feat: optionally add domain_hint

[gjasny]

Providing a domain hint allows to bypass the account selector on Microsoft side in case more than one account has been used in the Browser in the past. Documentation for the parameter is here.

Testing done

I locally built the plugin and installed the hpi file into a Jenkins 2.462.1. After adding our domain to the new input field I opened a separate browser. There the user account selector was bypassed and I got logged directly into Jenkins.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

I don't know how and where to add a test for the feature.

Please consider to merge and release a new plugin version.

Thanks,
Gregor

[KalleOlaviNiemitalo]

At Home Realm Discovery for an application, it says

Microsoft doesn't recommend configuring auto-acceleration any longer, as it can prevent the use of stronger authentication methods such as FIDO and hinders collaboration.

which I think applies to the domain_hint parameter.

The "hinders collaboration" part does not matter if Jenkins or Entra ID has already been configured to require all users to be in the same domain. I'm not sure about the effect on FIDO, though.

IMO, it's okay to support the domain_hint parameter in this plugin; but if there are downsides to setting it, then the help text should link to related documentation.

[gjasny]

At Home Realm Discovery for an application, it says

Microsoft doesn't recommend configuring auto-acceleration any longer, as it can prevent the use of stronger authentication methods such as FIDO and hinders collaboration.

IMO, it's okay to support the domain_hint parameter in this plugin; but if there are downsides to setting it, then the help text should link to related documentation.

I tested it with FIDO2 authentication and it still works.

[timja]

the label would normally just be the field name and then either a description or help text to explain what its for