friloo/wp-m365-login
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 4
wp-m365-login/CHANGELOG.md
friloo 8766927123
Add certificate authentication, in-app setup guides and security audit 
Certificate (RFC 7523 client assertion) as an alternative to the client
secret: one-click generation of a 3072-bit RSA key pair with a
self-signed certificate, .cer download (public part only), own PEM
upload with validation, expiry display, encrypted key storage. Both the
authorization code exchange and the Graph client-credentials request
use the selected method. Step-by-step guides for secret, certificate
and the app registration are shown in the settings.

Security audit (docs/security-audit.md) and fixes:
- Multi-tenant mode ignored the unverified email claim: matching now
  uses the UPN only, or the email claim when xms_edov is true.
- Login starts are rate limited per client (30 per 10 minutes).
- Optional trusted proxy header for client IPs
  (M365_LOGIN_CLIENT_IP_HEADER / filter).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
2026-09-22 15:04:32 +00:00

1.9 KiB
Raw Blame History

Changelog

All notable changes to this project are documented in this file. The format follows Keep a Changelog and the plugin adheres to Semantic Versioning.

[1.0.0] – 2026-09-22

Added

  • "Sign in with Microsoft" button on wp-login.php (OpenID Connect authorization code flow with PKCE).
  • Matching of existing WordPress users by e-mail address (optional UPN fallback), no user provisioning.
  • Settings screen (Settings → M365 Login) with connection, button and security tabs, live button preview, colour presets, media-library icon picker, redirect-URI copy button and tenant connectivity test.
  • ID token verification against Microsoft's JWKS (RS256, issuer, audience, tenant, expiry, nonce).
  • Encrypted client secret storage (AES-256-GCM).
  • Certificate based client authentication (RFC 7523 private_key_jwt): one-click generation of a 3072-bit RSA key pair with self-signed certificate, .cer download, own PEM upload, expiry display; step-by-step guides for both methods in the settings.
  • Security audit (docs/security-audit.md) with fixes: unverified email claim ignored in multi-tenant mode, login-start rate limit, trusted proxy IP header.
  • Account binding to the Microsoft object ID, e-mail domain allow-list.
  • Entra group restriction with a Graph-powered group picker; membership verified via the groups claim or Microsoft Graph checkMemberGroups.
  • Button-only mode that hides the password form and blocks password sign-in on wp-login.php, with a secret, rate-limited fallback link and a wp-config.php emergency constant.
  • Custom login page support: automatic button in wp_login_form() forms, m365_login_button() / m365_login_messages() template functions, custom login URL for error messages, fallback link and logout redirect.
  • [m365_login_button] shortcode (with divider and messages attributes) and developer hooks.
  • German translation.