diff --git a/.markdownlintrc b/.markdownlintrc index b077f0e..e6b0f44 100644 --- a/.markdownlintrc +++ b/.markdownlintrc @@ -1,4 +1,7 @@ { "default": true, - "MD013": false + "MD013": false, + "MD024": { + "siblings_only": true + } } diff --git a/composer.json b/composer.json index 251837f..038735a 100644 --- a/composer.json +++ b/composer.json @@ -40,7 +40,7 @@ "beste/clock": "~3.0", "simplesamlphp/assert": "~2.0", "simplesamlphp/composer-module-installer": "~1.7", - "simplesamlphp/simplesamlphp": "~2.5@dev", + "simplesamlphp/simplesamlphp": "~2.5", "simplesamlphp/xml-cas": "~2.5", "simplesamlphp/xml-common": "~2.7", "simplesamlphp/xml-soap": "~2.3", diff --git a/docs/ChangeLog.md b/docs/ChangeLog.md index 793134e..7bd087b 100644 --- a/docs/ChangeLog.md +++ b/docs/ChangeLog.md @@ -1,152 +1,296 @@ -# simplesamlphp-module-casserver changelog - -Unreleased - -* Allow certain authproc filters to be used in configuration -* Support method parameter at login -* Improve handling of invalid xml element names for attributes -* Minimum supported simplesamlphp version bumped to 1.17 -* debugMode option to display cas ticket xml -* Allow per service overriding of configuration options for www/login -* Pass the requesting cas service url to the authproc filters as the sp - entity id, which was previously always an empty string -* Added an 'idp_entity_id' option, passed to the authproc filters as the - idp entity id and defaulting to the simplesamlphp base url -* Reject a resumed authproc state whose service url differs from the one - the filters ran for - -2018-07-20 Bjorn Rohde Jensen - -* Release 6.1.0 -* Minimum supported simplesamlphp version bumped to 1.15. -* Fixed some deprecation warnings by using namespaces to refer to the - relevant classes. -* Added support for using Redis as a ticket store. - -2016-08-01 Bjorn Rohde Jensen - -* Release 6.0.0 -* Renamed module from sbcasserver to casserver. -* Added composer file to make module installable according to - simplesamlphp guidelines. -* Replaced use of deprecated SimpleSAMLphp api's. -* Fixed a bug when comparing service url parameter to ticket service url, - which caused service urls with %20 encoded spaces to fail verification. - -2014-10-15 Bjørn Rohde Jensen - -* Release 5.2.3 -* Added a missing linefeed character in the CAS 1.0 ticket validation - failure response. +# Changelog -2014-03-17 Bjørn Rohde Jensen +## [7.0.5] - 2026-08-11 -* Release 5.2.2 -* Fixed a bug where the sanitized forms of url parameters were used for - more than validation. -* Fixed a bug in the sanitizer logic to remove ';jsessionid' from urls. - -2014-02-27 Bjørn Rohde Jensen - -* Release 5.2.1 -* Fixed a bug where attributes containing colons in their names caused - serviceValidate to return invalid xml. - -2014-02-25 Bjørn Rohde Jensen - -* Release 5.2.0 -* Removed hardcoded removal of attributes starting with urn:oid. -* Added a logged in landing page in case the client does not provide - a service url. -* It is now possible to add an attribute indicating whether the attributes - are base64 encoded or not. - -2014-02-07 Bjørn Rohde Jensen - -* Release 5.1.0 -* Fixed a bug where the 'url' parameter was required even when displaying - a logged out page. -* Fixed a bug where attribute transfer could not be disabled. -* Added support for specifying which attributes to transfer. -* Added support for specifying a named subset of IdPs allowing clients to - restrict the list of IdPs in the wayf step. - -2013-11-04 Bjørn Rohde Jensen - -* Release 5.0.0 -* Removed support for storing tickets in proprietary key-value - store AttributeStore. -* Added support for storing tickets in a SQL database. -* Added support for storing tickets in memcached. -* Added support for proxy tickets. -* Added support for renewing login. -* Added an optional logged out landing page with a return url. -* Added support for specifying an idp during login thus skipping the - wayf step. -* Added support for specifying a language hint during login. - -2013-01-29 Bjørn Rohde Jensen - -* Release 4.0.0 -* Moved all filters to a dedicated project. -* Moved