• Fixed issue where the plugin did not enable when the analytics plugins of the host application is disabled.
• Fixed NoClassDefFoundError during user export to Excel.
• Added option to enable inline Javascript in POST binding form.
• Less verbose default logging during login and plugin upgrade.

• Fixed issue where the plugin did not enable when the analytics plugins of the host application is disabled.
• Fixed NoClassDefFoundError during user export to Excel.
• Added option to enable inline Javascript in POST binding form.
• Less verbose default logging during login and plugin upgrade.

• Fixed "pick first non-empty attribute" transformer to not return empty strings.
• Allow disabling Content Security Policy "default-src 'self'" on the SAML POST binding form that caused issues in some situations where the application is accessed from different URLs.
• Fixed NullPointerException in Bitbucket during OIDC login.

• Fixed "pick first non-empty attribute" transformer to not return empty strings.
• Allow disabling Content Security Policy "default-src 'self'" on the SAML POST binding form that caused issues in some situations where the application is accessed from different URLs.
• Fixed NullPointerException in Bitbucket during OIDC login.

New in 6.1.1:

• Fixed WebSudo (additional authentication) issue introduced in SAML Single Sign-On 6.1.0.

New in 6.1.0:

Together with minor fixes and updates, this version includes for the first time app analytics that collects anonymous configuration data with the purpose of improving the product. Learn more on the FAQs.

• SAML Single Sign-On 6.1.0 comes with the User Sync 2.5.0 release, see 2.5.x release notes
• When doing SP-initiated SSO, the SAML RelayState parameter now no longer contains the requested URL itself. Sending a deep link URL in the RelayState using IdP-initiated SSO is still working.
• When importing multi-IdP metadata, a certificate can be configured to validate the metadata against.
• Generating IdP names while importing multi-IdP metadata can now be customized using Groovy code.
• Fixed: the logout response for Single Logout now contains the original relay state.
• Several other minor fixes and improvements.

New in 6.1.1:

• Fixed WebSudo (additional authentication) issue introduced in SAML Single Sign-On 6.1.0.

New in 6.1.0:

Together with minor fixes and updates, this version includes for the first time app analytics that collects anonymous configuration data with the purpose of improving the product. Learn more on the FAQs.

• SAML Single Sign-On 6.1.0 comes with the User Sync 2.5.0 release, see 2.5.x release notes
• When doing SP-initiated SSO, the SAML RelayState parameter now no longer contains the requested URL itself. Sending a deep link URL in the RelayState using IdP-initiated SSO is still working.
• When importing multi-IdP metadata, a certificate can be configured to validate the metadata against.
• Generating IdP names while importing multi-IdP metadata can now be customized using Groovy code.
• Fixed: the logout response for Single Logout now contains the original relay state.
• Several other minor fixes and improvements.

• Removed inline JavaScript from hidden POST binding form to avoid issues with Content Security Policy and caching.
• Added progress logger for better debugging of login performance issues.

• Removed inline JavaScript from hidden POST binding form to avoid issues with Content Security Policy and caching.
• Added progress logger for better debugging of login performance issues.

• SAML Single Sign-On 6.0.10 comes with the User Sync 2.4.5 release, see 2.4.x release notes.
• Added option to make XML Schema validation optional for SAML responses.
• Added missing cache directive for POST binding form.
• Updated libraries.

• SAML Single Sign-On 6.0.10 comes with the User Sync 2.4.5 release, see 2.4.x release notes.
• Added option to make XML Schema validation optional for SAML responses.
• Added missing cache directive for POST binding form.
• Updated libraries.

• SAML Single Sign-On 6.0.9 comes with the User Sync 2.4.4 release, see 2.4.x release notes.
• Fixed issue with Single Logout where the logout URL was not used when using redirect binding.

• SAML Single Sign-On 6.0.9 comes with the User Sync 2.4.4 release, see 2.4.x release notes.
• Fixed issue with Single Logout where the logout URL was not used when using redirect binding.

• SAML Single Sign-On 6.0.6 comes with the User Sync 2.4.2 release, see 2.4.x release notes.
• Fixed possible XSS vulnerability on old browsers by injecting Javascript code in the redirectTo parameter.
• Fixed: exported support information could have contained sensitive information from the configured JVM arguments. The JVM arguments are no longer included in the support information.
• Fixed: enabling the option "Use Base URL from Request" caused wrong SAML request.
• Fixed slow logouts on Bitbucket Data Center setups.

• SAML Single Sign-On 6.0.6 comes with the User Sync 2.4.2 release, see 2.4.x release notes.
• Fixed possible XSS vulnerability on old browsers by injecting Javascript code in the redirectTo parameter.
• Fixed: exported support information could have contained sensitive information from the configured JVM arguments. The JVM arguments are no longer included in the support information.
• Fixed: enabling the option "Use Base URL from Request" caused wrong SAML request.
• Fixed slow logouts on Bitbucket Data Center setups.

New in 6.0.4:

• Fixed: Use SHA-256 instead of SHA-1 as digest algorithm.
• Fixed: NameIDPolicy was missing in AuthnRequest.
• Fixed email preset in attribute mapping for Google Cloud Identity (G Suite).

New in 6.0.3:

• SAML Single Sign-On 6.0.3 comes with the User Sync 2.4.1 release, which fixes an issue with the Azure full sync, see 2.4.x release notes.

New in 6.0.2:

• Fixed generating metadata for Service Provider (organizations section).

New in 6.0.1:

• Fixed login issue when IdP sends multiple attributes with the same key.
• Added new preset "Use UPN and convert guest users" for the email attribute in the Azure connector.

New in 6.0.0:

• SAML Single Sign-On 6.0.0 comes with the User Sync 2.4.0 release, see 2.4.x release notes.
• Support for OpenID Connect (beta)
• Replaced OpenSAML with OneLogin SAML/Java
• Removed separate SAMLWrapper-plugin
• Several improvements and bugfixes, see our release notes.

New in 6.0.4:

• Fixed: Use SHA-256 instead of SHA-1 as digest algorithm.
• Fixed: NameIDPolicy was missing in AuthnRequest.
• Fixed email preset in attribute mapping for Google Cloud Identity (G Suite).

New in 6.0.3:

• SAML Single Sign-On 6.0.3 comes with the User Sync 2.4.1 release, which fixes an issue with the Azure full sync, see 2.4.x release notes.

New in 6.0.2:

• Fixed generating metadata for Service Provider (organizations section).

New in 6.0.1:

• Fixed login issue when IdP sends multiple attributes with the same key.
• Added new preset "Use UPN and convert guest users" for the email attribute in the Azure connector.

New in 6.0.0:

• SAML Single Sign-On 6.0.0 comes with the User Sync 2.4.0 release, see 2.4.x release notes.
• Support for OpenID Connect (beta)
• Replaced OpenSAML with OneLogin SAML/Java
• Removed separate SAMLWrapper-plugin
• Several improvements and bugfixes, see our release notes.

• SAML Single Sign-On 6.0.3 comes with the User Sync 2.4.1 release, see 2.4.x release notes.
• Support for OpenID Connect (beta)
• Replaced OpenSAML with OneLogin SAML/Java
• Removed separate SAMLWrapper-plugin
• If Idp-selection by email is enabled and a selection-cookie is present, the page to enter the email address can be shown.
• Remove "prevent login form" option from the configuration-UI. Use Deny Password Authentication to prevent users from using a password.
• Fixed IdP-dropdown width when many IdPs are configured.
• Fixed missing validation for invalid directory selection.
• Fixed configuration frontend issue when the logged in user had no email address configured.
• Metadata is no longer reloaded automatically when loaded from a file
• Fixed misleading warning message "Not initialized" in the logs on plugin startup

• SAML Single Sign-On 6.0.3 comes with the User Sync 2.4.1 release, see 2.4.x release notes.
• Support for OpenID Connect (beta)
• Replaced OpenSAML with OneLogin SAML/Java
• Removed separate SAMLWrapper-plugin
• If Idp-selection by email is enabled and a selection-cookie is present, the page to enter the email address can be shown.
• Remove "prevent login form" option from the configuration-UI. Use Deny Password Authentication to prevent users from using a password.
• Fixed IdP-dropdown width when many IdPs are configured.
• Fixed missing validation for invalid directory selection.
• Fixed configuration frontend issue when the logged in user had no email address configured.
• Metadata is no longer reloaded automatically when loaded from a file
• Fixed misleading warning message "Not initialized" in the logs on plugin startup

• Fixed deeplinking to repos with Javascript files.
• SAML Single Sign-On 5.2.1 comes with the User Sync 2.2.1 release, see 2.2.x release notes.

• Fixed deeplinking to repos with Javascript files.
• SAML Single Sign-On 5.2.1 comes with the User Sync 2.2.1 release, see 2.2.x release notes.

• SAML Single Sign-On 5.2.0 comes with the User Sync 2.2.0 release, see 2.2.x release notes.
• Some minor bugfixes.

• SAML Single Sign-On 5.2.0 comes with the User Sync 2.2.0 release, see 2.2.x release notes.
• Some minor bugfixes.

• Improved Groovy attribute transformations. If you're using custom Groovy based attribute transformations, please check that user attributes are assigned properly after upgrading. There may be edge cases where adjusting the Groovy code is beneficial or required. If unsure, please open a support ticket and attach your configuration before upgrading so we can validate it.
• When using Crowd directories backed by LDAP, triggering the LDAP update in Crowd uses a builtin REST endpoint, so our Crowd plugin is no longer required.
• SAML Single Sign-On 5.1.2 comes with the User Sync 2.1.1 bugfix release, see 2.1.x release notes.

• Improved Groovy attribute transformations. If you're using custom Groovy based attribute transformations, please check that user attributes are assigned properly after upgrading. There may be edge cases where adjusting the Groovy code is beneficial or required. If unsure, please open a support ticket and attach your configuration before upgrading so we can validate it.
• When using Crowd directories backed by LDAP, triggering the LDAP update in Crowd uses a builtin REST endpoint, so our Crowd plugin is no longer required.
• SAML Single Sign-On 5.1.2 comes with the User Sync 2.1.1 bugfix release, see 2.1.x release notes.

• SAML Single Sign-On 5.0.7 comes with the User Sync 2.0.5 bugfix release, see 2.0.x release notes.

• SAML Single Sign-On 5.0.7 comes with the User Sync 2.0.5 bugfix release, see 2.0.x release notes.

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

This update includes the bugfix release of User Sync 1.9.7, which fixes the synchronization with OneLogin.

This update includes the bugfix release of User Sync 1.9.7, which fixes the synchronization with OneLogin.

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known

Sorry! - We have to ask you to update (again!)

On July 29th, we released a "fix version" for a critical security vulnerability, however, due to researcher feedback & additional follow-up, we realized another attack vector.

This version (released August 12th) addresses this additional scenario. We expected this to be the final & complete fix.

To allow upgrades to a fix version without major upgrades in the Atlassian application, all public versions in the marketplace include the fix to the security vulnerability.

Please reference the version history for the most relevant version for your instance. https://marketplace.atlassian.com/apps/1217045/saml-single-sign-on-saml-sso-bitbucket/version-history

Please refer to this wiki page for the latest status: https://wiki.resolution.de/doc/saml-sso/latest/jira/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known