friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 4
wp-m365-login/languages/m365-login.pot
friloo 1202283eda
Add Entra group restriction, button-only mode and detailed README 
Groups: a Graph-backed picker on the Security tab (search by name or
paste object IDs) stores allowed group IDs. During sign-in membership is
read from the ID token's groups claim when present, otherwise verified
through Microsoft Graph checkMemberGroups (transitive). Verification
failures refuse the sign-in.

Button-only mode: hides the password form and the lost-password link
and rejects password sign-ins on wp-login.php via the authenticate
filter. A generated, rate-limited fallback key re-enables the form for
30 minutes per browser; M365_LOGIN_DISABLE_BUTTON_ONLY switches the
mode off from wp-config.php.

Also: new German-language README with sequence diagram, settings
reference, troubleshooting and hook examples; readme.txt external
services section now covers Microsoft Graph; translations updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
2026-09-22 14:30:53 +00:00

600 lines
17 KiB
Text
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Copyright (C) 2026 friloo
# This file is distributed under the GPL-2.0-or-later.
msgid ""
msgstr ""
"Project-Id-Version: M365 Login 1.0.0\n"
"Report-Msgid-Bugs-To: https://github.com/friloo/wp-m365-login/issues\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"POT-Creation-Date: 2026-09-22T00:00:00+00:00\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"X-Generator: bin/make-pot.py\n"
"X-Domain: m365-login\n"
#: includes/class-m365-login-admin.php:75 includes/class-m365-login-admin.php:76 includes/class-m365-login-admin.php:248
msgid "M365 Login"
msgstr ""
#: includes/class-m365-login-admin.php:114
msgid "M365 Login is active but not connected to Microsoft Entra ID yet."
msgstr ""
#: includes/class-m365-login-admin.php:116
msgid "Open the settings"
msgstr ""
#: includes/class-m365-login-admin.php:145
msgid "Choose button icon"
msgstr ""
#: includes/class-m365-login-admin.php:146
msgid "Use this icon"
msgstr ""
#: includes/class-m365-login-admin.php:147
msgid "Copied!"
msgstr ""
#: includes/class-m365-login-admin.php:148 includes/class-m365-login-admin.php:502 includes/class-m365-login-admin.php:545
msgid "Copy"
msgstr ""
#: includes/class-m365-login-admin.php:149
msgid "Testing…"
msgstr ""
#: includes/class-m365-login-admin.php:150
msgid "The tenant could not be reached. Check the tenant ID and the server’s outgoing connections."
msgstr ""
#: includes/class-m365-login-admin.php:151
msgid "No groups found."
msgstr ""
#: includes/class-m365-login-admin.php:152
msgid "Searching…"
msgstr ""
#: includes/class-m365-login-admin.php:153
msgid "Add"
msgstr ""
#: includes/class-m365-login-admin.php:154 includes/class-m365-login-admin.php:476
msgid "Remove"
msgstr ""
#: includes/class-m365-login-admin.php:155 includes/class-m365-login-admin.php:210 includes/class-m365-login-admin.php:461
msgid "Save the connection settings first, then search for groups."
msgstr ""
#: includes/class-m365-login-admin.php:156
msgid "Generate a new fallback key on save? The old link stops working."
msgstr ""
#: includes/class-m365-login-admin.php:168 includes/class-m365-login-admin.php:207
msgid "You are not allowed to do this."
msgstr ""
#: includes/class-m365-login-admin.php:173
msgid "Please enter a valid tenant ID first."
msgstr ""
#. translators: %d: HTTP status code
#: includes/class-m365-login-admin.php:187
msgid "Microsoft answered with HTTP %d. Is the tenant ID correct?"
msgstr ""
#. translators: %d: HTTP status code
#: includes/class-m365-login-admin.php:196
msgid "Tenant reachable. The OpenID configuration was loaded successfully."
msgstr ""
#: includes/class-m365-login-admin.php:219
msgid "Microsoft Graph refused the request. Grant the application permission \"GroupMember.Read.All\" (or \"Directory.Read.All\") with admin consent in Entra ID."
