simplesamlphp-changelog.md

SimpleSAMLphp changelog
=======================

<!-- {{TOC}} -->

This document lists the changes between versions of SimpleSAMLphp.
See the upgrade notes for specific information about upgrading.

## Version 1.15.0

Released TBD

### New features
  * Added support for authenticated web proxies with the `proxy.auth` setting.
  * Added new `AttributeValueMap` authproc filter.
  * Added attributemaps for OIDs from SIS (Swedish Standards Institute) and
    for eduPersonUniqueId, eduPersonOrcid and sshPublicKey.
  * Added an option to specify metadata signing and digest algorithm
    `metadata.sign.algorithm`.
  * Added an option for regular expression matching of trusted.url.domains via new
    `trusted.url.regex` setting.
  * The `debug` option is more finegrained and allows one to specify whether
    to log full SAML messages, backtraces or schema validations separately.
  * Added a check for the latest SimpleSAMLphp version on the front page.
    It can be disabled via the new setting `admin.checkforupdates`.
  * Added a warning when there's a probable misconfiguration of PHP sessions.
  * Added ability to define additional attributes on ContactPerson elements
    in metatada, e.g. for use in Sirtfi contacts.
  * Added option to set a secure flag also on the language cookie.
  * Added support for PHP Memcached extension next to Memcache extension.
  * Added Redis as possible session storage mechanism.
  * Added support to specify custom metadata storage handlers.
  * Invalidate opcache after writing a file, so simpleSAMLphp works when
    `opcache.validate_timestamps` is disabled.
  * Metadata converter will deal properly with XML with leading whitespace.
  * Update `ldapwhoami()` call for PHP 7.3.
  * Made response POST page compatible with strict Content Security Policy on
    calling webpage.
  * Updated Greek, Polish, Traditional Chinese and Spanish translations and
    added Afrikaans.

### Bug fixes
  * The deprecated OpenIdP has been removed from the metadata template.
  * Trailing slash is no longer required in `baseurlpath`.
  * Make redirections more resilient.
  * Fixed empty protocolSupportEnumeration in AttributeAuthorityDescriptor.
  * Other bug fixes and numerous documentation enhancements.

### API and user interface
  * Updated to Xmlseclibs 3.0.
    Minimum PHP version is now 5.4, mcrypt requirement dropped.
  * Added a PSR-4 autoloader for modules. Now modules can declare their
    classes under the SimpleSAML\Module namespace.
  * Added new hook for module loader exception handling `exception_handler`.
  * Expose RegistrationInfo in parsed SAML metadata.
  * Introduced Twig templating for user interface.
  * Lots of refactoring, code cleanup and added many unit tests.

### `adfs`
  * Fixed POST response form parameter encoding.

### `authYubiKey`
  * Fixed PHP 7 support.

### `authfacebook`
  * Updated to work with latest Facebook API.

### `authlinkedin`
  * Added setting `attributes` to specify which attributes to request
    from LinkedIn.

### `authtwitter`
  * Added support for fetching the user's email address as attribute.

### `consent`
  * Added support for regular expressions in `consent.disable`.

### `core`
  * Added logging of `REMOTE_ADDR` on successful login.
  * `AttributeMap`: allow fetching mapping files from modules.
  * `ScopeAttribute`: added option `onlyIfEmpty` to add a scope only if
     none was present.
  * `AttributeCopy`: added option to copy to multiple destination attributes.

### `discopower`
  * Added South Africa tab.

### `ldap`
  * Added `search.filter` setting to limit LDAP queries to a custom search
    filter.
  * Added OpenLDAP support in AttributeAddUsersGroups.
  * Fixed for using non standard LDAP port numbers.
  * Fixed configuration option of whether to follow LDAP referrals.

### `memcacheMonitor`
  * Fixed several missing strings.

### `metarefresh`
  * Fixed several spurious PHP notices.

### `multiauth`
  * Fixed selected source timeout.

### `negotiate`
  * Fixed authentication failure on empty attributes-array.
  * Fixed PHP notices concerning missing arguments.

### `oauth`
  * Updated library to improve support for OAuth 1.0 Revision A.

### `radius`
  * Improved error messages.
  * Added parameter `realm` that will be suffixed to the username entered.

### `saml`
  * Handle instead of reject assertions that do not contain a NameID.
  * Added options to configure `AllowCreate` and `SPNameQualifier`.
  * Added option `saml:NameID` to set the Subject NameID in a SAML AuthnRequest.
  * Added filter `FilterScopes` to remove values which are not properly scoped.
  * Make sure we log the user out before reauthenticating.
  * More robust handling of IDPList support in proxy mode.
  * Increased `_authSource` field length in Logout Store.

### `smartattributes`
  * Fix SmartName authproc that failed to load.

### `sqlauth`
  * Fixed SQL schema for usergroups table.

## Version 1.14.16

Released 2017-09-04

  * Resolved a security issue in the consentAdmin module. See [SSPSA 201709-01](https://simplesamlphp.org/security/201709-01).

