SimpleSAMLphp changelog

SimpleSAMLphp changelog

This document lists the changes between versions of SimpleSAMLphp. See the upgrade notes for specific information about upgrading.

Version 2.5.0

Released TBD - November 2025 - as soon as Symfony 7.4 is released

authorize

Add entityID based filtering (simplesamlphp/simplesamlphp-module-authorize#30) (v1.7.0)

Version 2.4.3

Released TBD

Update and improve Indonesian translations (#2462)
Update and improve Thai translations (#2464)
Update and improve Vietnamese translations (#2465)
Fix various errors and warnings detected in VS Code (#2468)
Remove information in simplesamlphp-advancedfeatures.md about possible fallback from metadata.sign.privatekey to privatekey in IdP and SP metadata files (#2470)
Fix auth state AuthnInstant (#2478)
Allow "Secure" cookie attribute via HTTP on localhost (#2483)
Fix override over errorURL
Introduced a new assets.salt to allow cache busting without leaking version information (#2490)
If session.check_function is set and can not be called an error is raised (#2498)

authorize

Remove reauthentication-button when reauthentication is disabled (simplesamlphp/simplesamlphp-module-authorize#24) (v1.6.2)

Version 2.4.2

Released 2025-06-04

Fixed a bug where metadata-endpoints with isDefault set would not yield the expected metadata (#2439)
Fixed a backwards incompatibility that would throw an exception on an invalid entityID. The exception was downgraded to a warning in the log (#2448)
Fixed a security-issue where cron-jobs could be executed using the default key, even if a different one was set (#2453)

memcacheMonitor

Fixed an issue that prevented the latest version of this module from being installed on SSP 2.4.x

negotiate

Fixed an issue that prevented the latest version of this module from being installed on SSP 2.4.x

Version 2.4.1

Released 2025-05-14

Reverted #2278 because of a regression in SLO when using SSP as a bridge (#2436)
Fixed a dependency on a dev-version of the saml2-library

Version 2.4.0

Released 2025-04-16

Added a new feature flag encryption.optional to allow unencrypted assertions if the SP does not provide an encryption certificate (#2208)
Make translations tool theme-aware (#2315)
Fix deprecation of Twig spaceless-filter (#2229)
Add possibility to provide connection context to XML storage-handler (#2332)
Throw user-friendly exception with the proper HTTP statuscode for incorrect HTTP-method (#2234)
Fixed build-workflow to only re-build the website once
Bugfix: Use entityID from state to allow overriding the issuer (#2345)
When only a single IdP is in scope, skip discovery screen (#2355)
Downgrade simplesamlphp/composer-module-installer to 1.3.x to keep things working with older (OS-supplied) versions of composer
Skip test if xdebug.mode does not contain develop (#2419)
Add a console-script to clear cache (#2410)
PHP 8.4 Deprecation fixes (#2413)
Warn if a module has an unexpected translation-domain in its po file.
Add configuration that enables/disables twig template debug mode (#2406)
Add support for IDP Discovery protocol (#2402)
Destroy session cookies on logout (#2278)
A new module to allow debugging SP logins (#2381)
When only a single IdP is in scope, skip discovery screen (#2355)
Add authproc-filter to manipulate the Assertion's Issuer (#2346)
Many improvements to docs and translations
Updated dependencies

adfs

The ADFS-module has been disconnected from the SSP release. To continue to use it, the module has to be manually installed.
The ADFS-module was completely rewritten and now uses our own XML-libraries for building, signing and encrypting XML (v3.0.0)

discopower

Create discopower.po for italian locale (#22)
Hide tab list when there's only one tab
Fix for tags containing uppercase letters
Updated jQuery

ldap

Add SASL-support (v2.4.0). Note that this required a newer version of symfony/ldap than the one packaged (v2.4.3)

metarefresh

Fixed parsing of large metadata files (v1.2.4)

saml

Stricter regexp to verify SubjectID/PairwiseID: disallow trailing spaces.

Version 2.3.7

Released TBD

Fixed loading translations for themes where there is no explicit X-Domain set in the po file.

