<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
<article>
  <title>simpleSAMLphp changelog</title>

  <section>
    <title>Change log</title>

    <para>Here is changes between simpleSAMLphp versions. Look here if you are
    upgrading, to see if there are any changes to the config format. There is
    a <ulink url="???">generic section describing how to perform a upgrade in
    the installation manual</ulink>.</para>

    <section>
      <title>Version 1.3</title>

      <para>Released 2008-11-04. Revision 973.</para>

      <para>Configuration file <filename>config.php</filename> should not
      include significant changes, except one language added.</para>

      <section>
        <title>New features</title>

        <itemizedlist>
          <listitem>
            <para>Documentation update</para>
          </listitem>

          <listitem>
            <para>Added new language. Now there are two different portugese
            dialects.</para>
          </listitem>

          <listitem>
            <para>Consent "module" modified. Now added support for
            preselecting the checkbox by a configuration parameter. Consent
            module supports including attributs values (possible to
            configure).</para>
          </listitem>

          <listitem>
            <para>CSS and look changed. Removed transparency to fix problem
            for some browsers.</para>
          </listitem>

          <listitem>
            <para>The login-admin authentication module does not ask for
            username any more.</para>
          </listitem>

          <listitem>
            <para>Added support for persistent NameID Format. (Added by Hans
            ZAndbelt)</para>
          </listitem>

          <listitem>
            <para>Added experimental SAML 2.0 SP AuthSource module.</para>
          </listitem>

          <listitem>
            <para>More readable XML output formatting. In example
            metadata.</para>
          </listitem>

          <listitem>
            <para>Better support for choosing whether or not to sign
            authnrequest. Possible to specify both at SP hosted and IdP
            remote.</para>
          </listitem>

          <listitem>
            <para>Adding more example metadata in metadata-templates.</para>
          </listitem>

          <listitem>
            <para>Improved e-mails sent from SimpleSAMLphp. Now both plain
            text and html.</para>
          </listitem>

          <listitem>
            <para>Configuration class may return information about what
            version.</para>
          </listitem>

          <listitem>
            <para>iFrame AJAX SLO improved. Now with non-javascript failback
            handling.</para>
          </listitem>
        </itemizedlist>
      </section>

      <section>
        <title>Bug fixes</title>

        <itemizedlist>
          <listitem>
            <para>Fixed warning with XML validator.</para>
          </listitem>

          <listitem>
            <para>Improved loading of private/public keys in
            XML/Signer.</para>
          </listitem>

          <listitem>
            <para>Improvements to CAS module.</para>
          </listitem>

          <listitem>
            <para>Fixed memcache stats.</para>
          </listitem>
        </itemizedlist>
      </section>
    </section>

    <section>
      <title>Version 1.2</title>

      <para>Released 2008-09-26. Revision 899.</para>

      <para>There are some changes in the configuration files from version 1.1
      to 1.2. <literal>/simplesaml/admin/config.php</literal> should be used
      to check what options have changed.</para>

      <para>When you upgrade from an previous version you should copy
      <literal>authsources.php</literal> from
      <literal>config-templates</literal> into <literal>config</literal>
      directory.</para>

      <para>There are also some changes to the templates. If you have any
      custom templates, they should be updated to match the ones included. Of
      notable changes is that the <literal>t(...)</literal>-function has been
      simplified, and takes far fewer parameters. It is backwardscompatible,
      but will write a warning to the log until updated. The backwards
      compatibility will be removed in a future version.</para>

      <section>
        <title>New features</title>

        <itemizedlist>
          <listitem>
            <para>Experimental support for modules. Currently modules can
            contain custom authentication sources, authentication processing
            filters and themes.</para>
          </listitem>

          <listitem>
            <para>An generic SQL autentication module added for those who
            store their users in an SQL database.</para>
          </listitem>

          <listitem>
            <para>Limited support for validating against a CA root
            certificate. The current implementation only supports cases where
            the certificate is directly signed by the CA.</para>
          </listitem>

          <listitem>
            <para>Allow an IdP to have multiple valid certificate
            fingerprints, to allow for easier updating of certificates.</para>
          </listitem>

          <listitem>
            <para>Shibboleth 1.3 authentication for Auth MemCookie.</para>
          </listitem>

