Releases for SAML Authentication

Contributors (13)

Add a summary here

Warning: Module versions 8.x-3.3 - 8.x-3.8 have compatibility issues with ACSF - and possibly any other modules which manipulate the samlauth config values at runtime. See #3218856: v3.3 change in configuration values breaks ACSF. They also require a change to any of your scripts that would populate those config values; see the changelog (or the diff to samlauth.schema.yml) for details.

#3284901: Configuration (in settings.php) information disclosure by jasonlttl, roderik

Warning:

Fixes:

#3214901: getAccountName() is called on null when account matching by email or name is not allowed by glitchfinity
#3212205: Configuration value for security_assertions_signed not saved to config by bobbygryzynger

Please disregard 8.x-3.0.

Changes since 3.0-RC2:

Fix SA-CONTRIB-2021-006 - possible access bypass, by way of password reset email.

Please check when installing:

The "Allow SAML users to login directly with Drupal" did exactly the opposite from what it said: it would only allow SAML users to log using the Drupal login screen, when it was deselected. The code has now been changed to do what the option says, so the behavior will change after installing the new version.

Also, it is recommended to walk through the new options on the configuration screen and select them if appropriate (e.g. 'Strict mode' which is recommended to enable if at all possible).

Please test this version, there will be a 8.x-3.0 release soonish. (Yes it works on Drupal 9 as well.)

The 8.x-3.x versions use version 3 of the PHP-SAML toolkit, which provides compatibility for PHP7.2 (while also still being compatible with PHP5), by using a new depencency as encryption library.

Other changes:

Known incompatibilities:

The separate e-mail config value for mapping existing users based on e-mail has been removed. Anyone who used it and had it set to a different value than the other e-mail config value, should implement their own handler for the USER_LINK event.

Changes (subset):

Updating for Drupal RC1

Initial release of the SAML Authentication module