friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 4
wp-m365-login/CHANGELOG.md
friloo 3e3e87b399
Add M365 Login plugin: Microsoft Entra ID sign-in for existing users 
Adds a WordPress plugin that places a customisable "Sign in with
Microsoft" button on wp-login.php and signs existing users in via the
OpenID Connect authorization code flow with PKCE. Users are matched by
e-mail address only; no accounts are created.

Security: single-use state/nonce bound to an HttpOnly cookie, ID token
signature verification against Microsoft's JWKS (RS256 only) with
issuer/audience/tenant/expiry/nonce checks, optional tenant pinning,
account binding to the Microsoft object ID, e-mail domain allow-list,
client secret encrypted at rest (AES-256-GCM).

Admin: settings screen with connection, button and security tabs, live
button preview, colour presets, media-library icon picker, redirect URI
copy button and tenant connectivity test.

Packaging for WordPress.org: readme.txt with External services section,
GPL-2.0 license, uninstall.php, POT + German translations, .distignore,
build script, PHPCS config and CI running Plugin Check.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
2026-09-22 14:21:10 +00:00

964 B
Raw Blame History

Changelog

All notable changes to this project are documented in this file. The format follows Keep a Changelog and the plugin adheres to Semantic Versioning.

[1.0.0] – 2026-09-22

Added

  • "Sign in with Microsoft" button on wp-login.php (OpenID Connect authorization code flow with PKCE).
  • Matching of existing WordPress users by e-mail address (optional UPN fallback), no user provisioning.
  • Settings screen (Settings → M365 Login) with connection, button and security tabs, live button preview, colour presets, media-library icon picker, redirect-URI copy button and tenant connectivity test.
  • ID token verification against Microsoft's JWKS (RS256, issuer, audience, tenant, expiry, nonce).
  • Encrypted client secret storage (AES-256-GCM).
  • Account binding to the Microsoft object ID, e-mail domain allow-list.
  • [m365_login_button] shortcode and developer hooks.
  • German translation.