SSO for Microsoft Entra

2.6.1

• Fixed: WordPress.org plugin directory assets (icon, banner) served from the correct SVN path.

2.6.0

• Added: Database upgrade system with sfme_db_version and automatic migration of legacy option prefixes.
• Added: OAuth state is now bound to the initiating browser session via a short-lived sfme_oauth_session cookie.
• Added: sfme_allow_email_linking filter and sfme_user_linked_by_email action for controlling email-based account linking.
• Changed: Minimum PHP requirement is now 8.0.
• Fixed: uninstall.php now fully removes all current-version plugin data.

2.5.3

• Fixed: Remove .gitkeep placeholder files that were incorrectly included in the release package (WordPress Plugin Check: hidden_files).

2.5.2

• Fixed: ID token signature verification failed (jwt_signature_invalid) for Entra apps that use per-application signing keys. The plugin now appends ?appid={client_id} when fetching the JWKS so the app-specific signing key is included.

2.5.1

• Fixed: /sso/login returning 404 after activation — rewrite rule is now registered before flush.

2.5.0

• Breaking: Removed role mapping and default role selector. All new SSO users are assigned the Subscriber role. Administrators promote users manually.
• Removed: Role Mapping settings section and Role_Mapper class.

2.4.0

• Added: Settings link on the Plugins page next to Deactivate.

2.3.0

• Fixed: Validate $_SERVER[‘REQUEST_METHOD’] before accessing it (Plugin Check compliance).
• Fixed: Sanitize redirect_to parameter with sanitize_url().
• Fixed: Prefix template variables with sfme_ to avoid global namespace collisions.
• Fixed: Suppress expected slow DB query warning on Entra OID user lookup.
• Fixed: Reduce tags to 5 maximum per WordPress.org guidelines.

2.2.0

• Breaking: Removed SAML 2.0 support. The plugin now uses OpenID Connect with PKCE exclusively.
• Breaking: Removed robrichards/xmlseclibs and litesaml/lightsaml dependencies — no Composer vendor packages required.
• Breaking: Removed SAML Metadata Import section, protocol selector, and /sso/saml-acs endpoint.
• Fixed: Client secret sanitization no longer trims whitespace before encrypting (preserves secrets with leading/trailing spaces).
• Fixed: Removed load_plugin_textdomain() call — unnecessary for WordPress.org hosted plugins since WordPress 4.6.
• Improved: External Services section in readme rewritten with detailed data flow description.

2.0.3

• Fixed: JS lint errors in protocol toggle (CI green).

2.0.2

• Fixed: Skip Client Secret requirement when SAML protocol is selected.
• Fixed: Hide Client Secret field in settings when SAML 2.0 is active.
• Fixed: Settings URL slug and plugin name in admin notices.

2.0.1

• Fixed: Update “Tested up to” to WordPress 6.9.
• Fixed: Include composer.json in distribution (Plugin Check compliance).
• Added: README.md for GitHub with badges, support links.
• Added: Support section in readme.txt with GitHub Issues link.

2.0.0

• Breaking: Renamed plugin from “Microsoft Entra SSO” to “SSO for Microsoft Entra” for trademark compliance.
• Breaking: All internal names changed — namespace (SFME), option keys (sfme_*), CSS/JS classes (sfme-*). Existing settings auto-migrate on activation.
• Breaking: Requires PHP 8.1+ (LightSaml dependency).
• Added: Auto-extract Tenant ID and Client ID from federation metadata URL.
• Added: Auto-switch to SAML protocol when importing metadata.
• Added: Configurable rate limiting settings in admin (Max Attempts, Window).
• Added: Contextual Help tabs on settings page (Quick Start, Azure Setup, SAML Setup, Troubleshooting).
• Added: WordPress.org plugin assets (icon, banner).
• Added: Vietnamese translation.
• Fixed: SAML signature verification — replaced manual XML canonicalization with LightSaml library.
• Fixed: UTF-8 BOM in Microsoft federation metadata causing XML parse failure.
• Fixed: SAML Issuer using home URL instead of client ID (AADSTS700016).
• Fixed: Metadata wiped on settings save — now preserves AJAX-imported values.

1.2.0

• Auto-extract Tenant ID and Client ID from federation metadata URL on import.
• Auto-switch to SAML protocol when importing metadata.
• Rate limiting settings in admin UI.
• Strip UTF-8 BOM from Microsoft metadata XML.
• Use client ID as SAML AuthnRequest Issuer.
• Preserve SAML metadata on settings form save.

1.1.0

• Security: Fix critical SAML Signature Wrapping (XSW) and XPath injection.
• Security: Fix double rate-limiting lockout after 2 logins.
• Security: Add JWKS cache-refresh-on-failure.
• Security: Use HKDF for encryption key derivation.
• Changed: SSO endpoints moved from wp-login.php to /sso/* custom URLs.

1.0.0

• Initial release.
• OpenID Connect with PKCE, SAML 2.0, user provisioning, role mapping, rate limiting.