## Version 1.14.15

Released 2017-08-08

  * Resolved a security issue with the creation and validation of time-limited tokens. See [SSPSA 201708-01](https://simplesamlphp.org/security/201708-01).
  * Fixed an issue with session handling that could lead to crashes after upgrading from earlier 1.14.x versions.
  * Fixed issue #557 with instances of SimpleSAMLphp installed from the repository as well as custom modules.
  * Fixed issue #648 to properly handle SAML responses being sent to reply the same request, but using different response IDs.
  * Fixed issues #612 and #618 with the mobile view of the web interface.
  * Fixed issue #639 related to IdP names containing special characters not being properly displayed by discopower.
  * Fixed issue #571 causing timeouts when using Active Directory as a backend.
  * Other minor fixes.

## Version 1.14.14

Released 2017-05-05

  * Resolved a security issue with in the authcrypt module (Htpasswd authentication source) and in SimpleSAMLphp's session validation. See [SSPSA 201705-01](https://simplesamlphp.org/security/201705-01).
  * Resolved a security issue with in the multiauth module. See [SSPSA 201704-02](https://simplesamlphp.org/security/201704-02).

## Version 1.14.13

Released 2017-04-27

  * Resolved a security issue with unauthenticated encryption in the SimpleSAML\Utils\Crypto class. See [SSPSA 201704-01](https://simplesamlphp.org/security/201704-01).
  * Added requirement for the Multibyte String PHP extension and the corresponding checks.
  * Set a default name for SimpleSAMLphp sessions in the configuration template for the PHP session handler.
  
## Version 1.14.12

Released 2017-03-30

  * Resolved a security issue in the authcrypt module (Htpasswd authentication source) and in SimpleSAMLphp's session validation. See [SSPSA 201703-01](https://simplesamlphp.org/security/201703-01).
  * Resolved a security issue with IV generation in the  `SimpleSAML\Utils\Crypto::_aesEncrypt()` method. See [SSPSA 201703-02](https://simplesamlphp.org/security/201703-02).
  * Fixed an issue with the authfacebook module, broken after a change in Facebook's API.
  * Fixed an issue in the discopower module that ignored the `hide.from.discovery` metadata option.
  * Fixed an issue with trusted URLs validation that prevented a URL from being accepted if a standard port was explicitly included but not specified in the configuration.
  * Fixed an issue that prevented detecting a Memcache server being down when fetching Memcache statistics.
  * Fixed an issue with operating system detection that made SimpleSAMLphp identify OSX as Windows.

## Version 1.14.11

Released 2016-12-12

  * Resolved a security issue involving signature validation of SAML 1.1 messages. See [SSPSA 201612-02](https://simplesamlphp.org/security/201612-02).
  * Fixed an issue when the user identifier used to generate a persistent NameID was missing due to a misconfiguration, causing SimpleSAMLphp to generate the nameID based on the null data type.
  * Fixed an issue when persistent NameIDs were generated out of attributes with empty strings or multiple values.
  * Fixed issue #530. An empty SubjectConfirmation element was causing SimpleSAMLphp to crash. On the other hand, invalid SubjectConfirmation elements were ignored in PHP 7.0.

## Version 1.14.10

Released 2016-12-02

  * Resolved a security issue involving signature validation. See [SSPSA 201612-01](https://simplesamlphp.org/security/201612-01).
  * Fixed issue #517. A misconfigured session when acting as a service provider was leading to a PHP fatal error.
  * Fixed issue #519. Prevent persistent NameIDs from being generated from empty strings.
  * Fixed issue #520. It was impossible to verify Apache's custom MD5 passwords when using the Htpasswd authentication source.
  * Fixed issue #523. Avoid problems caused by different line-ending strategies in the project files.
  * Other minor fixes and enhancements.

## Version 1.14.9

Released 2016-11-10

  * Fixed an issue that resulted in PHP 7 errors being masked.
  * Fixed the smartattributes:SmartName authentication processing filter.
  * Fixed issue #500. When parsing metadata, two 'attributes.required' options were generated.
  * Fixed the list of requirements in composer, the documentation, and the configuration page.
  * Fixed issue #479. There were several minor issues with XHTML compliance.
  * Other minor fixes.

## Version 1.14.8

Released 2016-08-23

  * Fixed an issue in AuthMemCookie causing it to crash when an attribute received contains XML as its value.
  * Fixed an issue in AuthMemCookie that made it impossible to set its own cookie.
  * Fixed an issue when acting as a proxy and receiving attributes that contain XML as their values.
  * Fixed an issue that led to incorrect URL guessing when a script is invoked with a URI that doesn't include its name.

## Version 1.14.7

Released 2016-08-01

  * Fixed issue #424. Attributes containing XML as their values (like eduPersonTargetedID) were empty.