Version 2.3.6

Released 2025-02-17

Fixed PHP 8.4 deprecation notices
Fixed infinite recursion (#2367)
Added a new feature flag encryption.optional to allow unencrypted assertions if the SP does not provide an encryption certificate (#2208)
Make translations tool theme-aware (#2315)
Fixed build-workflow to only re-build the website once
Bugfix: Use entityID from state to allow overriding the issuer (#2345)
When only a single IdP is in scope, skip discovery screen (#2355)
Fixed "Undefined array key" warning in RequestedAuthnContextSelector if no RAC is present in the request
SimpleSAMLAuthToken cookie is now removed during an SLO

adfs

PHP 8.4 support
The ADFS-module has been disconnected from the SSP release. To continue to use it, the module has to be manually installed.
The ADFS-module was completely rewritten and now uses our own XML-libraries for building, signing and encrypting XML (v3.0.0)

authcrypt

PHP 8.4 support

discopower

Hide tab list when there's only one tab (simplesamlphp/simplesamlphp-module-discopower#27) (v1.5.0)
Bugfix: Use jquery-assets repo to work around symlink-issue (simplesamlphp/simplesamlphp-module-discopower#28) (v1.5.1)

ldap

Add SASL-support (v2.4.0). Note that this required a newer version of symfony/ldap than the one packaged (v2.4.3)

saml

Stricter regexp to verify SubjectID/PairwiseID: disallow trailing spaces.
Feature: Add authproc-filter to be able to manipulate the Assertion's Issuer (#2346)

debugsp

Added module to allow testing the SP you have in your installation without needing admin login This is similar to the admin/test page but can more easily be used by an IdP who may not have admin privileges on your site.

Version 2.3.0

Released 2024-08-20

The SubjectID authproc-filter now has a new option hashed , which if set to true will automatically hash the unique part of the ID. This will also automatically make the unique part of the ID in compliance with the specs (#2006)
Add microsecond support to the FileLoggingHandler (#2084)
Session ID's are now hashed when stored in a database (#2106)
Improved HTML 5 compatibility (#2162)
Fix: preloaded resource not used (#2207)
BC-break (unintentional): plain-text admin-password are no longer allowed (#2113)

authorize

Feature: allow a user to reauthenticate with a different account (simplesamlphp/simplesamlphp-module-authorize#17) (v1.5.0)
Feature: show user what account he's using when authorization fails (simplesamlphp/simplesamlphp-module-authorize#20) (v1.6.0)
Fix: fix faulty translation (v1.6.1)

consent

Update Luxembourgish translations (v1.4.0)

negotiate

Add support for SPNEGO channel binding (v2.3.1)

sqlauth

Add username_regex option - run regular expression over username before querying the database (simplesamlphp/simplesamlphp-module-sqlauth#11) (v1.3.0)

Version 2.2.6

Released 2025-08-20

Fix auth state AuthnInstant (#2478)

cron

Fixed a security-issue where cron-jobs could be executed using the default key, even if a different one was set (#2453)

metarefresh

Fixed parsing of large metadata files (v1.2.4)

Version 2.2.5

Released 2025-03-11

Fixed PHP 8.4 deprecation notices
Fixed infinite recursion (#2367)
Fixed "Undefined array key" warning in RequestedAuthnContextSelector if no RAC is present in the request
Bumped vulnerable saml2-library to v4.17.0

Version 2.2.4

Released 2024-12-02

Security

A security bug was patched in the saml2-library that allowed for XXE during the parsing of SAML2-messages (CVE-2024-52596)