          <listitem>
            <para>Support for link to privacy policy on consent-pages.</para>
          </listitem>

          <listitem>
            <para>Customizable initial focus on consent-page.</para>
          </listitem>

          <listitem>
            <para>Almost all pages should be translateable.</para>
          </listitem>

          <listitem>
            <para>Allow SAML 2.0 SP to handle error replies from IdP.</para>
          </listitem>

          <listitem>
            <para>PostgreSQL support for consent storage.</para>
          </listitem>

          <listitem>
            <para>Add support for encrypted private keys.</para>
          </listitem>

          <listitem>
            <para>Proof-of-concept MetaShare service, for easy publishing and
            sharing of metadata.</para>
          </listitem>
        </itemizedlist>
      </section>

      <section>
        <title>Bug fixes</title>

        <itemizedlist>
          <listitem>
            <para>Fixed generated SAML 2.0 metadata to be correct.</para>
          </listitem>

          <listitem>
            <para>Fixed logout for Auth MemCookie.</para>
          </listitem>

          <listitem>
            <para>Sign SAML 2.0 authentication response on failure (such as
            NoPassive).</para>
          </listitem>

          <listitem>
            <para>Fixes for IsPassive in the SAML 2.0 IdP.</para>
          </listitem>

          <listitem>
            <para>Fix default syslog configuration on Windows.</para>
          </listitem>

          <listitem>
            <para>Fix order of signing and encryption of SAML 2.0
            responses</para>
          </listitem>

          <listitem>
            <para>Fix generated metadata for Shib 1.3</para>
          </listitem>

          <listitem>
            <para>Fix order of elements in encrypted assertions to be schema
            compliant.</para>
          </listitem>

          <listitem>
            <para>Fix session index sent to SAML 2.0 SPs.</para>
          </listitem>

          <listitem>
            <para>Remember SAML 2.0 NameID sent to SPs, and include it in
            logout requests.</para>
          </listitem>
        </itemizedlist>
      </section>
    </section>

    <section>
      <title>Version 1.1</title>

      <para>Released 2008-06-19. Revision 673.</para>

      <para>When upgrading to version 1.1 from version 1.0, you should update
      the configuration files. Many options have been added, and some have
      moved or removed. The new configuration check page:
      <literal>/simplesaml/admin/config.php</literal> may be useful for
      determining what should be updated. Also note that the
      <literal>language.available</literal> option in
      <filename>config.php</filename> should be updated to reflect the new
      languages which have been added.</para>

      <para>There are also several changes to the template files. If you have
      done any customizations to these, you should test them to make sure that
      they still work. Some changes, such as allowing the users to save the
      IdP choice they make in the discovery service, will not work without
      updating the templates.</para>

      <para>New localizations in version 1.1: Sami, Svenska (swedish),
      Suomeksi (finnish), Nederlands, Luxembourgish, Slovenian, Hrvatski
      (Croatian), Magyar (Hungarian).</para>

      <section>
        <title>New features</title>

        <itemizedlist>
          <listitem>
            <para>Add support for saving the users choice of IdP in the IdP
            discovery service.</para>
          </listitem>

          <listitem>
            <para>Add a config option for whether the Response element or the
            Assertion element in the response should be signed.</para>
          </listitem>

          <listitem>
            <para>Make it easier to add attribute alteration functions.</para>
          </listitem>

          <listitem>
            <para>Added support for multiple languages in metadata name and
            description (for IdP discovery service).</para>
          </listitem>

          <listitem>
            <para>Added configuration checker for checking if configuration
            files should be updated.</para>
          </listitem>

          <listitem>
            <para>Add support for icons in IdP discovery service.</para>
          </listitem>

          <listitem>
            <para>Add support for external IdP discovery services.</para>
          </listitem>

          <listitem>
            <para>Support password encrypted private keys.</para>
          </listitem>

          <listitem>
            <para>Added PHP autoloading as the preferred way of loading the
            simpleSAMLphp library.</para>
          </listitem>

          <listitem>
            <para>New error report script which will report errors to the
            <literal>technicalcontact_email</literal> address.</para>
          </listitem>