## Version 1.14.6

Released 2016-07-18

  * Fixed issue #418. SimpleSAMLphp was unable to obtain the current URL correctly when invoked from third-party applications.

## Version 1.14.5

Released 2016-07-12

  * Fixed several issues with session handling when cookies couldn't be set for some reason.
  * Fixed an issue that caused wrong URLs to be generated in the web interface under certain circumstances.
  * Fixed the exception handler to be compatible with PHP 7.
  * Fixed an issue in the dropdown IdP selection page that prevented it to work with PHP 5.3.
  * Fixed compatibility with Windows machines.
  * Fixed an issue with the PDO and Serialize metadata storage handlers.
  * Fixed the authwindowslive module. It stopped working after the former API was discontinued.
  * Other minor issues and fixes.

## Version 1.14.4

Released 2016-06-08

  * Fixed two minor security issues that allowed malicious URLs to be presented to the user in a link. Reported by John Page.
  * Fixed issue #366. The LDAP class was trying to authenticate even when no password was provided (using the CAS module).
  * Fixed issue #401. The authenticate.php script was printing exceptions instead of throwing them for the exception handler to capture them.
  * Fixed issue #399. The size limitation of the TEXT type in MySQL was creating problems in certain setups.
  * Fixed issue #5. Incoherent population of the $_SERVER variable was creating broken links when running PHP with FastCGI.
  * Other typos and minor bugs: #389, #392.

## Version 1.14.3

Released 2016-04-19

  * Fixed a bug in the login form that prevented the login button to be displayed in mobile devices.
  * Resolved an issue in the PHP session handler that made it impossible to use PHP sessions simultaneously with other applications.

## Version 1.14.2

Released 2016-03-11

  * Use stable versions of the externalized modules to prevent possible issues when further developing them.

## Version 1.14.1

Released 2016-03-08

  * Resolved an information leakage security issue in the sanitycheck module. See [SSPSA 201603-01](/security/201603-01).

## Version 1.14.0

Released 2016-02-15

### Security

  * Resolved a security issue with multiple modules that were not validating the URLs they were redirecting to.
  * Added a security check to disable loading external entities in XML documents.
  * Enforced admin access to the metadata converter tool.
  * Changed `xmlseclibs` dependency to point to `robrichards/xmlseclibs` version 1.4.1.

### New features

  * Allow setting the location of the configuration directory with an environment variable.
  * Added support for the Metadata Query Protocol by means of the new MDX metadata storage handler.
  * Added support for the Sender-Vouches method.
  * Added support for WantAssertionsSigned and AuthnRequestsSigned in SAML 2.0 SP metadata.
  * Added support for file uploads in the metadata converter.
  * Added support for setting the prefix for Memcache keys.
  * Added support for the Hide From Discovery REFEDS Entity Category.
  * Added support for the eduPersonAssurance attribute.
  * Added support for the full SCHAC 1.5.0 schema.
  * Added support for UNIX sockets when configuring memcache servers.
  * Added the SAML NameID to the attributes status page, when available.
  * Added attribute definitions for schacGender (schac), sisSchoolGrade and sisLegalGuardianFor (skolfederation.se).
  * Attributes required in metadata are now taken into account when parsing.

### Bug fixes

  * Fixed an issue with friendly names in the attributes released.
  * Fixed an issue with memcache that would result in a push for every fetch, when several servers configured.
  * Fixed an issue with memcache that would result in an endless loop if all servers are down.
  * Fixed an issue with HTML escaping in error reports.
  * Fixed an issue with the 'admin.protectmetadata' option not being enforced for SP metadata.
  * Fixed an issue with SAML 1.X SSO authentications that removed the NameID of the subject from available data.
  * Fixed an issue with the login form that resulted in a `NOSTATE` error if the user clicked the login button twice.
  * Fixed an issue with replay detection in IdP-initiated flows.
  * Fixed an issue with SessionNotOnOrAfter that kept moving forward in the future with every SSO authentication.
  * Fixed an issue with the session cookie being set twice for the first time.
  * Fixed an issue with the XXE attack prevention mechanism conflicting with other applications running in the same server.
  * Fixed an issue that prevented the SAML 1.X IdP to restart when the session is lost.
  * Fixed an issue that prevented classes using namespaces to be loaded automatically.
  * Fixed an issue that prevented certain metadata signatures to be verified (fixed upstream in `xmlseclibs`).
  * Other bug fixes and numerous documentation enhancements.

### API and user interface

  * Added a new and simple database class to serve as PDO interface for all the database needs.
  * Added the possibility to copy metadata and other elements by clicking a button in the web interface.
  * Removed the old, unused `pack` installer tool.
  * Improved usability by telling users the endpoints are not to be accessed directly.
  * Moved the hostname, port and protocol diagnostics tool to the admin directory.
  * Several classes and functions deprecated.
  * Changed the signature of several functions.
  * Deleted old and deprecated code, interfaces and endpoints.
  * Deleted old jQuery remnants.
  * Deleted the undocumented dynamic XML metadata storage handler.
  * Deleted the backwards-compatible authentication source.
  * Updated jQuery to the latest 1.8.X version.
  * Updated translations.

