SSO for Entra ID

1.0.0

First release

1.1.0

• Added support for URL rewrites
• The plugin now receives less data from Microsoft APIs (only the user’s email address)
• The plugin source now contains internationalization comments

2.0.0

• Breaking change: The plugin now matches users based on email address and not UPN
• “Scope” setting has been removed (the plugin now uses the Microsoft Graph API exclusively)
• Account creation can now automatically fill the user’s name from their Azure AD profile
• Account creation can now create usernames without the email domain
• Other minor changes

2.1.0

• The plugin will now automatically convert callback URLs to HTTPS regardless of the site’s URL scheme, except if the hostname is “localhost” or “127.0.0.1”.

2.2.0

• The login start endpoint now uses POST requests (GET requests will be redirected to POST with a self-submitting form)
• The button on the login page will redirect to the login start endpoint with a POST request (only if JavaScript is enabled)
• Added support for receiving login callbacks with POST requests (enable in plugin settings -> “OAuth options” -> “Use POST callbacks”)

2.3.0

• The SSO login button can now be hidden (!5)

2.4.0

• Added the ability to set a different role for users created by this plugin (!6)

2.5.0

• The requirement for login start requests to use POST is now configurable with an option (enabled by default, disable in plugin settings -> “Endpoints” -> “Require POST to Start URL”)
• The button on the login page will only redirect to the login start endpoint with a POST request if the above option is enabled

2.5.1

• Fixed a warning that may occur when logging in directly without a redirect URL
• Fixed the login redirect page being in Quirks Mode (#5)

2.5.2

• Pages managed by this plugin no longer show site content (Contributed on the plugin forum)

2.6.0

• Renamed plugin to “SSO for Entra ID” (Recommended on the plugin forum)
  The plugin still uses the old name in non-user-facing locations (such as IDs and URLs) to avoid breakage. This is not a breaking change.
• Changed default login button text to “Log in with Entra ID”

3.0.0

• Breaking change: The plugin’s user matching behavior has changed.
  The plugin now matches users based on email address and not UPN, which it was supposed to do but didn’t
• General code cleanup
• The OAuth state is now stored in the database and checked with a custom cookie instead of using WordPress nonces
• The login flow now uses PKCE for improved security
  Changes in this release were suggested in a merge request.