msgstr ""
#: includes/class-m365-login-admin.php:232
msgid "You are not allowed to access this page."
msgstr ""
#: includes/class-m365-login-admin.php:249
msgid "Let existing users sign in with their Microsoft 365 / Entra ID account."
msgstr ""
#: includes/class-m365-login-admin.php:254
msgid "Connected"
msgstr ""
#: includes/class-m365-login-admin.php:254
msgid "Setup incomplete"
msgstr ""
#: includes/class-m365-login-admin.php:262
msgid "Connection"
msgstr ""
#: includes/class-m365-login-admin.php:263
msgid "Button"
msgstr ""
#: includes/class-m365-login-admin.php:264
msgid "Security"
msgstr ""
#: includes/class-m365-login-admin.php:273
msgid "Microsoft Entra ID app registration"
msgstr ""
#: includes/class-m365-login-admin.php:274
msgid "Enter the values from your app registration in the Microsoft Entra admin center."
msgstr ""
#: includes/class-m365-login-admin.php:277
msgid "Directory (tenant) ID"
msgstr ""
#: includes/class-m365-login-admin.php:280
msgid "Test tenant"
msgstr ""
#: includes/class-m365-login-admin.php:282
msgid "Recommended: the GUID of your tenant. Only sign-ins from this tenant are accepted. \"organizations\" allows any work or school account."
msgstr ""
#: includes/class-m365-login-admin.php:287
msgid "Application (client) ID"
msgstr ""
#: includes/class-m365-login-admin.php:292
msgid "Client secret"
msgstr ""
#: includes/class-m365-login-admin.php:294
msgid "•••••••••••• (stored, leave empty to keep)"
msgstr ""
#: includes/class-m365-login-admin.php:294
msgid "Paste the secret value"
msgstr ""
#: includes/class-m365-login-admin.php:295
msgid "Show secret"
msgstr ""
#: includes/class-m365-login-admin.php:300
msgid "Remove the stored secret"
msgstr ""
#: includes/class-m365-login-admin.php:303
msgid "Stored encrypted (AES-256-GCM, key derived from your WordPress salts) and never displayed again. Client secrets expire – note the expiry date in Entra ID."
msgstr ""
#: includes/class-m365-login-admin.php:307
msgid "Account prompt"
msgstr ""
#: includes/class-m365-login-admin.php:309
msgid "Always let the user pick an account (recommended)"
msgstr ""
#: includes/class-m365-login-admin.php:310
msgid "Use the current Microsoft session if available"
msgstr ""
#: includes/class-m365-login-admin.php:311
msgid "Always require re-entering credentials"
msgstr ""
#: includes/class-m365-login-admin.php:320
msgid "Appearance"
msgstr ""
#: includes/class-m365-login-admin.php:323
msgid "Live preview"
msgstr ""
#: includes/class-m365-login-admin.php:337
msgid "Button text"
msgstr ""
#: includes/class-m365-login-admin.php:341
msgid "Divider text"
msgstr ""
#: includes/class-m365-login-admin.php:343
msgid "Leave empty to hide the divider line."
msgstr ""
#: includes/class-m365-login-admin.php:348
msgid "Icon"
msgstr ""
#: includes/class-m365-login-admin.php:351
msgid "Show an icon on the button"
msgstr ""
#: includes/class-m365-login-admin.php:362
msgid "Default: Microsoft logo"
msgstr ""
#: includes/class-m365-login-admin.php:364
msgid "Choose from media library"
msgstr ""
#: includes/class-m365-login-admin.php:365
msgid "Use Microsoft logo"
msgstr ""
#: includes/class-m365-login-admin.php:367
msgid "PNG, SVG, JPG or WebP. Square images (e.g. 64×64 px) work best."