### `authcrypt`

  * Added whitehat101/apr1-md5 as a dependency for Apache htpasswd.

### `authX509`

  * Added an authentication processing filter to warn about certificate expiration.

### `ldap`

  * Added a new `port` configuration option.
  * Better error reporting.

### `metaedit`

  * Removed the `admins` configuration option.

### `metarefresh`

  * Added the possibility to specify which types of entities to load.
  * Added the possibility to verify metadata signatures by using the public key present in a certificate.
  * Fix `certificate` precedence over `fingerprint` in the configuration options when verifying metadata signatures.

### `smartnameattribute`

  * This module was deprecated long time ago and has now been removed. Use the `smartattributes` module instead.

## Version 1.13.2

Released 2014-11-04

  * Solved performance issues when processing large metadata sets.
  * Fix an issue in the web interface when only one language is enabled.

## Version 1.13.1

Released 2014-10-27

  * Solved an issue with empty fields in metadata to cause SimpleSAMLphp to fail with a translation error. Issues #97 and #114.
  * Added Basque language to the list of known languages. Issue #117.
  * Optimized the execution of redirections by removing an additional, unnecessary function call.
  * Solved an issue that caused SimpleSAMLphp to fail when the RelayState parameter was empty or missing on an IdP-initiated authentication. Issues #99 and # 104.
  * Fixed a certificate check for SubjectConfirmations with Holder of Key methods.

## Version 1.13

Released 2014-09-25.

  * Added the 'remember me' option to the default login page.
  * Improved error reporting.
  * Added a new 'logging.format' option to control the formatting of the logs.
  * Added support for the 'objectguid' binary attribute in LDAP modules.
  * Added support for custom search and private attributes read credentials in all LDAP modules.
  * Added support for the WantAuthnRequestsSigned option in generated SAML metadata.
  * Tracking identifiers are no longer generated based on MD5.
  * Several functions, classes and interfaces marked as deprecated.
  * Bug fixes and documentation enhancements.
  * Updated translations.
  * New language: Basque.

### `adfs`

  * Honour the 'wreply' parameter when redirecting.

### `aggregator`

  * Fixed an issue when regenerating metadata from certain metadata sources.

### `discopower`

  * Bug fix.

### `expirycheck`

  * Translations are now possible for this module.

### `metarefresh`

  * Use cached metadata if something goes wrong when refreshing feeds.

### `openidProvider`

  * Fix for compatibility with versions of PHP greater or equal to 5.4.

### `saml`

  * Make it possible to add friendly names to attributes in SP metadata.
  * The RSA_1.5 (RSA with PKCS#1 v1.5 padding) encryption algorithm is now blacklisted by default for security reasons.
  * Stop checking the 'IDPList' parameter in IdPs.
  * Solved an issue that allowed bypassing authentication status checks when presenting an 'IDPList' parameter.
  * The 'Destination' attribute is now always sent in logout responses issued by an SP.

### `sqlauth`

  * Updated documentation to remove bad practice with regard to password storage.

## Version 1.12

Released 2014-03-24.

  * Removed example authproc filters from configuration template.
  * Stopped using the 'target-densitydpi' option removed from WebKit.
  * The SimpleSAML_Utilities::generateRandomBytesMTrand() function is now deprecated.
  * Removed code for compatibility with PHP versions older than 5.3.
  * Removed the old interface of SimpleSAML_Session.
  * Fixed a memory leak in SimpleSAML_Session regarding serialization and unserialization.
  * Support for RegistrationInfo (MDRPI) elements in the metadata of identity and service providers.
  * Renamed SimpleSAML_Utilities::parseSAML2Time() function to xsDateTimeToTimestamp().
  * New SimpleSAML_Utilities::redirectTrustedURL() and redirectUntrustedURL() functions.
  * Deprecated the SimpleSAML_Utilities::redirect() function.
  * Improved Russian translation.
  * Added Czech translation.
  * New 'errorreporting' option to enable or disable error reporting feature.
  * Example certificate removed.
  * New SimpleSAML_Configuration::getEndpointPrioritizedByBinding() function.
  * PHP 5.3 or newer required.
  * Started using Composer as dependency manager.
  * Detached the basic SAML2 library and moved to a standalone library in github.
  * Added support for exporting shibmd:Scope metadata with regular expressions.
  * Remember me option in the IdP.
  * New SimpleSAML_Utilities::setCookie wrapper.
  * Custom HTTP codes on error.
  * Added Romanian translation.
  * Bug fixes and documentation enhancements.

### `adfs`

  * Support for exporting metadata.

### `aggregator`

  * Support for RegistrationInfo (MDRPI) elements in the metadata.
  * Fix for HTTP header injection vulnerability.
  * Fix for directory traversal vulnerability.