Other fixes

Run ob_end_clean() on configuration file parsing error (#2219)
Fix typo that caused the metadata file-upload to be hidden (#2271)

admin

Fix metadata-viewer to output a valid PHP array

Version 2.2.3

Released 2024-08-20

Added a missing use-statement that would cause a 'class not found' exception.
Improved Luxembourgish (LB) translations (#2129, #2140)
Fix regression introduced in v2.2.2 regarding autofilling usernames.
Restore the possibility to set trusted.url.domains to null
Improved documentation on cachedir-setting (#2153)
Fix bug in post.twig (#2161)
Fix MDQ cache file bugs (#2200)

adfs

Fixed metadata download to become a proper xml-file
Prevent metadata-download from ever being cached

authorize

Fixed logout button (simplesamlphp/simplesamlphp-module-authorize#16) (v1.4.1)

ldap

Fixed a bug that would throw an unhandled exception to the user if they would enter a non-existing organization and username_organization_method is set to allow or force (v2.3.6).

metarefresh

Fixed incorrect parsing of configuration (v1.2.2)

radius

Fixed security bug known as Blast-Radius (CVE-2024-3596) (simplesamlphp/simplesamlphp-module-radius#10) (v2.0.2)

Version 2.2.2

:warning: IMPORTANT NOTE :warning:

Due to a mistake, this bugfix-release can turn out to become a backwards-incompatibility for those who override the loginuserpass.twig in their custom theme. Please update your theme to reflect the changes in this commit before updating.

Released 2024-04-30

Fix regression when setting the host-variable in saml20-idp-hosted (was #1922)
Fix posting the form to the incorrect endpoint when using an authsource based on UserPassOrgBase (#2022)
Fix RequestedAuthnContextSelector for case with multiple RACs in request
Add xml opening-tag to SP-metadata for consistency with IdP-metadata (#2048)
Fixed a PHP 8.3 compliance issue in the logout handler (#2047)
Improve parsing of base64-encoded strings
Autofill username when Entra ID hints it in the HTTP parameters

admin

Set custom security header to properly display phpinfo-page
Hide file-upload button for metadata-converter if uploads are disabled at PHP-level

exampleauth

Fix controller for External-authsource

ldap

Fix exception being thrown when password is empty

saml2 library

Fixed a bug where base64 encoded strings were not decoded using the strict flag, leading to an incorrect error message.

sqlauth

Add username_regex option (simplesamlphp/simplesamlphp-module-sqlauth#11) (v1.3.0)

Version 2.2.1

Released 2014-03-17

Fix regression in bin/initMDSPdo.php (was #1892)
Fix regression in translations, causing a fallback to English (#2009 + #2010)

sqlauth

Add multi-query support (simplesamlphp/simplesamlphp-module-sqlauth#9) (v1.2.0)

Version 2.2.0

Released 2024-03-08

Make error codes easier to extend (#1870)
Updated eduPerson attributes in attribute maps (#1948)
Add regex support for attribute names in AttributeLimit authproc filter (#1971)
Reverted the .mo files change introduced in 2.1.x
NOTE: 'core:StatisticsWithAttribute' filter was removed from SimpleSAMLphp, but is still available from the statistics -module. It was previously enabled in the default configuration file (config/config.php.dist), so many lightly configured installations will have it enabled by default. Please check your config/config.php (and anywhere else you have authprocs configured) that you've either disabled "core:StatisticsWithAttribute" or migrated to "statistics:StatisticsWithAttribute" before upgrading to SimpleSAMLphp 2.2.0.

Version 2.1.4

Released 2024-02-29

Fix static call for non-static method in bin/importPdoMetadata.php (#1969)
Validate AuthState before processing it (#1706)
Fix possible incompatible dependency-set (#1981)

Version 2.1.3

Released 2024-02-12

Fix backwards compatibility for mandatory cachedir-setting introduced in 2.1.2

Deprecations:

The core:StatisticsWithAttribute authproc-filter has been deprecated. It is now available in the 'statistics' module (v1.2+) as 'statistics:StatisticsWithAttribute', while only the 'core:StatisticsWithAttribute' filter will be removed from SimpleSAMLphp in a future release.

