DOWO
Home Documentation Support Start a project

WordPress Entra Login

Last updated 1 week ago

Sign in to WordPress with Microsoft Entra ID (Azure AD) via OpenID Connect. Multi-factor authentication is enforced by Microsoft through Conditional Access. Local WordPress username/password login can be enabled for individual accounts if needed via a secure login page. Standard accounts will still need to use Entra to log into WordPress.

Features

  • Microsoft Entra SSO using the OpenID Connect Authorization Code flow with PKCE.
  • MFA via Microsoft — Conditional Access / security defaults are honoured automatically; no MFA secrets live in WordPress.
  • Secure token validation — RS256 signature checked against the tenant JWKS, with audience, issuer, expiry, and nonce validation.
  • User mapping by Entra object ID — email is used only for the first match; after that the account is bound to the immutable oid, and the token's tenant must match the configured tenant GUID.
  • Optional auto-provisioning with a configurable default role.
  • Domain allow-list to restrict who may sign in.
  • Hidden local login so the standard form is decluttered for normal users but always reachable for staff.
  • Per-account local-login allow-list — only flagged accounts can sign in with a password or use application passwords for REST/XML-RPC (office@dowo.digital is granted automatically on activation), with a built-in lockout-prevention warning.
  • Credentials via constants — keep the client secret out of the database using wp-config.php.
  • Built to the WordPress Coding Standards.

Requirements

  • WordPress 6.9+
  • PHP 8.2+ with openssl and json
  • HTTPS
  • A Microsoft Entra tenant with permission to register an app

Installation

  1. Copy this folder to wp-content/plugins/dowo-wpentra-login.
  2. Activate DOWO WP Entra Login under Plugins.
  3. Follow the Setup Guide.

Documentation

The detailed guides live in documentation/:

Release history is tracked in CHANGELOG.md.

Development

Coding standards are enforced with PHPCS + WPCS:

composer install
composer test      # phpunit
composer lint      # phpcs
composer lint:fix  # phpcbf
composer deps      # composer outdated, ignoring PHPCS (held at 3.x by WPCS)

Versioning

The plugin version lives in two places that must always agree: the Version: plugin header and the DOWO_WPENTRA_VERSION constant, both in dowo-wpentra-login.php. When bumping the version, update both.

A check enforces this before every commit. Run it manually any time:

composer check-version       # or: php bin/check-version.php

It prints the matching version on success, or highlights the mismatch and exits non-zero on failure.

Enable the bundled pre-commit hook once per clone so the check runs automatically (and blocks the commit on a mismatch):

git config core.hooksPath .githooks

To bypass intentionally: git commit --no-verify.

License

GPL-2.0-or-later.