### `aggregator2`

  * Support for RegistrationInfo (MDRPI) elements in the metadata.

### `aselect`

  * License changed to LGPL 2.1.

### `authfacebook`

  * Updated extlibinc to 3.2.2.

### `authtwitter`

  * Added 'force_login' configuration option.

### `cdc`

  * Bugfix related to request validation.

### `core`

  * The AttributeAlter filter no longer throws an exception if the attribute was not found.
  * Support for removal of values in the AttributeAlter filter, with '%remove' flag.
  * Support for empty strings and NULL values as a replacement in the AttributeAlter filter.
  * Bugfixes in the AttributeAlter filter.
  * Support for NULL attribute values.
  * Support for limiting values and not only attributes in the AttributeLimit filter.
  * Log a message when a user authenticates successfully.
  * Added %duplicate flag to AttributeMap, to leave original names in place when using map file.
  * Fix infinite loop when overwriting attributes with AttributeMap.

### `discopower`

  * Bugfix for incorrect handling of the 'idpdisco.extDiscoveryStorage' option.

### `ldap`

  * Support for configuring the duplicate attribute handling policy in AttributeAddFromLDAP, 'attribute.policy' option.
  * Support for binary attributes in the AttributeAddFromLDAP filter.
  * Support for multiple attributes in the AttributeAddFromLDAP filter.

### `metarefresh`

  * Support for specifying permissions of the resulting files.

### `negotiate`

  * Added support for "attributes"-parameter.

### `oauth`

  * Bugfix related to authorize URL building.

### `openidProvider`

  * Support for SReg and AX requests.

### `saml`

  * Send 'isPassive' in passive discovery requests.
  * Support for generating NameIDFormat in service providers with NameIDPolicy set.
  * Support for AttributeConsumingService and AssertionConsumingServiceIndex.
  * Support for the HTTP-POST binding in WebSSO profile.
  * Fix for entity ID validation problems when using the IDPList configuration option.

### `smartattributes`

  * New 'add_candidate' option to allow the user to decide whether to prepend or not the candidate attribute name to the resulting value.

### `statistics`

  * Bugfix in statistics aggregator.

## Version 1.11

Released 2013-06-05.

  * Support for RSA_SHA256, RSA_SHA384 and RSA_SHA512 in HTTP Redirect binding.
  * Support for RegistrationInfo element in SAML 2.0 metadata.
  * Support for AuthnRequestsSigned and WantAssertionsSigned when generating metadata.
  * Third party OpenID library updated with a bugfix.
  * Added the Name attribute to EntitiesDescriptor.
  * Removed deprecated option 'session.requestcache' from config-template.
  * Workaround for SSL SNI extension not being correctly set.
  * New language cookie and parameter config options.
  * Add 'module.enable' configuration option for enabling/disabling modules.
  * Check for existence of memcache extension. 
  * Initial support for limiting redirects to trusted hosts.
  * Demo example now shows both friendly and canonical name of the attributes.
  * Other minor fixes for bugs and typos.
  * Several translations updated.
  * Added Latvian translation.

### `authorize`

  * Added a logout link to the 403 error page.

### `authtwitter`

  * Updated API endpoint for version 1.1.
  * Fix for oauth_verifier parameter.

### `authX509`

  * ldapusercert validation made optional.

### `consent`

  * Added support for SQLite databases.

### `core`

  * Fix error propagation in UserPass(Org)Base authentication sources.
  * MCrypt module marked as required.

### `discopower`

  * Get the name of an IdP from mdui:DisplayName.

### `expirycheck`

  * PHP 5.4 compatibility fixes.

### `InfoCard`

  * PHP 5.4 compatibility fixes.

### `ldap`

  * Added an option to disable following referrals.

### `metarefresh`

  * Improved help message.

### `oauth`

  * PHP 5.4 compatibility fixes.

### `saml`

  * Verify that the issuer of an AuthnResponse is the same entity ID we sent a request to.
  * Added separate option to enable Holder of Key support on SP.
  * Fix for HoK profile metadata.
  * New filter for storing persistent NameID in eduPersonTargetedID attribute.
  * Support for UIInfo elements.
  * Bugfix for SAML SP metadata signing.
  * Ignore default technical contact.
  * Support for MDUI elements in SP metadata.
  * Support for more contact types in SP metadata.
  * New information in statistics with the time it took for a login to happen.

### `sanitycheck`

  * Configuration file made optional.

### `smartattributes`

  * New filter: smartattributes:SmartID.
  * New filter: smartattributes:SmartName.

### `smartnameattribute`

  * Deprecated.

### `wsfed`

  * Support for SLO in WS-Fed.

## Version 1.10

Released 2012-09-25.

