Add deprecation notices

docs/simplesamlphp-changelog.md

@@ -14,6 +14,8 @@ Released TBD
   * Allow to log to STDERR in the logging.handler option.
   * Allow use of stream wrappers (e.g. s3://) in paths.
   * Improve 'update or insert' handling for different SQL drivers
+  * The default algorithm within the TimeLimitedToken-class has been bumped from SHA-1 to SHA-256
+    as announced by deprecation notice in 1.15-RC1
 
 ### metarefresh
   * The algorithm to compute the fingerprint of the certificate that signed
@@ -30,6 +32,14 @@ Released TBD
 ### Interoperability
   * The minimum PHP version required is now 5.6.
 
+### Deprecation
+  * The class SimpleSAML\Auth\TimeLimitedToken is now deprecated and will be removed in a future release
+    If your custom module relies on this class, be sure to make a copy into your repository and
+    make sure to also copy the unit tests that come along.
+  * Setting 'privacypolicy' in metadata-files will be removed in a future release. It was only used
+    by the consent-module, which supports UIInfo's PrivacyStatementURL.
+    See https://simplesamlphp.org/docs/stable/simplesamlphp-metadata-extensions-ui on how to configure this.
+
 ## Version 1.17.5
 
 Released 2019-08-02

docs/simplesamlphp-reference-idp-hosted.md

@@ -123,6 +123,8 @@ Common options
     any value in the SP-remote metadata overrides the one configured
     in the IdP metadata.
 
+:   *Note*: **deprecated** Will be removed in a future release; use the MDUI-extension instead
+
 `privatekey`
 :   Name of private key file for this IdP, in PEM format. The filename
     is relative to the `cert/`-directory.

docs/simplesamlphp-reference-sp-remote.md

@@ -98,6 +98,8 @@ and Shibboleth 1.3 protocol:
     entry in the SP-remote metadata overrides the option in the
     IdP-hosted metadata.
 
+:   *Note*: **deprecated** Will be removed in a future release; use the MDUI-extension instead
+
 `userid.attribute`
 :   The attribute name of an attribute which uniquely identifies
     the user. This attribute is used if SimpleSAMLphp needs to generate

lib/SimpleSAML/Auth/TimeLimitedToken.php

@@ -6,6 +6,8 @@ use SimpleSAML\Utils;
 
 /**
  * A class that generates and verifies time-limited tokens.
+ *
+ * @deprecated  This class was deprecated in 1.18 and will be removed in a future release
  */
 
 class TimeLimitedToken

psalm.xml

@@ -37,6 +37,7 @@
         <!-- Ignore deprecated classes -->
         <ignoreFiles>
             <file name="lib/SimpleSAML/Auth/DefaultAuth.php" />
+            <file name="lib/SimpleSAML/Auth/TimeLimitedToken.php" />
             <file name="lib/SimpleSAML/Utilities.php" />
 
             <!-- Ignore deprecated PHP-templates - Remove for 2.0 -->