Release 5.2.1 of Microsoft plugins for Moodle 5.2 - #71
Merged
Conversation
…url() instead of strpos
… user login is completed
- Dispatch the hook in all three handlelogin() branches (it previously only fired for already-connected users, missing the username-changed and new/unconnected-user paths - the latter being the main case for gating first-time logins). - Dispatch only after authenticate_user_login() succeeds, immediately before complete_user_login(), instead of unconditionally. - Fix the hook's PHPDoc/attribute text and $idtoken property doc, which were copy-pasted from unrelated core hooks. - Add the missing @PARAM tag for the constructor. - Document the login-rejection contract: callbacks reject a login by throwing an exception (e.g. \moodle_exception), since the hook manager does not catch callback exceptions.
- Fix typo "Nofications" -> "Notifications" - Qualify notification frequency as the default schedule, since the scheduled task can be rescheduled by admins - Use "expiry" consistently instead of "expiration" to match other strings in this file
…ed/unknown OIDC login state
…name Manually matched users are keyed by Entra UPN, which often differs from the Moodle username. handlelogin() found the matched user but then discarded it, continuing with the UPN as the username and failing with "User not found in Moodle." Now it binds to the matched user's actual username instead. Also normalizes entraidupn casing on write and read to avoid case-mismatch failures.
…_STABLE # Conflicts: # auth/oidc/db/upgrade.php # auth/oidc/version.php
…_STABLE # Conflicts: # auth/oidc/classes/loginflow/authcode.php # auth/oidc/classes/utils.php # auth/oidc/db/upgrade.php # auth/oidc/version.php
The "Secret expiry notification" section heading was always shown once local_o365 is installed, even when its only field (secret expiry recipients) is JS-hidden because the client authentication method isn't Secret or the IdP type is Other. This left an empty section with just a heading and the page's Save button above it. Apply the same hide_if() conditions to the heading so it hides together with the field it introduces.
auth_oidc_validate_auth_settings() in lib.php (added in a13728f, 'Re-organise configuration pages for auth_oidc and local_o365...') calls get_string('auth_settings_validation_error', 'auth_oidc') to build the notification shown when settings validation fails, but the corresponding lang string was never added. Cherry-picked from #70 (2c8b686)
Bring in line with wip-136768-m405: drop the auth_settings_validation_error added directly after auth_oidcdescription (from #70) and the stale error_masked_secret_not_changed wording that predates the "Change" checkbox UX, replacing both with the current wording already used on m405, in the error-strings block after error_invalid_custom_claim. Also removes a pre-existing upstream duplicate, errorauthdisconnectinvalidmethod (added twice, identically, in 6f8e952 back in 2015). Harmless since both copies had the same value, but redundant.
…s session Microsoft's admin-consent and add-tenant callbacks can arrive via a cross-site navigation that drops the session cookie under SameSite=Lax, kicking the initiating admin back to the login screen instead of completing the flow. Capture the initiating user's id in the OIDC state and re-establish their session on the callback when none is currently active. Hardening applied on top of the base fix, per code review: - Only re-login when there is no active session (or it's a guest), never switching away an already-logged-in different user. - Don't clobber a caller-provided initiatinguserid already present in the state params. - Require sesskey on mode_adminconsent() and mode_tenantsaddgo() so the privileged flow can't be CSRF-initiated. - Invalidate any pending OIDC CSRF state (state row + cookie) on logout, so an explicit logout mid-flow can't be undone by a later callback. - Only allow the initiatinguserid auto-login when CSRF-cookie verification actually ran, closing an unauthenticated-login gap on non-HTTPS deployments without the CSRF cookie.
…v2 IdP When the auth_oidc plugin is configured to use Microsoft identity platform (v2) IdP, the "Microsoft Entra tenant" and "OneDrive for Business URL" settings need to be manual filled after providing admin consent. The local_o365 plugin settings page displays a message about it, but this is invisible unless debugging is turned on. This commit changes how the message is displayed so it's more obvious.
…_STABLE # Conflicts: # auth/oidc/version.php
…onditional Access When the auth_oidc plugin is configured to use Microsoft identity platform (v2.0) IdP, an app-only access token is requested right after admin consent to auto-detect the "Microsoft Entra tenant" and "OneDrive for Business URL" settings. Conditional Access policies can block this specific token request (AADSTS53003) even though admin consent itself succeeded, which previously surfaced as a fatal error page instead of returning the admin to the settings page. This commit catches that specific failure and silently redirects back to the local_o365 settings page instead of throwing a fatal error, since the tenant and OneDrive for Business URL can still be auto-detected via other Graph API calls, so no warning is needed. The re-association of the browser session with the admin who initiated consent is also moved earlier, before the token request, so a failure there no longer leaves the admin looking logged out on the resulting page. Also removes the now-unused local_o365 language string "settings_adminconsent_error_53003".
…_STABLE # Conflicts: # auth/oidc/classes/loginflow/authcode.php
The fix in the previous commit applied hide_if() to the section heading, but core's admin_setting_heading renders only a bare <h3> with no named form control and no .form-item wrapper, so showhidesettings.js cannot target it and the condition was silently ignored. The heading stayed visible with an empty section whenever the client authentication method wasn't Secret or the IdP type was Other. Add auth_oidc_admin_setting_section_heading, which wraps the heading in a .form-item container with a hidden input carrying the setting's form field name, so the admin settings show/hide JavaScript can hide it together with the field it introduces.
…_STABLE # Conflicts: # auth/oidc/settings.php
auth_oidc: reject email addresses that are not valid in the "secret expiry notification recipients" setting when it is saved, both on the admin settings page (new auth_oidc_admin_setting_secretexpiryrecipients class) and in the application configuration wizard form. local_o365: notifysecretexpiry now DNS-checks each configured recipient domain (MX, falling back to A/AAAA) before sending, skips recipients that cannot receive mail, and marks the task as failed so the misconfiguration is visible to admins instead of the address being silently dropped. (cherry picked from commit 975552ce8d3880be725cbfcbccd8cba6307b3cee)
…_STABLE # Conflicts: # auth/oidc/lang/en/auth_oidc.php # auth/oidc/settings.php # auth/oidc/version.php
- Root ci.yml: rebuild matrix internal-deps from each plugin's version.php dependencies (including transitive ones); drop the no-op bare include entries. - Check out all dependency folders via sparse-checkout and move whole directories (keeping dotfiles) into extra-plugins; fail the job if a declared dependency is missing. - Drop MYSQL_USER=root and the MySQL env vars the mariadb image ignores; pin mariadb:10 -> mariadb:10.11. - Add "permissions: contents: read" to every workflow. - Sync per-plugin workflow templates to actions/checkout v6.1.0.
Remove the separate microsoft_365 and microsoft_365_copilot icon images. The current microsoft.svg logo is now used for both Microsoft and Microsoft 365, renamed to microsoft_365.svg and referred to as the Microsoft 365 logo. Sites that had selected the Microsoft or Microsoft 365 Copilot icon are migrated to the Microsoft 365 logo on upgrade.
…_STABLE # Conflicts: # auth/oidc/db/upgrade.php
Lai Wei (weilai-irl)
requested review from
Patryk Mroczko (patmr7)
and
a lite review from Copilot
and removed request for
Copilot
September 2, 2026 11:40
Patryk Mroczko (patmr7)
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.