  * Add support for storing data without expiration timestamp in memcache.
  * Fix for reauthentication in old shib13 authentication handler.
  * Clean up executable-permissions on files.
  * Change encryption to use the rsa-oaep-mgf1p key padding instead of PKCS 1.5.
  * Update translations.
  * Added Serbian translation.

### `core`

  * `core:UserPass(Org)Base`: Add "remember username" option.

### `papi`

  * New authentication module supporting PAPI protocol.

### `radius`

  * New feature to configure multiple radius servers.

### `riak`

  * New module for storing sessions in a Riak database.

### `saml`

  * Add support for overriding SAML 2.0 SP authentication request generation.
  * Add support for blacklisting encryption algorithms.

## Version 1.9.2

Released 2012-08-29

  * Fix related to the security issue addressed in version 1.9.1.

## Version 1.9.1

Released 2012-08-02.

  * Fix for a new attack against PKCS 1.5 in XML encryption.

## Version 1.9

Released 2012-06-13.

  * Restructure error templates to share a common base template.
  * Warnings about URL length limits from Suhosin PHP extension.
  * New base class for errors from authentication sources.
  * Support for overriding URL generation when behind a reverse proxy.
  * New languages: Russian, Estonian, Hebrew, Chinese, Indonesian
  * Add getAuthSource()-function to SimpleSAML_Auth_Simple.
  * Add reauthenticate()-function to SimpleSAML_Auth_Source. (Is called when the IdP receives a new authentication request.)
  * iframe logout: Make it possible to skip the "question-page" for code on the IdP.
  * RTL text support.
  * Make SimpleSAMLAuthToken cookie name configurable.
  * Block writing secure cookies when we are on http.
  * Fix state information being unavailable to UserPassOrgBase authentication templates.
  * Make it possible to send POST-messages to http-endpoints without triggering a warning when the IdP supports both http and https.
  * Add IPv6-support to the SimpleSAML_Utilities::ipCIDRcheck()-function.
  * Do not allow users to switch to a language that is not enabled.
  * iframe logout: Add a per-SP timeout option.
  * SimpleSAML_Auth_LDAP: Better logging of the cause of exceptions.
  * SimpleSAML_Auth_State: Add $allowMissing-parameter to loadState().
  * module.php: More strict URL parsing.
  * Add support for hashed admin passwords.
  * Use openssl_random_pseudo_bytes() for better cross-platform random number generation.
  * Add the current hostname to the error reports.
  * Make the lifetime of SimpleSAML_Auth_State "state-arrays" configurable (via the `session.state.timeout`-option).
  * SimpleSAML_Auth_State: Add cloneState()-function.
  * Fix log levels used on Windows.
  * SimpleSAML_Auth_LDAP: Clean up some unused code.
  * core:UserPassOrgBase: Add selected organization to the authentication data that is stored in the session.
  * Do not warn about missing Radius and LDAP PHP extensions unless those modules are enabled.
  * Support for overriding the logic to determine the language.
  * Avoid crashes due to deprecation-warnings issued by PHP.
  * Use case-insensitive matching of language codes.
  * Add X-Frame-Options to prevent other sites from loading the SSP-pages in an iframe.
  * Add SimpleSAML_Utilities::isWindowsOS()-helper function.
  * chmod() generated files to only be accessible to the owner of the files.
  * Fix "re-posting" of POST data containing a key named "submit".
  * Do not attempt to read new sessions from the session handler.
  * Fix some pass-by-reference uses. (Support removed in PHP 5.4.)
  * Warn the user if the secretsalt-option isn't set.
  * A prototype for a new statistics logging core. Provides more structured logging of events, and support for multiple storage backends.
  * Support for arbitrary namespace-prefixed attributes in md:EndpointType-elements.
  * Fix invalid HTML for login pages where username is set.
  * Remove unecessary check for PHP version >= 5.2 when setting cookies.
  * Better error message when a module is missing a default-enable or default-disable file.
  * Support for validating RSA-SHA256 signatures.
  * Fixes for session exipration handling.

### `aselect`

  * New module that replaces the previous module.
  * Better error handling.
  * Support for request signing.
  * Loses support for A-Select Cross.

### `authcrypt`

  * `authcrypt:Hash`: New authentication source for checking username & password against a list of usernames and hashed passwords.
  * `authcrypt:Htpasswd`: New authentication source for checking username & password against a `.htpasswd`-file.

### `authfacebook`

  * Update to latest Facebook PHP SDK.

### `authorize`

  * `authorize:Authorize`: Add flag to change the behaviour from default-deny to default-allow.
  * `authorize:Authorize`: Add flag to do simple string matching instead of regex-matching.

### `authtwitter`

  * Update to use the correct API endpoint.
  * Propagate "user aborted" errors back to the caller.
  * Changes to error handling, throw more relevant exceptions.
  * Store state information directly in the state array, instead of the session.

### `authYubiKey`

  * Remove deprecated uses of split().

### `cas`

  * Make it possible for subclasses to override finalState().

### `core`

  * `core:AttributeCopy`: New filter to copy attributes.

