friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 4
wp-m365-login/CHANGELOG.md
friloo 1202283eda
Add Entra group restriction, button-only mode and detailed README 
Groups: a Graph-backed picker on the Security tab (search by name or
paste object IDs) stores allowed group IDs. During sign-in membership is
read from the ID token's groups claim when present, otherwise verified
through Microsoft Graph checkMemberGroups (transitive). Verification
failures refuse the sign-in.

Button-only mode: hides the password form and the lost-password link
and rejects password sign-ins on wp-login.php via the authenticate
filter. A generated, rate-limited fallback key re-enables the form for
30 minutes per browser; M365_LOGIN_DISABLE_BUTTON_ONLY switches the
mode off from wp-config.php.

Also: new German-language README with sequence diagram, settings
reference, troubleshooting and hook examples; readme.txt external
services section now covers Microsoft Graph; translations updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
2026-09-22 14:30:53 +00:00

1.3 KiB
Raw Blame History

Changelog

All notable changes to this project are documented in this file. The format follows Keep a Changelog and the plugin adheres to Semantic Versioning.

[1.0.0] – 2026-09-22

Added

  • "Sign in with Microsoft" button on wp-login.php (OpenID Connect authorization code flow with PKCE).
  • Matching of existing WordPress users by e-mail address (optional UPN fallback), no user provisioning.
  • Settings screen (Settings → M365 Login) with connection, button and security tabs, live button preview, colour presets, media-library icon picker, redirect-URI copy button and tenant connectivity test.
  • ID token verification against Microsoft's JWKS (RS256, issuer, audience, tenant, expiry, nonce).
  • Encrypted client secret storage (AES-256-GCM).
  • Account binding to the Microsoft object ID, e-mail domain allow-list.
  • Entra group restriction with a Graph-powered group picker; membership verified via the groups claim or Microsoft Graph checkMemberGroups.
  • Button-only mode that hides the password form and blocks password sign-in on wp-login.php, with a secret, rate-limited fallback link and a wp-config.php emergency constant.
  • [m365_login_button] shortcode and developer hooks.
  • German translation.