin.php:439
|
||||
msgid "Issues a 14-day WordPress session instead of a browser session."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:444
|
||||
msgid "Under Token configuration add the optional claim \"email\" for ID tokens (recommended), then save this page."
|
||||
msgid "Allowed e-mail domains (optional)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:446
|
||||
msgid "Required API permission: openid, profile, email (delegated) – granted by default."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:450
|
||||
msgid "Shortcode"
|
||||
msgid "One or more domains separated by commas or new lines. Leave empty to allow any domain of your tenant."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:451
|
||||
msgid "Allowed Entra groups (optional)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:452
|
||||
msgid "Only members of at least one of these groups may sign in. Leave empty to allow every matched user. Nested memberships count."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:455
|
||||
msgid "Search groups"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:457
|
||||
msgid "Type a group name or paste an object ID…"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:458
|
||||
msgid "Search"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:463
|
||||
msgid "Needs the application permission \"GroupMember.Read.All\" with admin consent. Without it you can still paste group object IDs."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:469
|
||||
msgid "Selected groups"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:470
|
||||
msgid "No groups selected – every matched user may sign in."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:480
|
||||
msgid "Membership is read from the \"groups\" claim of the ID token when present; otherwise the plugin asks Microsoft Graph (application permission \"User.Read.All\" or \"Directory.Read.All\"). If neither works, the sign-in is refused."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:485
|
||||
msgid "Button-only mode"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:486
|
||||
msgid "Hide the username/password form and the \"Lost your password?\" link, and refuse password sign-ins on the login page. Application passwords, REST and XML-RPC are not affected."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:491
|
||||
msgid "Show only the Microsoft button on the login page"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:492
|
||||
msgid "Becomes active once the connection is configured. Make sure your own account can sign in via Microsoft before enabling this."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:497
|
||||
msgid "Fallback link (keep it secret)"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:498
|
||||
msgid "Opening this link shows the password form again in that browser for 30 minutes. Bookmark it somewhere safe – it is your way back in if Microsoft sign-in ever breaks."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:506
|
||||
msgid "Generate a new key when saving"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:509
|
||||
msgid "A key is generated automatically the first time you save these settings."
|
||||
msgstr ""
|
||||
|
||||
#. translators: %s: PHP constant
|
||||
#: includes/class-m365-login-admin.php:515
|
||||
msgid "Emergency switch: add %s to wp-config.php to disable button-only mode entirely."
|
||||
msgstr ""
|
||||
|
||||
#. translators: %s: PHP constant
|
||||
#: includes/class-m365-login-admin.php:524
|
||||
msgid "What the plugin does to keep sign-ins safe"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:526
|
||||
msgid "OpenID Connect authorization code flow with PKCE (S256) – no tokens ever pass through the browser."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:527
|
||||
msgid "Single-use state and nonce values bound to the browser via an HttpOnly cookie (CSRF and replay protection)."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:528
|
||||
msgid "ID token signature verified against Microsoft’s published signing keys; issuer, audience, tenant, expiry and nonce are checked."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:529
|
||||
msgid "Client secret encrypted at rest; no accounts are created, no passwords are changed."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:535
|
||||
msgid "Save changes"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:541
|
||||
msgid "Redirect URI"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:542
|
||||
msgid "Register this URI in your app registration under Authentication → Web → Redirect URIs:"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:548
|
||||
msgid "Plain permalinks are active, so the callback uses a query string. If you enable pretty permalinks later, the redirect URI changes and must be updated in Entra ID."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:551
|
||||
msgid "Your site does not use HTTPS. Microsoft only accepts http:// redirect URIs for localhost; production sites must use HTTPS."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:556
|
||||
msgid "Setup in 5 steps"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:558
|
||||
msgid "Open the Microsoft Entra admin center → App registrations → New registration."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:559
|
||||
msgid "Choose \"Accounts in this organizational directory only\", set the platform to Web and paste the redirect URI above."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:560
|
||||
msgid "Copy the Application (client) ID and Directory (tenant) ID from the overview page."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:561
|
||||
msgid "Under Certificates & secrets create a client secret and copy its value (not the ID)."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:562