### `consent`

  * Add a timeout option for the database connection.
  * Fix disabling of consent when the data store is down.
  * Simpler configuration for disabling consent for one SP or one IdP.
  * Do not connect to the database when consent is disabled for the current SP/IdP.

### `consentAdmin`

  * Fix for bridged IdP setup with `userid.attribute` set in `saml20-idp-hosted` metadata.

### `cron`

  * Set the From-address to be the technical contact email address.

### `expirycheck`

  * `expirycheck:ExpiryDate`: New module to check account expiration.

### `ldap`

  * Add a base class for authentication processing filters which fetch data from LDAP.
  * `ldap:AttributeAddUsersGroups`: Authentication processing filter that adds group information from LDAP.

### `metarefresh`

  * Support for blacklisting and whitelisting entities.
  * Support for conditional GET of metadata files.
  * Reuse old metadata when fetching metadata fails.

### `multiauth`

  * Add `multiauth:preselect`-parameter, to skip the page to select authentication source.
  * Make it possible to configure the names of the authentication sources.
  * Remember the last selected authentication source.

### `negotiate`

  * New module implementing "negotiate" authentication, which can be used for Kerberos authentication (including Windows SSO).

### `oauth`

  * Update to latest version of the OAuth library.
  * Remove support for older versions of OAuth than OAuth Rev A.

### `openid`

  * Separate linkback URL from page displaying OpenID URL field.
  * Throw more relevant exceptions.
  * Update to latest version of the OpenID library.
  * Support for sending authentication requests via GET requests (with the prefer_http_redirect option).
  * Prevent deprecation warnings from the OpenID library from causing deadlocks in the class loader.

### `openidProvider`

  * Prevent deprecation warnings from the OpenID library from causing deadlocks in the class loader.

### `radius`

  * Support for setting the "NAS-Identifier" attribute.

### `saml`

  * Preserve ID-attributes on elements during signing. (Makes it possible to change the binding for some messages.)
  * Allow SAML artifacts to be received through a POST request.
  * Log more debug information when we are unable to determine the binding a message was sent with.
  * Require HTTP-POST messages to be sent as POST data and HTTP-Redirect messages to be sent as query parameters.
  * Link to download certificates from metadata pages.
  * Fix canonicalization of &lt;md:EntityDescriptor> and &lt;md:EntitiesDescriptor>.
  * Support for receiving and sending extension in authentication request messages.
  * Reuse SimpleSAML_Utilities::postRedirect() to send HTTP-POST messages.
  * Allow ISO8601 durations with subsecond precision.
  * Add support for parsing and serializing the &lt;mdrpi:PublicationInfo> metadata extension.
  * Ignore cacheDuration when validating metadata.
  * Add support for the Holder-of-Key profile, on both the [SP](./simplesamlphp-hok-sp) and [IdP](./simplesamlphp-hok-idp).
  * Better error handling when receiving a SAML 2.0 artifact from an unknown entity.
  * Fix parsing of &lt;md:AssertionIDRequestService> metadata elements.
  * IdP: Do not always trigger reauthentication when the authentication request contains a IdPList-element.
  * IdP: Add `saml:AllowCreate` to the state array. This makes it possible to access this parameter from authentication processing filters.
  * IdP: Sign the artifact response message.
  * IdP: Allow the "host" metadata option to include more than one path element.
  * IdP: Support for generating metadata with MDUI extension elements.
  * SP: Use the discojuice-module as a discovery service if it is enabled.
  * SP: Add `saml:idp`-parameter to trigger login to a specific IdP to as_login.php.
  * SP: Do not display error on duplicate response when we have a valid session.
  * SP: Fix for logout after IdP initiated authentication.
  * SP: Fix handling of authentication response without a saml:Issuer element.
  * SP: Support for specifying required attributes in metadata.
  * SP: Support for limiting the AssertionConsumerService endpoints listed in metadata.
  * SP: Fix session expiration when the IdP limits the session lifetime.
  * `saml:PersistentNameID`: Fail when the user has more than one value in the user ID attribute.
  * `saml:SQLPersistentNameID`: Persistent NameID stored in a SQL database.
  * `saml:AuthnContextClassRef`: New filter to set the AuthnContextClassRef in responses.
  * `saml:ExpectedAuthnContextClassRef`: New filter to verify that the SP received the correct authentication class from the IdP.

## Version 1.8.2

Released 2012-01-10.

  * Fix for user-assisted cross site scripting on a couple of pages.

## Version 1.8.1

Released 2011-10-27.

  * Fix for key oracle attack against XML encryption on SP.
  * Fix for IdP initiated logout with IdP-initiated SSO.
  * Fix a PHP notice if we are unable to open /dev/urandom.
  * Fix a PHP notice during SAML 1.1 authentication.

