Addons by Reinos

Appearance

Changelog ​

6.0.0 (unreleased) ​

  • Security: members created by SSO got a guessable password (md5(time())), passwords are now random. Existing SSO members keep the old password, reset them after updating
  • Security: the yes/no settings were not read correctly when they were never saved, so Allow social login to merge with non social accounts could be active on a fresh install
  • Security: new setting Require a verified email to link an existing account (enabled by default), only link a provider to an existing account when the provider verified the email
  • Security: banned and pending members can no longer log in with a provider
  • Security: the return and new_member_return params only redirect to the own site (open redirect). Allow extra hosts with $config['reinos_sso_allowed_redirect_hosts']
  • Security: disconnecting a provider requires the CSRF token of the session. Custom disconnect links must add &csrf_token={csrf_token} (Breaking change)
  • Security: avatars are downloaded with timeouts, a size limit and an image check
  • Updated: Hybridauth 3.13.0 (CVE-2026-4587, SSL certificates are now verified, the server needs an up-to-date CA bundle) and phpseclib 3.0.57
  • Updated: php-jwt 7.2.1 (GHSA-2x45-7fc3-mxwq), used by Sign in with Apple and the Facebook limited login
  • Added: providers Microsoft, LinkedIn (OpenID Connect), GitHub, Discord and X
  • Added: providers Amazon, PayPal, Yahoo, Twitch, Slack, GitLab (also self-managed), Keycloak and Okta
  • Added: a generic OpenID Connect provider (Auth0, Authentik, Zitadel, ...) with discovery and PKCE
  • Updated: the providers page in the CP is an overview per group with the status of each provider (enabled, missing settings, off), a status filter, a search and bulk enable/disable. Each provider has its own edit page
  • Added: set the provider credentials in config.php with $config['reinos_sso_providers']
  • Added: Remember me setting
  • Added: hooks sso_before_create_member, sso_auth_error and sso_disconnect
  • Added: translate="yes" param for {exp:reinos_sso:auth_error}
  • Added: filters (severity, date, keyword), bulk delete and a CSV export on the log page in the CP
  • Added: paging, a provider filter and a search on the member (name, email) on the linked accounts page in the CP
  • Updated: the control panel pages use the ExpressionEngine 7 control panel routes. The settings page moved from addons/settings/reinos_sso/settings to addons/settings/reinos_sso
  • Updated: the $new_member param of the sso_login hook is only true when the login created the member (Breaking change)
  • Bugfix: where connecting a provider with {provider_connect_link} did not work and could log the member in as another member
  • Bugfix: where linking a provider to an existing member sent a new password email, replaced the avatar and used new_member_return
  • Bugfix: where the Zoo Visitor integration threw an error on EE6 and newer
  • Bugfix: where the second hook got the wrong arguments when both the sso_ and reinos_sso_ hook were used
  • Bugfix: where Sign in with Apple did not work on PHP 7.4
  • Bugfix: where Delete all logs also deleted the logs of the other sites
  • Bugfix: where an empty provider setting in the CP was sent to the provider instead of using its default
  • Bugfix: where an enabled provider with missing settings broke the logout
  • Updated: the installer now uses the ExpressionEngine 7 add-on installer and migrations
  • Updated: the action links are split into an auth and a disconnect action. The links of older versions (act_route with &method=auth or &method=disconnect, also via {reinos_sso_action_url}) still work, but are deprecated
  • Added: the global variables {reinos_sso_auth_url} and {reinos_sso_disconnect_url} to build the login and disconnect links yourself, see Disconnect
  • Updated: removed the unused CP CSS action and the cp_js_end hook
  • Updated: the email templates are removed when the add-on is uninstalled
  • Bugfix: where the member_anonymize hook was not installed on a fresh install
  • Updated: removed the code for ExpressionEngine 6 and older, and the migration from the old Sso module
  • Updated: requires ExpressionEngine 7.3+ and PHP 8.0+, for ExpressionEngine 6 use the legacy package (legacy/ee_sso-v5.9.0.zip) (Breaking change)
  • Updated: the legacy packages for ExpressionEngine 3, 4 and 5 are no longer included in the download

5.9.0 (02-09-2026) ​

  • Added: verifyTokenSignature to disable verify token via BCMath or GMP PHP extension
  • Fix: catch Throwable to avoid blank page on some errors
  • Fix: do not redirect when sso_route_callback is called. Handle authentication in the hook itself to avoid a POST-to-GET redirect.
  • chore: new_user_can_use_existing_email setting should always be visible
  • Updated: remove custom license check and rely on the built-in license verification of ExpressionEngine

5.7.0 (22-09-2025) ​

  • Bugfix: PHP 8.4 fixes
  • Update: vendor packages

5.6.0 (12-06-2025) ​

  • Added: no_email_return='' and new_member_return='' param to the {exp:reinos_sso:linked_providers}
  • Added: a new page where you can see all linked accounts - no management, just a view
  • Added: Detect and remove duplicate identifiers who do not have a native member linked
  • Added: Delete SSO member by identifier when a member is deleted, this ensure a healty state of the linked members
  • Bugfix: where it could in some cases not load the provider
  • Bugifx: where it could throw an error if the upload folder for Avatars does not exists
  • Bugfix: where the connect url contains a wrong link
  • Bugfix: Send only password when the user is a new EE user
  • Bugfix: where the 'Allow social login to merge with non social accounts' was working in the opposite way
  • Bugfix: avoid a hard error when saving the avatar when the path is incorrect (mostly after a migration)

