33This is an upgrade guide from versions 1 → 7. Review the changes and
44apply those relevant to your deployment.
55
6- In general, when upgrading any of the SimpleSAMLphp modules or the
6+ In general, when upgrading any of the SimpleSAMLphp modules or the
77SimpleSAMLphp instance itself, you should clear the SimpleSAMLphp
8- cache after the upgrade. In newer versions of SimpleSAMLphp, the
8+ cache after the upgrade. In newer versions of SimpleSAMLphp, the
99following command is available to do that:
1010
1111``` shell
@@ -21,7 +21,7 @@ New features:
2121
2222- Instance can now be configured to support multiple algorithms and signature
2323keys for protocol (Connect), Federation, and VCI purposes. This was introduced
24- to support signature algorithm negotiation with the clients.
24+ to support signature algorithm negotiation with the clients.
2525- Clients can now be configured with new properties:
2626 - ID Token Signing Algorithm (` id_token_signed_response_alg ` )
2727- Optional OAuth2 Token Introspection endpoint, as per RFC7662. Check the API
@@ -33,9 +33,9 @@ it in production.
3333New configuration options:
3434
3535- ` ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS ` - (required) enables
36- defining multiple protocol (Connect) related signing algorithms and key pairs.
36+ defining multiple protocol (Connect) related signing algorithms and key pairs.
3737- ` ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS ` - (required if
38- federation capabilities are enabled) enables defining multiple key pairs for
38+ federation capabilities are enabled) enables defining multiple key pairs for
3939Federation purposes like signing Entity Statements, publishing new key for
4040key roll-ower scenarios, etc.
4141- ` ModuleConfig::OPTION_VCI_SIGNATURE_KEY_PAIRS ` - (required if VCI
@@ -51,7 +51,7 @@ optional, enables the OAuth2 token introspection endpoint as per RFC7662.
5151
5252Major impact changes:
5353
54- - The following configuration options related to the protocol (Connect)
54+ - The following configuration options related to the protocol (Connect)
5555signature algorithm and key pair are removed:
5656 - ` ModuleConfig::OPTION_PKI_PRIVATE_KEY_PASSPHRASE `
5757 - ` ModuleConfig::OPTION_PKI_PRIVATE_KEY_FILENAME `
@@ -73,11 +73,11 @@ and key pair are removed:
7373 - ` ModuleConfig::OPTION_PKI_FEDERATION_NEW_PRIVATE_KEY_PASSPHRASE `
7474 - ` ModuleConfig::OPTION_PKI_FEDERATION_NEW_PRIVATE_KEY_FILENAME `
7575 - ` ModuleConfig::OPTION_PKI_FEDERATION_NEW_CERTIFICATE_FILENAME `
76-
76+
7777 Instead of those options, now you must use option
7878 ` ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS ` in which you can define
7979 all the supported signature keys for Federation purposes.
80- - Config option ` ModuleConfig::OPTION_HOMEPAGE_URI ` is removed. Use
80+ - Config option ` ModuleConfig::OPTION_HOMEPAGE_URI ` is removed. Use
8181` ModuleConfig::OPTION_ORGANIZATION_URI ` instead.
8282- New algorithm for generating Key ID claim value (` kid ` ) for signature keys
8383is used. Previously, key ID was based on public key file hash. In v7, key ID
@@ -87,7 +87,7 @@ current signature keys, you will probably want to keep the old `kid` values,
8787so that the clients know the keys did not change. You can set the old
8888` kid ` value manually for signature keys in
8989` ModuleConfig::OPTION_PROTOCOL_SIGNATURE_KEY_PAIRS ` and
90- ` ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS ` . Once you do a key
90+ ` ModuleConfig::OPTION_FEDERATION_SIGNATURE_KEY_PAIRS ` . Once you do a key
9191roll-over, you can omit setting the ` kid ` manually, so you start using the
9292automatically generated thumbprint.
9393- In v6 of the module, when defining custom scopes, there was a possibility to
@@ -97,7 +97,7 @@ have a single value by specification. All [standard claims](https://openid.net/s
9797are now hardcoded to have a single value, even when the
9898'are_multiple_claim_values_allowed' option is enabled.
9999- OpenID Federation specific endpoints for subordinate listing and fetching
100- statements about subordinates are removed, as the final specification
100+ statements about subordinates are removed, as the final specification
101101explicitly states that leaf entities must not have those endpoints.
102102This effectively means that this OP implementation can only be a leaf entity
103103in the federation context, and not a federation operator or intermediary entity.
@@ -113,6 +113,12 @@ needed since the OP implementation can only be a leaf entity
113113- Admin menu item "OIDC" has been renamed to "OIDC OP" to better reflect
114114the main purpose of the module.
115115
116+ ## Version 6.3 to 6.4
117+
118+ This is a minor release in order to enable installation of the module with
119+ SimpleSAMLphp v2.5.* , which now requires at least PHP v8.3 and bumps a bunch
120+ of dependent Symfony packages to v7.4.
121+
116122## Version 5 to 6
117123
118124New features:
0 commit comments