msgstr ""
#: includes/class-m365-login-admin.php:375
msgid "Background"
msgstr ""
#: includes/class-m365-login-admin.php:376
msgid "Background (hover)"
msgstr ""
#: includes/class-m365-login-admin.php:377
msgid "Text colour"
msgstr ""
#: includes/class-m365-login-admin.php:378
msgid "Border"
msgstr ""
#: includes/class-m365-login-admin.php:391
msgid "Corner radius"
msgstr ""
#: includes/class-m365-login-admin.php:395
msgid "Position on the login page"
msgstr ""
#: includes/class-m365-login-admin.php:397
msgid "Below the login form"
msgstr ""
#: includes/class-m365-login-admin.php:398
msgid "Above the login form"
msgstr ""
#: includes/class-m365-login-admin.php:404
msgid "Quick presets"
msgstr ""
#: includes/class-m365-login-admin.php:405
msgid "Microsoft dark"
msgstr ""
#: includes/class-m365-login-admin.php:406
msgid "Microsoft light"
msgstr ""
#: includes/class-m365-login-admin.php:407
msgid "Azure blue"
msgstr ""
#: includes/class-m365-login-admin.php:408
msgid "WordPress blue"
msgstr ""
#: includes/class-m365-login-admin.php:416
msgid "User matching & hardening"
msgstr ""
#: includes/class-m365-login-admin.php:417
msgid "Users are never created automatically. A Microsoft sign-in only succeeds when a WordPress user with the same e-mail address already exists."
msgstr ""
#: includes/class-m365-login-admin.php:422
msgid "Bind WordPress accounts to the Microsoft object ID"
msgstr ""
#: includes/class-m365-login-admin.php:423
msgid "On first sign-in the immutable Microsoft object ID is stored with the user. Later sign-ins with the same e-mail but a different Microsoft identity are rejected. Strongly recommended."
msgstr ""
#: includes/class-m365-login-admin.php:430
msgid "Fall back to the user principal name (UPN)"
msgstr ""
#: includes/class-m365-login-admin.php:431
msgid "If the token contains no \"email\" claim, use the UPN (e.g. jane@contoso.com) when it is a valid e-mail address. Usually required for work accounts."
msgstr ""
#: includes/class-m365-login-admin.php:438
msgid "Keep users signed in (\"Remember me\")"
msgstr ""
#: includes/class-m365-login-admin.php:439
msgid "Issues a 14-day WordPress session instead of a browser session."
msgstr ""
#: includes/class-m365-login-admin.php:444
msgid "Allowed e-mail domains (optional)"
msgstr ""
#: includes/class-m365-login-admin.php:446
msgid "One or more domains separated by commas or new lines. Leave empty to allow any domain of your tenant."
msgstr ""
#: includes/class-m365-login-admin.php:451
msgid "Allowed Entra groups (optional)"
msgstr ""
#: includes/class-m365-login-admin.php:452
msgid "Only members of at least one of these groups may sign in. Leave empty to allow every matched user. Nested memberships count."
msgstr ""
#: includes/class-m365-login-admin.php:455
msgid "Search groups"
msgstr ""
#: includes/class-m365-login-admin.php:457
msgid "Type a group name or paste an object ID…"
msgstr ""
#: includes/class-m365-login-admin.php:458
msgid "Search"
msgstr ""
#: includes/class-m365-login-admin.php:463
msgid "Needs the application permission \"GroupMember.Read.All\" with admin consent. Without it you can still paste group object IDs."
msgstr ""
#: includes/class-m365-login-admin.php:469
msgid "Selected groups"
msgstr ""
#: includes/class-m365-login-admin.php:470
msgid "No groups selected – every matched user may sign in."
msgstr ""
#: includes/class-m365-login-admin.php:480
msgid "Membership is read from the \"groups\" claim of the ID token when present; otherwise the plugin asks Microsoft Graph (application permission \"User.Read.All\" or \"Directory.Read.All\"). If neither works, the sign-in is refused."
msgstr ""
#: includes/class-m365-login-admin.php:485
msgid "Button-only mode"
msgstr ""
#: includes/class-m365-login-admin.php:486
msgid "Hide the username/password form and the \"Lost your password?\" link, and refuse password sign-ins on the login page. Application passwords, REST and XML-RPC are not affected."
