SHA-1 is still supported but needs to be configured explicitly if you need it.

Duplicate the $state['SimpleSAML_Auth_Default.*'] entries to $state['SimpleSAML_Auth_Source.*'] where needed, while we are transitioning to 2.0. Leave those that will be removed in SimpleSAML_Auth_Default. Move the rest of the code to the new entries in the state array.

When building an assertion, the current time should be obtained once, used many, instead of being obtained every time we are using it (that could lead to clock discrepancies between several timestamps in the same assertion). Additionally, if authentication happened in the past (that is, we got a request that is not the one that triggered authentication, and this is pure SSO), we should calculate the value for SessionNotOnOrAfter relative to the start of the session, not the current time. This resolves #244.

Refactor SimpleSAML_Auth_State::extractPersistentAuthState() to getPersistentAuthData() to avoid confusions around the behaviour of this method.

The state array should not be modified after extracting (getting) the persistent authentication data. This resolves #247.

Provide config options to allow SQLPersistentNameID to be less conservative about creating entries in the SQL datastore, whilst preserving default behaviour

Move SimpleSAML_Auth_Default::handleUnsolicitedAuth() to sspmod_saml_Auth_Source_SP::handleUnsolicitedAuth() and deprecate the former.

Move SimpleSAML_Auth_Default::extractPersistentAuthState() to SimpleSAML_Auth_State::extractPersistentAuthState() and deprecate the former.

Move SimpleSAML_Utilities:: checkCookie() to SimpleSAML\Utils\HTTP::checkSessionCookie() and deprecate the former.

Move SimpleSAML_Utilities:: redirectTrustedURL() to SimpleSAML\Utils\HTTP:: redirectTrustedURL() and deprecate the former.

Move SimpleSAML_Utilities::selfURLNoQuery() to SimpleSAML\Utils\HTTP::getSelfURLNoQuery() and deprecate the former.

Move SimpleSAML_Utilities::selfURL() to SimpleSAML\Utils\HTTP::getSelfURL() and deprecate the former.

Move SimpleSAML_Utilities::addURLparameter() to SimpleSAML\Utils\HTTP::addURLParameters() and deprecate the former.

Move SimpleSAML_Utilities::getSecretSalt() to SimpleSAML_Utils_Config::getSecretSalt(). Deprecate the former and stop using it.

Move SimpleSAML_Utilities::generateID() to SimpleSAML_Utils_Random::generateID(). Deprecate the former and schedule it for removal in 2.0.

Mark the old ones as deprecated and schedule them for removal in 2.0.

Schedule SimpleSAML_Utilities:: arrayize() for removal.