          <listitem>
            <para>Support lookup of the DN of the user who is logging in by
            searching for an attribute when using the LDAP authentication
            module.</para>
          </listitem>

          <listitem>
            <para>Add support for fetching name and description of entities
            from XML metadata files.</para>
          </listitem>

          <listitem>
            <para>Support for setting custom AttributeNameFormats.</para>
          </listitem>

          <listitem>
            <para>Support for signing generated metadata.</para>
          </listitem>

          <listitem>
            <para>Support for signature validation of metadata.</para>
          </listitem>

          <listitem>
            <para>Added consent support for Shib 1.3 logging.</para>
          </listitem>

          <listitem>
            <para>Added errorlog logging handler for logging to the default
            Apache error log.</para>
          </listitem>

          <listitem>
            <para>Added support for WS-Federation single signon.</para>
          </listitem>

          <listitem>
            <para>Allow <literal>session_save_path</literal> to be overridden
            by setting the <literal>session.phpsession.savepath</literal>
            option in <filename>config.php</filename>.</para>
          </listitem>

          <listitem>
            <para>Add support for overriding autogenerated metadata values,
            such as the <literal>AssertionConsumerService</literal>
            address.</para>
          </listitem>

          <listitem>
            <para>Added IsPassive support in the SAML 2.0 IdP.</para>
          </listitem>

          <listitem>
            <para>Add attribute filter for generating eduPersonTargetedID
            attribute.</para>
          </listitem>

          <listitem>
            <para>Add support for validation of sent and received messages and
            metadata.</para>
          </listitem>

          <listitem>
            <para>Add support for dynamic metadata loading with cache.</para>
          </listitem>

          <listitem>
            <para>Add support for dynamic generation of entityid and
            metadata.</para>
          </listitem>

          <listitem>
            <para>Added wayf.dk login module.</para>
          </listitem>

          <listitem>
            <para>Add support for encrypting and decrypting assertions.</para>
          </listitem>

          <listitem>
            <para>CAS authentication module: Add support for
            serviceValidate.</para>
          </listitem>

          <listitem>
            <para>CAS authentication module: Add support for getting
            attributes from response by specifying XPath mappings.</para>
          </listitem>

          <listitem>
            <para>Add support for specifying a certificate in the
            <literal>saml20-idp-remote</literal> metadata instead of a
            fingerprint.</para>
          </listitem>

          <listitem>
            <para>Add an attribute alter function for dynamic group
            generation.</para>
          </listitem>

          <listitem>
            <para>Add support for attribute processing in SAML 2 SP.</para>
          </listitem>

          <listitem>
            <para>Added tlsclient authentication module.</para>
          </listitem>

          <listitem>
            <para>Allow the templates to override the header and footer of
            pages.</para>
          </listitem>

          <listitem>
            <para>Major improvements to the Feide authentication
            module.</para>
          </listitem>

          <listitem>
            <para>Add support for ForceAuthn in the SAML 2.0 IdP.</para>
          </listitem>

          <listitem>
            <para>Choose language based on the languages the user has selected
            in the web browser.</para>
          </listitem>

          <listitem>
            <para>Added fallback to base language if translation isn't
            found.</para>
          </listitem>
        </itemizedlist>
      </section>

      <section>
        <title>Bug fixes</title>

        <itemizedlist>
          <listitem>
            <para>Modified IdP discovery service to support Shibboleth 2.0
            SP.</para>
          </listitem>

          <listitem>
            <para>Fix setcookie warning for PHP version &lt; 5.2.</para>
          </listitem>

          <listitem>
            <para>Fix logout not being performed for Auth MemCache
            sometimes.</para>
          </listitem>

          <listitem>
            <para>Preserve case of attribute names during LDAP attribute
            retrival.</para>
          </listitem>

          <listitem>
            <para>Fix IdP-initiated logout.</para>
          </listitem>

          <listitem>
            <para>Ensure that changed sessions with changed SP associations
            are written to memcache.</para>
          </listitem>

          <listitem>
            <para>Prevent infinite recursion during logging.</para>
          </listitem>

          <listitem>
            <para>Don't send the relaystate from the SP which initiated the
            logout to other SPs during logout.</para>
          </listitem>

