friloo
1202283eda
Groups: a Graph-backed picker on the Security tab (search by name or paste object IDs) stores allowed group IDs. During sign-in membership is read from the ID token's groups claim when present, otherwise verified through Microsoft Graph checkMemberGroups (transitive). Verification failures refuse the sign-in. Button-only mode: hides the password form and the lost-password link and rejects password sign-ins on wp-login.php via the authenticate filter. A generated, rate-limited fallback key re-enables the form for 30 minutes per browser; M365_LOGIN_DISABLE_BUTTON_ONLY switches the mode off from wp-config.php. Also: new German-language README with sequence diagram, settings reference, troubleshooting and hook examples; readme.txt external services section now covers Microsoft Graph; translations updated. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJxAHYdMfKPoN4koRc4Ci2
19 lines
1.3 KiB
Markdown
19 lines
1.3 KiB
Markdown
# Changelog
|
||
|
||
All notable changes to this project are documented in this file. The format follows
|
||
[Keep a Changelog](https://keepachangelog.com/) and the plugin adheres to
|
||
[Semantic Versioning](https://semver.org/).
|
||
|
||
## [1.0.0] – 2026-09-22
|
||
|
||
### Added
|
||
- "Sign in with Microsoft" button on `wp-login.php` (OpenID Connect authorization code flow with PKCE).
|
||
- Matching of existing WordPress users by e-mail address (optional UPN fallback), no user provisioning.
|
||
- Settings screen (Settings → M365 Login) with connection, button and security tabs, live button preview, colour presets, media-library icon picker, redirect-URI copy button and tenant connectivity test.
|
||
- ID token verification against Microsoft's JWKS (RS256, issuer, audience, tenant, expiry, nonce).
|
||
- Encrypted client secret storage (AES-256-GCM).
|
||
- Account binding to the Microsoft object ID, e-mail domain allow-list.
|
||
- Entra group restriction with a Graph-powered group picker; membership verified via the `groups` claim or Microsoft Graph `checkMemberGroups`.
|
||
- Button-only mode that hides the password form and blocks password sign-in on `wp-login.php`, with a secret, rate-limited fallback link and a `wp-config.php` emergency constant.
|
||
- `[m365_login_button]` shortcode and developer hooks.
|
||
- German translation.
|