msgstr ""
#: includes/class-m365-login-admin.php:491
msgid "Show only the Microsoft button on the login page"
msgstr ""
#: includes/class-m365-login-admin.php:492
msgid "Becomes active once the connection is configured. Make sure your own account can sign in via Microsoft before enabling this."
msgstr ""
#: includes/class-m365-login-admin.php:497
msgid "Fallback link (keep it secret)"
msgstr ""
#: includes/class-m365-login-admin.php:498
msgid "Opening this link shows the password form again in that browser for 30 minutes. Bookmark it somewhere safe – it is your way back in if Microsoft sign-in ever breaks."
msgstr ""
#: includes/class-m365-login-admin.php:506
msgid "Generate a new key when saving"
msgstr ""
#: includes/class-m365-login-admin.php:509
msgid "A key is generated automatically the first time you save these settings."
msgstr ""
#. translators: %s: PHP constant
#: includes/class-m365-login-admin.php:515
msgid "Emergency switch: add %s to wp-config.php to disable button-only mode entirely."
msgstr ""
#. translators: %s: PHP constant
#: includes/class-m365-login-admin.php:524
msgid "What the plugin does to keep sign-ins safe"
msgstr ""
#: includes/class-m365-login-admin.php:526
msgid "OpenID Connect authorization code flow with PKCE (S256) – no tokens ever pass through the browser."
msgstr ""
#: includes/class-m365-login-admin.php:527
msgid "Single-use state and nonce values bound to the browser via an HttpOnly cookie (CSRF and replay protection)."
msgstr ""
#: includes/class-m365-login-admin.php:528
msgid "ID token signature verified against Microsoft’s published signing keys; issuer, audience, tenant, expiry and nonce are checked."
msgstr ""
#: includes/class-m365-login-admin.php:529
msgid "Client secret encrypted at rest; no accounts are created, no passwords are changed."
msgstr ""
#: includes/class-m365-login-admin.php:535
msgid "Save changes"
msgstr ""
#: includes/class-m365-login-admin.php:541
msgid "Redirect URI"
msgstr ""
#: includes/class-m365-login-admin.php:542
msgid "Register this URI in your app registration under Authentication → Web → Redirect URIs:"
msgstr ""
#: includes/class-m365-login-admin.php:548
msgid "Plain permalinks are active, so the callback uses a query string. If you enable pretty permalinks later, the redirect URI changes and must be updated in Entra ID."
msgstr ""
#: includes/class-m365-login-admin.php:551
msgid "Your site does not use HTTPS. Microsoft only accepts http:// redirect URIs for localhost; production sites must use HTTPS."
msgstr ""
#: includes/class-m365-login-admin.php:556
msgid "Setup in 5 steps"
msgstr ""
#: includes/class-m365-login-admin.php:558
msgid "Open the Microsoft Entra admin center → App registrations → New registration."
msgstr ""
#: includes/class-m365-login-admin.php:559
msgid "Choose \"Accounts in this organizational directory only\", set the platform to Web and paste the redirect URI above."
msgstr ""
#: includes/class-m365-login-admin.php:560
msgid "Copy the Application (client) ID and Directory (tenant) ID from the overview page."
msgstr ""
#: includes/class-m365-login-admin.php:561
msgid "Under Certificates & secrets create a client secret and copy its value (not the ID)."
msgstr ""
#: includes/class-m365-login-admin.php:562
msgid "Under Token configuration add the optional claim \"email\" for ID tokens (recommended), then save this page."
msgstr ""
#: includes/class-m365-login-admin.php:564
msgid "Required API permission: openid, profile, email (delegated) – granted by default."
msgstr ""
#: includes/class-m365-login-admin.php:565
msgid "Optional, for group restrictions: application permissions GroupMember.Read.All and User.Read.All (Microsoft Graph) with admin consent."