Version 2.1.2

Released 2024-02-05

Restore possibility to use HTTP-Artifact on AuthnRequests (regression from 2.0.4)
Fixed undefined variable exception when using MS SQL store (#1917 + #1918)
Fix legacy-endpoints to not send responses twice
Fix exception when using iframe-logout (#1936)
Look for the schema files in the right place (#1929)
Fixed file logging handler to not fail on the first write after file-creation (#1877)
Fixed a warning in the RequestedAuthnContextSelector

adfs

Fixed incorrect use of StreamedResponse (v2.1.3)

core

Fixed a broken template for the WarnShortSSOInterval authproc-filter (#1920)
Fixed the order of the routes so that the least specific error-controller is hit last (#1923)

ldap

Restored 1.x functionality to be able to fetch operational attributes (v2.3.0)
Fixed undesirable side-effect introduced in v2.3.0 (v2.3.1)
Restore the ability to read attributes using a privileged account (v2.3.2)

saml

Disable caching for metadata-endpoint when protect.metadata is true (#1926)

saml2 library

Fix serialization for the NameID element
Fix inheritance - There is no relation between BaseID and NameID

NOTE: Clear your session store after updating, because old serialized sessions can no longer be unserialized

Version 2.1.1

Released 2023-11-28

Fix static call for non-static method in bin/initMDSPdo.php (#1892)
Restore logout-behaviour for IdP's that do not send a saml:NameID in their LogoutRequest (#1894)
Fix code error in docs (#1895)
Fixed a TypeError when accessing the module.php endpoint without specifying a module (#1907)
Fixed the precondition-functionality for more complex authproc-filters (#1905)
Reverted a case of 'constructor property promotion' in SAMLParser, causing the validators to be empty (#1904)
Drop ext-intl in favour of a polyfill (#1908)

multiauth

Fix TypeError due to missing keys in source array (#1900)

Version 2.1.0

Released 2023-10-30

Functionality that before was provided by the sanitycheck-module is now implicit. The module has been archived and should no longer be used. (#1843)
Add support for conditional authproc-filters (#1836)
Add support for TLS configuration for Redis Store (#1828)
Add support for Metadata Deployment Profile for errorURL (#1841)
Raised minimum Symfony version to 6.0
Raise minimum PHP version to 8.0
Specified the allowed HTTP methods for each route
Our dependency on composer/composer was dropped in favour of a packaged phar-file (#1857)
The bin/pwgen.php script was improved to used stronger encryption (#1849)
Fixed a missing Accept-header for metadata queries (#1865)
Changed the UNIQUE constraint for the SP LogoutStore database to PRIMARY KEY to prevent confusing warnings in Drupal (#1862)
Add Accept HTTP headers to MDQ queries (#1865)
The custom error- and exception handlers were moved to their very own classes (#1858)

Version 2.0.8

Released 2023-11-28

Fix static call for non-static method in bin/initMDSPdo.php (#1892)
Restore logout-behaviour for IdP's that do not send a saml:NameID in their LogoutRequest (#1894)
Fix code error in docs (#1895)
Fixed a TypeError when accessing the module.php endpoint without specifying a module (#1907)
Drop ext-intl in favour of a polyfill (#1908)

multiauth

Fix TypeError due to missing keys in source array (#1900)

Version 2.0.7

Released 2023-10-30

Fixed a missing Accept-header for metadata queries (#1865)
Update vulnerable composer (CVE-2023-43655; not affected)
Fixed a potential XSS-through-DOM (3x; not affected)
Fixed a warning in the RequestedAuthnContextSelector

Version 2.0.6

Released 2023-09-07

Fixed a legacy endpoint causing to break iframe-logout (#1846)
Fixed an incorrect return-type in RunnableResponse
Fix for admin.protectmetadata=true - it would show a blank page
Fix default for entity attributes NameFormat in XML metadata to be 'URI'.
Fix error message when invoking SSO endpoint without the required parameters.
Security header regression
Fixed a regression that made it impossible to configure metadata-signing on individual hosted IdP's (#1792)

