Troubleshooting

Recovering access (locked out)#

Local login is never truly disabled, so you can always recover.

1. Use the hidden local login URL: wp-login.php?dowo=1 (or your configured key). Sign in with a WordPress account.
2. Deactivate the plugin to restore the standard login form:
   • WP-CLI: wp plugin deactivate dowo-wpentra-login
   • Or rename wp-content/plugins/dowo-wpentra-login via SFTP/SSH.
3. Reset just the hide setting without deactivating:

   wp option patch update dowo_wpentra_settings hide_local_login ''
   

4. Reset a password for a known account: wp user update <user> --user_pass=...
5. Grant local login to an account when the restriction is blocking you:

   wp user meta update <user-or-id> dowo_wpentra_allow_local 1
   

   Or turn the restriction off entirely:

   wp option patch update dowo_wpentra_settings restrict_local_login ''
   

Errors during sign-in#

"AADSTS50011: The redirect URI specified in the request does not match"#

The Redirect URI in Entra doesn't exactly match the plugin's. Copy the value shown at the top of Settings → Entra Login and paste it into the app registration's Authentication → Web → Redirect URIs. It must match character-for-character, including https:// and the ?action=... query.

"AADSTS7000215: Invalid client secret provided"#

The client secret is wrong or expired. Create a new secret in Certificates & secrets, copy the Value (not the Secret ID), and paste it into the plugin. Remember secrets expire — set a rotation reminder.

"AADSTS650053 / scope" or consent errors#

The app needs admin consent in your tenant. In API permissions, click Grant admin consent for <tenant>.

"AADSTS50105: The user is not assigned to a role for the application"#

The Enterprise application has Assignment required = Yes and the user isn't assigned. Assign the user/group under Enterprise applications → Users and groups, or set assignment to No.

"Your Microsoft account domain is not permitted to sign in here."#

The signed-in account's domain isn't in the plugin's Allowed email domains list. Add the domain or clear the field to allow any tenant account.

"No WordPress account matches your Microsoft email address."#

Auto-provisioning is off and no matching WordPress user exists. Either enable Auto-provision users, or create a WordPress user whose email matches the Microsoft account.

"ID token signature verification failed" / "No matching Microsoft signing key"#

Usually a transient issue with cached keys. It self-heals (keys are refetched on a miss), but you can force a refresh by re-saving the settings (which clears the cached discovery document and JWKS), or:

wp transient delete dowo_wpentra_jwks
wp transient delete dowo_wpentra_openid_config

Also confirm the server has the openssl PHP extension enabled.

"Local login is disabled for this account."#

The local-login restriction is on and this account isn't marked Allow local login. Either sign in with the Microsoft button, or have an administrator tick Allow local login on the account's profile (or use the WP-CLI command in the recovery section above).

"Your sign-in session expired or was invalid. Please try again."#

The state transient expired (the flow takes longer than 10 minutes) or cookies/transients aren't persisting. Retry the sign-in. If it persists, check that object caching isn't dropping transients prematurely.

"Could not read the Microsoft Entra discovery document."#

The server cannot reach login.microsoftonline.com. Check outbound HTTPS, firewall/proxy rules, and DNS on the web server.

The Microsoft button doesn't appear#

• Confirm tenant ID, client ID, and client secret are all filled in — the button only shows when the plugin is fully configured.
• Confirm Enable Entra SSO is ticked.
• Clear any page/login cache.

MFA isn't prompting#

MFA is controlled by Entra, not the plugin. Verify your Conditional Access policy (or security defaults) targets the right users and the WordPress app. See MFA.md. Note that already-satisfied MFA in the browser session may not re-prompt.

Diagnostics#

• Entra sign-in logs: Entra admin center → Monitoring → Sign-in logs show each attempt, applied policies, and failure reasons (AADSTS codes).
• WordPress debug log: set WP_DEBUG and WP_DEBUG_LOG to true in wp-config.php and check wp-content/debug.log.