## Version 1.8

  * New authentication modules:
      * [`authmyspace`](./authmyspace:oauthmyspace)
      * [`authlinkedin`](./authlinkedin:oauthlinkedin)
      * [`authwindowslive`](./authwindowslive:windowsliveid)
  * Support for custom error handler, replacing the default display function.
  * Allow error codes to be defined in modules.
  * Better control of logout what we do after logout request.
      * This makes it possible for the SP to display a warning when receiving a PartialLogout response from the IdP.
  * New `cdc` module, for setting and reading common domain cookies.

### `consent`

  * Support for disabling consent for some attributes.

### `ldap`

  * `ldap:AttributeAddFromLDAP`: Extract values from multiple matching entries.

### `oauth`

  * Added support for:
      * RSASHA1 signatures
      * consent
      * callbackurl
      * verifier code
      * request parameters

### `openid`

  * Support for sending custom extension arguments (e.g. UI extensions).

### `saml`

  * Extract Extensions from AuthnRequest for use by custom modules when authenticating.
  * Allow signing of SP metadata.
  * Better control over NameIDPolicy when sending AuthnRequest.
  * Support encrypting/decrypting NameID in LogoutRequest.
  * Option to disable client certificate in SOAP client.
  * Better selection of AssertionConsumerService endpoint based on parameters in AuthnRequest.
  * Set NotOnOrAfter in IdP LogoutRequest.
  * Only return PartialLogout from the IdP.


## Version 1.7

  * New authentication modules:
      * `aselect`
      * `authX509`
  * Unified cookie configuration settings.
  * Added protection against session fixation attacks.
  * Error logging when failing to initialize the Session class.
  * New session storage framework.
      * Add and use generic key/value store.
      * Support for storing sessions in SQL databases (MySQL, PostgreSQL & SQLite).
      * Support for implementing custom session storage handlers.
      * Allow loading of multiple sessions simultaneously.
  * Set headers allowing caching of static files.
  * More descriptive error pages:
      * Unable to load $state array because the session was lost.
      * Unable to find metadata for the given entityID.
  * Support for multiple keys in metadata.
      * Allow verification with any of the public keys in metadata.
      * Allow key rollower by defining new and old certificate in configuration.
      * Verify with signing keys, encrypt with encryption keys.
  * Change `debug`-option to log messages instead of displaying them in the browser.
      * Also logs data before encryption and after decryption.
  * Support for custom attribute dictionaries.
  * Add support for several authentication sessions within a single session.
      * Allows several SPs on a single host.
      * Allows for combining an SP and an IdP on a single host.
  * HTTP proxy support.

### Internal API changes & features removed

  * The `saml2` module has been removed.
      * The `saml2:SP` authsource has been removed.
      * The `sspmod_saml2_Error` class has been renamed to `sspmod_saml_Error`.
      * The `sspmod_saml2_Message` class has been renamed to `sspmod_saml_Message`.
  * Moved IdP functions from `sspmod_saml_Message` to `sspmod_saml_IdP_SAML2`.
  * Removed several functions and classes that are unused:
      * `SimpleSAML_Utilities::strleft`
      * `SimpleSAML_Utilities::array_values_equal`
      * `SimpleSAML_Utilities::getRequestURI`
      * `SimpleSAML_Utilities::getScriptName`
      * `SimpleSAML_Utilities::getSelfProtocol`
      * `SimpleSAML_Utilities::cert_fingerprint`
      * `SimpleSAML_Utilities::generateTrackID`
      * `SimpleSAML_Utilities::buildBacktrace`
      * `SimpleSAML_Utilities::formatBacktrace`
      * `SimpleSAML_Metadata_MetaDataStorageHandlerSAML2Meta`
      * `SimpleSAML_ModifiedInfo`
  * Moved function from Utilities-class to more appropriate locations.
      * `getAuthority` to `SimpleSAML_IdP`
      * `generateUserId` to `sspmod_saml_IdP_SAML2`.
  * Replaced calls to  with throwing an `SimpleSAML_Error_Error` exception.
  * Removed metadata send functionality from old SP code.
  * Removed bin/test.php and www/admin/test.php.
  * Removed metashare.
  * Removed www/auth/login-auto.php.
  * Removed www/auth/login-feide.php.
  * Removed optional parameters from `SimpleSAML_XHTML_Template::getLanguage()`.
  * Removed functions from `SAML2_Assertion`: `get/setDestination`, `get/setInResponseTo`.
    Replaced with `setSubjectConfirmation`.
  * Removed several unused files & templates.

### SAML 2 IdP

  * Support for generation of NameID values via [processing filters](./saml:nameid)
  * Obey the NameIDPolicy Format in authentication request.
  * Allow AuthnContextClassRef to be set by processing filters.
  * Rework iframe logout page to not rely on cookies.

### SAML 2 SP

  * Support SOAP logout.
  * Various fixes to adhere more closely to the specification.
      * Allow multiple SessionIndex-elements in LogoutRequest.
      * Handle multiple Assertion-elements in Response.