Version 2.0.5

Released 2023-07-31

Fixed link pointing to legacy endpoint (#1833)
Updated German translations (#1814)
Do not drop UIInfo from SSP array style metadata (#1808)
Fixed incorrect return types
Added removeEntry-method to MetadataStorageHandlerPdo (#1823)
Fixed SLO with signed response (#1812)
Fixed broken MetaDataStorageHandlerSerialize
Usernames are now trimmed (#1829)
Never expose the cron-API if secret is not properly configured (#1831)
Fixed a bug where IdP-initiated SLO using the HTTP-POST binding wasn't properly dealt with

admin

Updated French translations (#1824)

cron

Log a warning if secret is not properly configured (#1831)

metarefresh

Added support for PDO storage (v0.11.0)

Version 2.0.4

Released 2023-05-12

The source that was selected by the SourceSelector is now available in the state.
The zone that was selected by the SourceIPSelector is now available in the state.
The defaultSource for the SourceIPSelector can now be set to null . If none of the zones are matched, a NotFound exception will be thrown.
It is now possible to set a default AuthnContext in the RequestedAuthnContextSelector.
Fixed a bug in MDQ metadata expiration
Resolved a possible object injection vulnerability in MDQ metadata cache
Restored the possibility to use HTTP-Artifact binding on AuthnRequests
Removed unused private method MetaDataStorageSource::getDynamicHostedUrl (leftover from entityid generation)
Bumped simplesamlphp-assets-base

ldap

Fixed loading the options-array from configuration (v2.1.6)
Properly escape user-input in ldap filters (v2.1.7)

saml2

Fixed a static call to a non-static function that caused a broken artifact binding (v4.6.8)

Version 2.0.3

Released 2023-03-29

Fix exception when translation-file does not exist
Correct host in generated URLS for IdPs with 'host' config in admin/federation (#1774, #1781)
Restore dev-autoloader (#1795)

authyubikey

The module wasn't fully compatible with SSP 2.0 yet (v2.0.1)

cas

Fixed a broken controller (simplesamlphp/simplesamlphp-module-cas#6) (v1.1.2)

saml2debug

Fixed a broken controller (simplesamlphp/simplesamlphp-module-saml2debug#4) (v1.0.5)

Version 2.0.2

Released 2023-03-10

Fixed the broken 2.0.1 release by restoring an accidentally removed file

Version 2.0.1

Released 2023-03-10

The language-menu on mobile devices was fixed
Fix some issues with logout (#1776, #1780, #1785)
The loginpage_links functionality for authsources was restored and documented (#1770, #1773)
Several issues regarding the use of the back-button were fixed (#1720)
Many fixes in documentation
Fixed config/authsources.php.dist so you can just rename it for new deployments to get you started (#1771)
Fixed UTF-8 encoding for metadata output
Fixed incompatibility with SSP 2.0 for the following modules;
- consent
- consentadmin
- consentsimpleadmin
- exampleattributeserver
- expirycheck
- memcachemonitor
- memcookie
- metaedit
- negotiate
- negotiateext
- preprodwarning
- saml2debug
- sanitycheck
- sqlauth

authtwitter

A legacy route was added for backwards compatibility
Docs have been updated

ldap

Fixed the possibility to return ALL attributes (simplesamlphp/simplesamlphp-module-ldap#39)
Restored the possibility to use anonymous bind (simplesamlphp/simplesamlphp-module-ldap#41)

negotiate

Added support for multi-realm environments

statistics

Fixed missing script-tag to load jQuery
Fixed static calls to SSP utilities
Docs have been updated

Version 2.0.0

Released 2023-02-23

Many changes, upgrades and improvements since the 1.x series.
Most notably the new templating system based on Twig, a new localization system based on gettext.
Most modules have been moved out of the core package but can easily be installed on-demand as required via composer.
Better conformance by default to the SAML2INT standard.
Code cleanups, improvements and simplifications.
Improved test coverage and more use of standard libraries.
Compatibility with modern versions of PHP.
Various new features, including:
- SAML SubjectID and Pairwise ID support
- Accepting unsolicited responses can be disabled by setting enable_unsolicited to false in the SP authsource.
- Certificates and private keys can now be retrieved from a database
- Support for Redis sentinel was added.
Please read the upgrade notes for 2.0 because this release breaks backwards compatibility in a number of places.