msgstr ""
#: includes/class-m365-login-admin.php:569
msgid "Shortcode"
msgstr ""
#: includes/class-m365-login-admin.php:570
msgid "Place the button on a custom login page:"
msgstr ""
#: includes/class-m365-login-auth.php:136
msgid "Password sign-in is disabled on this site. Please use the Microsoft button."
msgstr ""
#: includes/class-m365-login-auth.php:751
msgid "Password sign-in is temporarily enabled for this browser (30 minutes)."
msgstr ""
#: includes/class-m365-login-auth.php:758 includes/class-m365-login-graph.php:63
msgid "Microsoft login is not configured yet."
msgstr ""
#: includes/class-m365-login-auth.php:759
msgid "The login request expired or was invalid. Please try again."
msgstr ""
#: includes/class-m365-login-auth.php:760
msgid "Microsoft sign-in was cancelled."
msgstr ""
#: includes/class-m365-login-auth.php:761
msgid "Microsoft returned an error. Please try again."
msgstr ""
#: includes/class-m365-login-auth.php:762
msgid "Could not complete the sign-in with Microsoft. Please try again or contact an administrator."
msgstr ""
#: includes/class-m365-login-auth.php:763
msgid "The Microsoft sign-in could not be verified."
msgstr ""
#: includes/class-m365-login-auth.php:764
msgid "Your Microsoft account did not provide an e-mail address."
msgstr ""
#: includes/class-m365-login-auth.php:765
msgid "Your e-mail domain is not allowed to sign in here."
msgstr ""
#: includes/class-m365-login-auth.php:766
msgid "No WordPress account exists for your Microsoft e-mail address."
msgstr ""
#: includes/class-m365-login-auth.php:767
msgid "This WordPress account is linked to a different Microsoft account. Please contact an administrator."
msgstr ""
#: includes/class-m365-login-auth.php:768
msgid "You are not allowed to sign in with this account."
msgstr ""
#: includes/class-m365-login-auth.php:769
msgid "Your Microsoft account is not a member of a group that is allowed to sign in here."
msgstr ""
#: includes/class-m365-login-auth.php:770
msgid "Your group membership could not be verified. Please contact an administrator."
msgstr ""
#: includes/class-m365-login-auth.php:771
msgid "The fallback key is not valid."
msgstr ""
#: includes/class-m365-login-auth.php:772
msgid "Too many attempts. Please wait 15 minutes."
msgstr ""
#: includes/class-m365-login-graph.php:193
msgid "Group"
msgstr ""
#: includes/class-m365-login-graph.php:195
msgid "Security group"
msgstr ""
#: includes/class-m365-login-graph.php:197
msgid "Microsoft 365 group"
msgstr ""
#: includes/class-m365-login-settings.php:44
msgid "Sign in with Microsoft"
msgstr ""
#: includes/class-m365-login-settings.php:53
msgid "or"
msgstr ""
#: includes/class-m365-login-settings.php:245
msgid "The tenant ID must be a GUID (e.g. 1a2b3c4d-…) or one of \"organizations\", \"common\", \"consumers\"."
msgstr ""
#: includes/class-m365-login-settings.php:253
msgid "The application (client) ID must be a GUID."
msgstr ""
#: includes/class-m365-login-settings.php:265
msgid "The client secret contains invalid characters."
msgstr ""
#: includes/class-m365-login-settings.php:269
msgid "The client secret could not be encrypted. Is the OpenSSL extension available?"
msgstr ""
#: includes/class-m365-login.php:102
msgid "Settings"
msgstr ""
#: includes/class-m365-login.php:113
msgid "M365 Login requires PHP 7.4 or newer."
msgstr ""
#: includes/class-m365-login.php:114 includes/class-m365-login.php:123
msgid "Plugin activation failed"
msgstr ""
#: includes/class-m365-login.php:122
msgid "M365 Login requires the PHP OpenSSL extension (needed to verify Microsoft token signatures and to encrypt the client secret)."
msgstr ""
Reference in a new issue View git blame Copy permalink