|
||||
msgid "Under Token configuration add the optional claim \"email\" for ID tokens (recommended), then save this page."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:564
|
||||
msgid "Required API permission: openid, profile, email (delegated) – granted by default."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:565
|
||||
msgid "Optional, for group restrictions: application permissions GroupMember.Read.All and User.Read.All (Microsoft Graph) with admin consent."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:569
|
||||
msgid "Shortcode"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-admin.php:570
|
||||
msgid "Place the button on a custom login page:"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:593
|
||||
#: includes/class-m365-login-auth.php:136
|
||||
msgid "Password sign-in is disabled on this site. Please use the Microsoft button."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:751
|
||||
msgid "Password sign-in is temporarily enabled for this browser (30 minutes)."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:758 includes/class-m365-login-graph.php:63
|
||||
msgid "Microsoft login is not configured yet."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:594
|
||||
#: includes/class-m365-login-auth.php:759
|
||||
msgid "The login request expired or was invalid. Please try again."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:595
|
||||
#: includes/class-m365-login-auth.php:760
|
||||
msgid "Microsoft sign-in was cancelled."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:596
|
||||
#: includes/class-m365-login-auth.php:761
|
||||
msgid "Microsoft returned an error. Please try again."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:597
|
||||
#: includes/class-m365-login-auth.php:762
|
||||
msgid "Could not complete the sign-in with Microsoft. Please try again or contact an administrator."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:598
|
||||
#: includes/class-m365-login-auth.php:763
|
||||
msgid "The Microsoft sign-in could not be verified."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:599
|
||||
#: includes/class-m365-login-auth.php:764
|
||||
msgid "Your Microsoft account did not provide an e-mail address."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:600
|
||||
#: includes/class-m365-login-auth.php:765
|
||||
msgid "Your e-mail domain is not allowed to sign in here."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:601
|
||||
#: includes/class-m365-login-auth.php:766
|
||||
msgid "No WordPress account exists for your Microsoft e-mail address."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:602
|
||||
#: includes/class-m365-login-auth.php:767
|
||||
msgid "This WordPress account is linked to a different Microsoft account. Please contact an administrator."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:603
|
||||
#: includes/class-m365-login-auth.php:768
|
||||
msgid "You are not allowed to sign in with this account."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:40
|
||||
#: includes/class-m365-login-auth.php:769
|
||||
msgid "Your Microsoft account is not a member of a group that is allowed to sign in here."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:770
|
||||
msgid "Your group membership could not be verified. Please contact an administrator."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:771
|
||||
msgid "The fallback key is not valid."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-auth.php:772
|
||||
msgid "Too many attempts. Please wait 15 minutes."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-graph.php:193
|
||||
msgid "Group"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-graph.php:195
|
||||
msgid "Security group"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-graph.php:197
|
||||
msgid "Microsoft 365 group"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:44
|
||||
msgid "Sign in with Microsoft"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:49
|
||||
#: includes/class-m365-login-settings.php:53
|
||||
msgid "or"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:176
|
||||
#: includes/class-m365-login-settings.php:245
|
||||
msgid "The tenant ID must be a GUID (e.g. 1a2b3c4d-…) or one of \"organizations\", \"common\", \"consumers\"."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:184
|
||||
#: includes/class-m365-login-settings.php:253
|
||||
msgid "The application (client) ID must be a GUID."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:196
|
||||
#: includes/class-m365-login-settings.php:265
|
||||
msgid "The client secret contains invalid characters."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login-settings.php:200
|
||||
#: includes/class-m365-login-settings.php:269
|
||||
msgid "The client secret could not be encrypted. Is the OpenSSL extension available?"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login.php:94
|
||||
#: includes/class-m365-login.php:102
|
||||
msgid "Settings"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login.php:105
|
||||
#: includes/class-m365-login.php:113
|
||||
msgid "M365 Login requires PHP 7.4 or newer."
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login.php:106 includes/class-m365-login.php:115
|
||||
#: includes/class-m365-login.php:114 includes/class-m365-login.php:123
|
||||
msgid "Plugin activation failed"
|
||||
msgstr ""
|
||||
|
||||
#: includes/class-m365-login.php:114
|
||||
#: includes/class-m365-login.php:122
|
||||
msgid "M365 Login requires the PHP OpenSSL extension (needed to verify Microsoft token signatures and to encrypt the client secret)."
|
||||
msgstr ""
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue