SSOPress
Pobierz wersję darmowąKup Pro

Changelog

What's new in SSOPress.

Release notes, feature additions, and breaking changes. Subscribe to the blog for longer-form announcements.

v1.1.0

minor

Role mapping now follows the provider on every login. A user whose group or membership value disappears drops to the default role, with a new setting to keep the old behaviour if you want it.

Fixes

  • A login whose role value is missing now assigns the default role. Previously the existing role was left in place, so a user whose provider group or membership had ended kept it (Pro)
  • The stored role value is cleared when the provider stops sending one, so user meta reflects the last login

Features

  • New Active Member Attribute setting: point it at a true/false field in the userinfo response and a false value is treated as no role value, even if a stale role value is still present (Pro)
  • New Keep Existing User Roles setting: assign a role on account creation only and leave existing users alone on every login. Off by default; this makes the previous behaviour an explicit choice (Pro)
  • Administrators, editors, authors and contributors are never changed by a login. Filterable via ssopress_protected_roles

Audit logs

  • User created and user updated events now record the active-member flag and whether a role was preserved

v1.0.0

initial

First public release. SSOPress is live on WordPress.org with a complete OAuth 2.0 / OIDC flow, user provisioning, encrypted credential storage, and rate-limited endpoints.

Features

  • OAuth 2.0 authorization code flow with PKCE-style state validation
  • OpenID Connect userinfo support with standard and custom claim mapping
  • Automatic WordPress user creation and profile sync on each login
  • Dot-notation attribute mapping for nested claim structures
  • Custom login button on wp-login.php with optional hiding of the standard form
  • Admin backdoor via ?oauthlogin=false to recover access if OAuth misconfigures

Security

  • Client secret encryption at rest via libsodium with OpenSSL fallback
  • 64-character hex state tokens with format validation on callback
  • Per-IP rate limiting on OAuth init and callback endpoints (default 20 req/min)
  • Safe redirect validation on redirect_to parameter
  • WordPress nonce protection on all admin forms

Audit logs

  • Seven event types tracked: attempt, success, failure, token exchange, userinfo fetch, user created, user updated
  • Per-event IP address, user agent, error code, error message, and structured metadata
  • Configurable retention with automatic daily pruning via WP-Cron
  • Searchable admin UI (Pro)

Pro features

  • Role mapping from OAuth claim values to WordPress roles
  • Custom attribute mapping beyond standard OIDC claims
  • Full searchable audit log UI with filtering
  • Email support