theme related code into the sbthemes project. -* Added an abstract cas ticket store with concrete subclasses to store - tickets locally or in the attribute store. -* Changed cas 2.0 response generation from hand coded to using - php dom document. -* Fixed a bug in cas 1.0 response generation, where yes/no was - returned in upper case. - -2012-10-31 Bjørn Rohde Jensen - -* release 3.3.0 -* IPRoleMapper can now be configured to add its roles to any given attribute - by setting the filter parameter 'targetAttributeName'. - -2012-10-24 Bjørn Rohde Jensen - -* release 3.2 -* Added AttributeCollector auth filter for collecting attributes from - the attribute store. -* Added CAS logout - -2012-05-22 Per Møldrup-Dalum +### Changed -* release 3.1 -* Corrected a spelling bug +- Restructure and complete the changelog file (Ioannis Igoumenos) +- Require stable SimpleSAMLphp ~2.5 instead of ~2.5@dev (Ioannis Igoumenos) -2012-05-08 Per Møldrup-Dalum +### Fixed -* Release 3 -* Added the Statsbiblioteket theme from sbdisco -* Added the IP role mapper from sbdisco +- Fix CI pipeline workflows, resolve PHP 8.5 test deprecations and upgrade PHPUnit schema (Ioannis Igoumenos) +- Fix GitHub Actions schema validation errors and resolve Phive installation rate limits by properly passing GITHUB_TOKEN (Ioannis Igoumenos) -2011-10-31 Per Møldrup-Dalum +## [7.0.4] - 2026-08-11 -* Release 2.3 -* Added a hack to keep compatibility with the eduPersonNIN attribute. - -2011-03-29 Per Møldrup-Dalum +### Changed -* Release 2.2 -* Reintroduced ignore urn:oid attributes. -* Added configurable base 64 encoding of attribute values. -* Removed debug messages. -* Changed the casserver to use the configured auth source. +- Pass real Source/Destination metadata into the authproc processing chain (Marko Ivančić) -2011-01-18 Per Møldrup-Dalum +### Fixed -* Changed default from disabled to enabled +- Fix PHPUnit notices and PHPStan reported issues (Ioannis Igoumenos) -2011-01-17 Per Møldrup-Dalum +## [7.0.3] - 2026-05-15 -* Creating release 2.0 -* All files are rewritten based on work by Dubravko Voncina. See Google - Groups discussion in this thread: - `http://groups.google.com/group/simplesamlphp/browse_thread/thread/4c655d169532650a` -* Creating release 2.1 - The sbcasserver module now uses its own "namespace" instead of - hi-jacking the casserver "namespace". Therefore the - `config-templates/module_casserver.php` has been renamed to - module_sbcasserver.php -* The files in www has all been changed to use the new "namespace". +### Fixed + +- Fix unit tests to pass on Windows environments (Tim van Dijen) + +## [7.0.2] - 2026-05-07 + +### Changed + +- Minor bug fixes and dependency updates (Ioannis Igoumenos, Tim van Dijen) + +### Fixed + +- Fix Random utility import to use SimpleSAML\Utils\Random (Ioannis Igoumenos) + +## [7.0.1] - 2026-02-21 + +### Changed + +- Bump dependencies + +## [7.0.0] - 2026-01-15 + +### Added + +- Add routes and controllers for SimpleSAMLphp 2.x compatibility, and migrate templates to Twig (Ioannis Igoumenos, Tim van Dijen, Patrick Radtke, David Lundgren) + +### Changed + +- Require PHP 8.3 and SimpleSAMLphp 2.5 (Ioannis Igoumenos, Tim van Dijen, Patrick Radtke, David Lundgren) +- Upgrade xml-libraries to their 2.x versions (using typed values), update version constraints, and require ext-ctype (Ioannis Igoumenos, Tim van Dijen, Patrick Radtke, David Lundgren) +- Improve gateway parameter handling to match protocol descriptions, allow service tickets on proxyValidate, refactor legal URL comparison, and allow SimpleSAMLphp 2.4.2 assertion usage (Ioannis Igoumenos, Tim van Dijen, Patrick Radtke, David Lundgren) +- Replace Psalm with PHPstan, replace super-linter with a reusable workflow, and resolve CodeSniffer issues (Ioannis Igoumenos, Tim van Dijen, Patrick Radtke, David Lundgren) + +## [6.3.1] - 2026-01-15 + +### Fixed + +- Fix open redirect and XSS vulnerabilities in logout template (Tim van Dijen, Patrick Radtke) + +## [6.3.0] - 2024-11-18 + +### Added + +- Initial support for \`samlValidate\` for compatibility with Banner (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Add support for alternate service/ticket parameter names and preserving \`debugMode\` parameter (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Add support for PHP 8.0, 8.1, and 8.3 testing (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) + +### Changed + +- Require PHP 8.1 and SimpleSAMLphp 2.2 (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Move \`lib/\` to \`src/\` and \`www/\` to \`public/\` (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Migrate templates to Twig and translations to dictionaries (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Migrate code to use \`xml-cas\`, \`xml-soap\`, and \`xml-common\` libraries (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Refactor stores for SimpleSAMLphp 2.0 compatibility (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Implement processing chain and delegating ticket store (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Modernize test-suite, migrate PHPUnit config and metadata to attributes, add return types, and fix broken tests on Windows (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Replace abandoned security-checker with composer audit, update SuperLinter, add markdown-linter (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Configure Dependabot and improve GitHub Actions workflows (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) + +### Fixed + +- Fix SOAP namespace, typo/markdown issues, and handle PDO as an optional dependency (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) +- Fix Psalm, CodeSniffer (PSR-12, namespaces, strict typing), and Codecov issues (Tim van Dijen, Patrick Radtke, Ioannis Igoumenos) + +## [6.2.1] - 2026-01-15 + +### Fixed + +- Fix open redirect and XSS vulnerabilities in logout template (Tim van Dijen, Patrick Radtke) + +## [6.2.0] - 2022-02-02 + +### Changed + +- Require PHP 7.1 and SimpleSAMLphp 1.19 +- Bump dependencies + +## [6.1.2] - 2022-01-06 + +### Changed + +- Rename \`.codecov.yml\` to \`codecov.yml\` (Tim van Dijen) + +### Fixed + +- Fix \`.gitignore\` file and configured \`allow-plugins\` tag for Composer (Tim van Dijen) + +## [6.1.1] - 2019-11-13 + +### Added + +- Add support for optional method parameter at login, and allow services to override CAS config (Tim van Dijen, Patrick Radtke, Danny) +- Add \`debugMode\` to print ticket XML (Tim van Dijen, Patrick Radtke, Danny) + +### Changed + +- Require PHP 5.6 and SimpleSAMLphp 1.17.7 (Tim van Dijen, Patrick Radtke, Danny) +- Improve CAS 1.0/2.0 protocol handling and illegal attribute name handling (Tim van Dijen, Patrick Radtke, Danny) +- Improve authproc filtering and fix undefined variables (Tim van Dijen, Patrick Radtke, Danny) +- Refactor CAS ticket stores (FileSystem, MemCache, Redis, SQL) (Tim van Dijen, Patrick Radtke, Danny) +- Branch off 1.x, migrate to PHP namespaces, rationalize code, and fix PSR-2 formatting (Tim van Dijen, Patrick Radtke, Danny) +- Introduce Psalm and Scrutinizer for static analysis and fix reported issues (Tim van Dijen, Patrick Radtke, Danny) +- Improve integration and functional tests to run without requiring a separate PHP server process (Tim van Dijen, Patrick Radtke, Danny) + +## [6.1.0] - 2018-07-20 + +### Added + +- Add support for using Redis as a ticket store (Bjorn Rohde Jensen) + +### Changed + +- Minimum supported simplesamlphp version bumped to 1.15 (Bjorn Rohde Jensen) + +### Fixed + +- Fix some deprecation warnings by using namespaces to refer to the relevant classes (Bjorn Rohde Jensen) + +## [6.0.0] - 2016-08-01 + +### Added + +- Add composer file to make module installable according to simplesamlphp guidelines, requiring SimpleSAMLphp 1.14 (Bjorn Rohde Jensen) + +### Changed + +- Rename module from sbcasserver to casserver (Bjorn Rohde Jensen) +- Replace use of deprecated SimpleSAMLphp api's (Bjorn Rohde Jensen) + +### Fixed + +- Fix a bug when comparing service url parameter to ticket service url, which caused service urls with %20 encoded spaces to fail verification (Bjorn Rohde Jensen) + +## [5.2.3] - 2014-10-15 + +### Added + +- Add a missing linefeed character in the CAS 1.0 ticket validation failure response (Bjørn Rohde Jensen ) + +## [5.2.2] - 2014-03-17 + +### Fixed + +- Fix a bug where the sanitized forms of url parameters were used for more than validation (Bjørn Rohde Jensen ) +- Fix a bug in the sanitizer logic to remove ';jsessionid' from urls (Bjørn Rohde Jensen ) + +## [5.2.1] - 2014-02-27 + +### Fixed + +- Fix a bug where attributes containing colons in their names caused serviceValidate to return invalid xml (Bjørn Rohde Jensen ) + +## [5.2.0] - 2014-02-25 + +### Added + +- Add a logged in landing page in case the client does not provide a service url (Bjørn Rohde Jensen ) + +### Changed + +- It is now possible to add an attribute indicating whether the attributes are base64 encoded or not (Bjørn Rohde Jensen ) + +### Removed + +- Remove hardcoded removal of attributes starting with urn:oid (Bjørn Rohde Jensen ) + +## [5.1.0] - 2014-02-07 + +### Added + +- Add support for specifying which attributes to transfer (Bjørn Rohde Jensen ) +- Add support for specifying a named subset of IdPs allowing clients to restrict the list of IdPs in the wayf step (Bjørn Rohde Jensen ) + +### Fixed + +- Fix a bug where the 'url' parameter was required even when displaying a logged out page (Bjørn Rohde Jensen ) +- Fix a bug where attribute transfer could not be disabled (Bjørn Rohde Jensen ) + +## [5.0.0] - 2013-11-04 + +### Added + +- Add support for storing tickets in a SQL database (Bjørn Rohde Jensen ) +- Add support for storing tickets in memcached (Bjørn Rohde Jensen ) +- Add support for proxy tickets (Bjørn Rohde Jensen ) +- Add support for renewing login (Bjørn Rohde Jensen ) +- Add an optional logged out landing page with a return url (Bjørn Rohde Jensen ) +- Add support for specifying an idp during login thus skipping the wayf step (Bjørn Rohde Jensen ) +- Add support for specifying a language hint during login (Bjørn Rohde Jensen ) + +### Removed + +- Remove support for storing tickets in proprietary key-value store AttributeStore (Bjørn Rohde Jensen ) + +## [4.0.0] - 2013-01-29 + +### Added + +- Add an abstract cas ticket store with concrete subclasses to store tickets locally or in the attribute store (Bjørn Rohde Jensen ) + +### Changed + +- Move all filters to a dedicated project (Bjørn Rohde Jensen ) +- Move theme related code into the sbthemes project (Bjørn Rohde Jensen ) +- Change cas 2.0 response generation from hand coded to using php dom document (Bjørn Rohde Jensen ) + +### Fixed + +- Fix a bug in cas 1.0 response generation, where yes/no was returned in upper case (Bjørn Rohde Jensen ) + +## [3.3.0] - 2012-10-31 + +### Changed + +- IPRoleMapper can now be configured to add its roles to any given attribute by setting the filter parameter 'targetAttributeName' (Bjørn Rohde Jensen ) + +## [3.2] - 2012-10-24 + +### Added + +- Add AttributeCollector auth filter for collecting attributes from the attribute store (Bjørn Rohde Jensen ) +- Add CAS logout (Bjørn Rohde Jensen ) + +## [3.1] - 2012-05-22 + +### Fixed + +- Correct a spelling bug (Per Møldrup-Dalum ) + +## [3] - 2012-05-08 + +### Added + +- Add the Statsbiblioteket theme from sbdisco (Per Møldrup-Dalum ) +- Add the IP role mapper from sbdisco (Per Møldrup-Dalum ) + +## [2.3] - 2011-10-31 + +### Added + +- Add a hack to keep compatibility with the eduPersonNIN attribute (Per Møldrup-Dalum ) + +## [2.2] - 2011-03-29 + +### Added + +- Add configurable base 64 encoding of attribute values (Per Møldrup-Dalum ) + +### Changed + +- Reintroduce ignore urn:oid attributes (Per Møldrup-Dalum ) +- Change the casserver to use the configured auth source (Per Møldrup-Dalum ) + +### Removed + +- Remove debug messages (Per Møldrup-Dalum ) + +## [None] - 2011-01-18 + +### Changed + +- Change default from disabled to enabled (Per Møldrup-Dalum ) + +## [2.1] - 2011-01-17 + +### Changed + +- All files are rewritten based on work by Dubravko Voncina (Per Møldrup-Dalum ) +- See Google Groups discussion in this thread: (Per Møldrup-Dalum ) +- The files in www has all been changed to use the new "namespace" (Per Møldrup-Dalum )