          <listitem>
            <para>Prevent consent module from revealing DB password when an
            error occurs.</para>
          </listitem>

          <listitem>
            <para>Fix logout with memcache session handler.</para>
          </listitem>

          <listitem>
            <para>Allow new session to be created in login modules.</para>
          </listitem>

          <listitem>
            <para>Removed the strict parameter from base64_decode for PHP 5.1
            compatibility.</para>
          </listitem>
        </itemizedlist>
      </section>
    </section>

    <section>
      <title>Version 1.0</title>

      <para>Released 2008-03-28. Revision 470.</para>
    </section>

    <section>
      <title>Version 0.5</title>

      <para>Released 2007-10-15. Revision 28.</para>

      <warning>
        <para>Both <filename>config.php</filename> and metadata format are
        changed. Look at the templates to understand the new format.</para>
      </warning>

      <itemizedlist>
        <listitem>
          <para>Documentation is updated!</para>
        </listitem>

        <listitem>
          <para>Metadata files made tidier. Unused entries removed. Look at
          the new templates on how to change your existing metadata.</para>
        </listitem>

        <listitem>
          <para>Support for sending metadata by mail to Feide. Automatically
          detecting whether you have configured Feide as the default IdP or
          not.</para>
        </listitem>

        <listitem>
          <para>Improved SAML 2.0 Metadata generation</para>
        </listitem>

        <listitem>
          <para>Added support for Shibboleth 1.3 IdP functionality (beta,
          contact me if any problems)</para>
        </listitem>

        <listitem>
          <para>Added RADIUS authentication backend</para>
        </listitem>

        <listitem>
          <para>Added support for HTTP-Redirect debugging when enable
          <literal>debug=true</literal></para>
        </listitem>

        <listitem>
          <para>SAML 2.0 SP example now contains a logout page.</para>
        </listitem>

        <listitem>
          <para>Added new authentication backend with support for multiple
          LDAP based on which organization the user selects.</para>
        </listitem>

        <listitem>
          <para>Added SAML 2.0 Discovery Service</para>
        </listitem>

        <listitem>
          <para>Initial 'proof of concept' implementation of "User consent on
          attribute release"</para>
        </listitem>

        <listitem>
          <para>Fixed some minor bugs.</para>
        </listitem>
      </itemizedlist>
    </section>

    <section>
      <title>Version 0.4</title>

      <para>Released 2007-09-14. Revision X.</para>

      <itemizedlist>
        <listitem>
          <para>Improved documentation</para>
        </listitem>

        <listitem>
          <para>Authentication plugin API. Only LDAP authenticaiton plugin is
          included, but it is now easier to implement your own plugin.</para>
        </listitem>

        <listitem>
          <para>Added support for SAML 2.0 IdP to work with Google Apps for
          Education. Tested.</para>
        </listitem>

        <listitem>
          <para>Initial implementation of SAML 2.0 Single Log Out
          functionality both for SP and IdP. Seems to work, but not yet
          well-tested.</para>
        </listitem>

        <listitem>
          <para>Added support for bridging SAML 2.0 to SAML 2.0.</para>
        </listitem>

        <listitem>
          <para>Added some time skew offset to the NotBefore timestamp on the
          assertion, to allow some time skew between the SP and IdP.</para>
        </listitem>

        <listitem>
          <para>Fixed Browser/POST page to automaticly submit, and have fall
          back functionality for user agents with no javascript
          support.</para>
        </listitem>

        <listitem>
          <para>Fixed some bug with warning traversing Shibboleth 1.3
          Assertions.</para>
        </listitem>

        <listitem>
          <para>Fixed tabindex on the login page of the LDAP authentication
          module to allow you to tab from username, to password and then to
          submit.</para>
        </listitem>

        <listitem>
          <para>Fixed bug on autodiscovering hostname in multihost
          environments.</para>
        </listitem>

        <listitem>
          <para>Cleaned out some debug messages, and added a debug option in
          the configuration file. This debug option let's you turn on the
          possibility of showing all SAML messages to users in the web
          browser, and manually submit them.</para>
        </listitem>

        <listitem>
          <para>Several minor bugfixes.</para>
        </listitem>
      </itemizedlist>
    </section>
  </section>
</article>