- No border or shadow around the login box on wp-login.php (form and
Microsoft block, also in button-only mode); the white area stays.
- Button-only mode: the "Lost your password?" link is removed through
lost_password_html_link instead of CSS only, the lostpassword,
retrievepassword, rp and resetpass screens redirect to the login page
and allow_password_reset refuses resets – all unless the fallback link
is active.
- The login stylesheet is also loaded when only the form is hidden
(e.g. broken connection); before, the link and form showed there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Privileged accounts: the UPN rule also applies when bind_oid is off or
the account is not bound; privileges are checked on every site of a
multisite user, include code/HTML capabilities (unfiltered_html,
plugins, themes, users) and the remembered roles of deactivated
accounts.
- send_auth_cookies protection also works on WordPress 6.0/6.1.
- Run lock via INSERT IGNORE (atomic), refreshed during long runs; a
shutdown handler reports fatal errors and frees the lock.
- Deprovisioning only for accounts linked in the current tenant (tenant
recorded per account; legacy links not found are left alone).
- Safety stop based on the accounts linked before the run; new safety
stop for removals of administrative roles.
- Disable is idempotent; row-action nonces are bound to the state.
- Profile photos are re-encoded to 240 px (drops EXIF and appended
data), size-limited while downloading, removed on deactivation;
index.php guard in the photo folder.
- Privacy exporter and eraser for the copied data.
- One-time migration hardens accounts deactivated by 1.0 and cleans a
stored certificate bundle; the .cer download is always re-exported.
- Password fields hidden in button-only mode even when the connection
is broken; settings written non-autoloaded; robust user ID queries.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Add the button (and error messages) to every wp_login_form() form via
login_form_top/login_form_bottom; in button-only mode the password
fields are wrapped and hidden there.
- New template functions m365_login_button() and m365_login_messages();
the shortcode gains divider and messages attributes.
- New setting for the custom login page URL: failed sign-ins, the
fallback link and the logout redirect point there instead of
wp-login.php. Must be a same-site URL.
- Button-only mode now blocks every interactive password sign-in
through the authenticate filter, not only wp-login.php; XML-RPC, REST,
WP-CLI and cron are exempt, plus a filter for trusted exceptions.
- Fallback key accepted on any page (init) instead of login_init only.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
Groups: a Graph-backed picker on the Security tab (search by name or
paste object IDs) stores allowed group IDs. During sign-in membership is
read from the ID token's groups claim when present, otherwise verified
through Microsoft Graph checkMemberGroups (transitive). Verification
failures refuse the sign-in.
Button-only mode: hides the password form and the lost-password link
and rejects password sign-ins on wp-login.php via the authenticate
filter. A generated, rate-limited fallback key re-enables the form for
30 minutes per browser; M365_LOGIN_DISABLE_BUTTON_ONLY switches the
mode off from wp-config.php.
Also: new German-language README with sequence diagram, settings
reference, troubleshooting and hook examples; readme.txt external
services section now covers Microsoft Graph; translations updated.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
Adds a WordPress plugin that places a customisable "Sign in with
Microsoft" button on wp-login.php and signs existing users in via the
OpenID Connect authorization code flow with PKCE. Users are matched by
e-mail address only; no accounts are created.
Security: single-use state/nonce bound to an HttpOnly cookie, ID token
signature verification against Microsoft's JWKS (RS256 only) with
issuer/audience/tenant/expiry/nonce checks, optional tenant pinning,
account binding to the Microsoft object ID, e-mail domain allow-list,
client secret encrypted at rest (AES-256-GCM).
Admin: settings screen with connection, button and security tabs, live
button preview, colour presets, media-library icon picker, redirect URI
copy button and tenant connectivity test.
Packaging for WordPress.org: readme.txt with External services section,
GPL-2.0 license, uninstall.php, POT + German translations, .distignore,
build script, PHPCS config and CI running Plugin Check.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