5.5.0 (26-02-2025) ​

  • Rename the callback link from https://your-domain.com/sso_route/auth/{provider_name} to https://your-domain.com/sso_route_callback/auth/{provider_name}. (Breaking changes - You should check your callback link with the providers)
  • Bugfix: disconnect was not working at all
  • Added: option to send an email with the new password once a user disconnect
  • Updated: added new icon

5.4.6 (13-07-2024) ​

  • Updated: vendors to fix Apple Sign In Issues
  • Bugfix: PHP 8.x dynamic variables creation

5.4.5 (15-10-2023) ​

  • Bugfix: issue where option disable new members was not working
  • Updated: PHP 8.2 support

5.4.4 (23-08-2023) ​

  • Bugfix: where the avatar was not saved correctly (again)
  • Bugfix: where facebook avatar was correctly fetched with an access_token
  • Update: min PHP version to PHP 7.4

5.4.3 (31-01-2023) ​

  • Bugfix: where the avatar was not saved correctly

5.4.2 (18-01-2023) ​

  • Fixed: incorrect const name

5.4.1 (04-12-2022) ​

  • Fixed: correct version number

5.4.0 (13-11-2022) ​

  • Added: Apple Sign in
  • Added: option to disable new member registration via the SSO module

5.3.1 (17-05-2022) ​

  • Bugfix: issue where visitor was throwing a PHP error

5.3.0 (23-04-2022) ​

  • Added: introduce tag
  • Bugfix: no matching hash algorithm PHP error

5.2.1 (24-11-2021) ​

  • Added: settings to disable the default member registration

5.2.0 (18-11-2021) ​

  • Added: delete user from sso table when anonymized

5.1.1 (27-09-2021) ​

  • Bugfix: EE6 issue for Zoo Visitor
  • Bugfix: Visitor create 2 or none accounts for a user
  • Removed: check on member registration is off due the way how SSO is working

5.1.0 (13-04-2021) ​

  • Added: extra user logging
  • Bugfix: where the avatar cannot be synced
  • Bugfix: where sometimes the user catch a blank page
  • Bugfix: remove linkedin scope w_member_social
  • Docs: wrong tag was shown for the collect email form in the settings

5.0.1 (25-02-2021) ​

  • Bugfix: where in some cases login was showing an empty page

5.0.0 (29-12-2020) ​

  • Added: EE6 support

4.0.2 (08-12-2020) ​

  • Added: obey member registration option
  • Bugfix: have a default member password

4.0.1 (31-03-2020) ​

  • Bugfix: where the slug for visitor cannot be created
  • Bugfix: where the hooks where not called correctly

4.0.0 (27-01-2020) ​

  • Updated: Hybridauth
  • Refactor: License settings due the release of the EE store (*Breaking changes)
  • Refactor: Rename the module with a prefix of reinos_ due the release of the EE store (**Breaking changes)

*Note: There is a change you will have to validate the license again

**Note: Because the module has been renamed with a prefix reinos_ there is an update path by simply add the new update to*** your site and install it. By installing the module, you are disabling the old module that can be deleted afterward. Also note that you have to rename the module calls and hooks with a prefix reinos_

Also note that the module need to be installed twice, as the first installation will modify some files in order to safely migrate the module

See this article about the rename https://addons.reinos.nl/news/modules-renamed

3.1.0 (03-04-2019) ​

  • Refactor: user login, so the password does not change
  • Bugfix: where the avatar could not be saved

3.0.2 (18-03-2019) ​

  • Bugfix: where existing users cannot login
  • Bugfix: where the notification mail was sent because of the password change

3.0.1 (06-03-2019) ​

  • Bugfix: where the entry url cannot be set for the Visitor module if installed

3.0.0 (19-02-2019) ​

  • Added: possibility to enter an email if no email is fetched from the social site
  • Added: {exp:sso:email_error} tag in the collect email tag
  • Added: option for "Allow social logins to merge with non social accounts" Default to no for security reasons.
  • Added: {exp:sso:auth_error} tag for general auth errors
  • Added: {exp:sso:linked_providers} for connect multiple providers to one account
  • Added: multiple developer extension hooks
  • [BREAKING] Removed: {exp:sso:login_error} tag (use {exp:sso:auth_error})

2.3.0 (25-01-2019) ​

  • Bugfix: where the selection of enabled providers was not showing correctly
  • Bugfix: where the MSM was not working correctly
  • Updated: hybrid to v2.12.0
  • Added: no_email_return="" param that is used when there is no mail available from the social login
  • Added: new_member_return="" when the user is new

2.2.0 (19-12-2018) ​

  • Added: EE5 support
  • Stopped: EE3 feature development. Only bugfixes are done into the EE3 branch.

2.1.1 (09-06-2018) ​

  • Added: license support for MSM

2.1.0 (25-04-2018) ​

  • Added: new license field (*Breaking changes) [EE3, EE4]
  • Bugfix: PHP 7.2 issue [EE3, EE4]

***Note: you need to add your license key and license email from addons.reinos.nl in order to validate your license and add a valid domain url in your license field on addons.reinos.nl/profile/licenses or the module will not work on a live site. Also make sure you have read the license section in the documentation **

2.0.0 (04-12-2017) ​

  • Added: EE4 support
  • Refactor: Module updater

1.1.1 (01-11-2017) ​

  • Bugfix: issue with the linkedIn keys
  • Update: HybridAuth

1.1.0 (25-07-2017) ​

  • Updated: avoid reset password every time on login
  • Added: send email when a user is created with a password
  • Added: profile picture update for the avatar
  • Small bugfixes

1.0.2 (02-03-2017) ​

  • Update: HybridAuth

1.0.1 (30-09-2016) ​

  • Updated: callback url & is already encoded

1.0.0 (08-09-2016) ​

  • init release.