Access Platform SSO 1.2.5

Preserve complete same-site Library return URLs through Access SSO. Fixes first sign-in failures caused by nested authorization parameters escaping into the SSO start query. Adds behavioral round-trip and redirect-safety regression coverage.

Version 1.2.4

Access Platform SSO v1.2.4

Account Page: "Manage or cancel your membership" banner

• The banner now shows only to members billed through Access, decided from their MemberPress subscriptions (gateway manual with a sub_ Stripe subscription id), not from Access SSO login metadata.
• Legacy members billed by MemberPress's own Stripe gateway no longer see it, even after logging in through Access or being viewed with admin "Login as". Their native Update/Pause/Cancel controls are unchanged.
• Access-billed members who log in with a WordPress password now see it too.
• A cancelled Access subscription no longer shows the banner while another subscription is active or paused.
• The subscription lookup never prints a database error into the page.

No changes to login or SSO.

Version 1.2.3

Access Platform SSO v1.2.3

Restored Access Admin Propagation

• Restores automatic promotion of Access administrators to WordPress administrators.
• Applies to both newly created and existing WordPress users upon their next Access SSO login.
• Supports the Access admin claims is_admin, access_role, and role.
• Does not downgrade or replace roles for non-admin users.

Security

Administrator promotion is accepted only from a fully validated, site-specific, single-use JWT. Validation includes:

• JWT signature
• Expiration and issued-at timestamps
• Trusted issuer and audience
• Exact canonical Access site ID
• Replay protection

Version 1.2.2

• Site-initiated Login with Access now works on hosts that strip cookies from cacheable URLs (WP Engine): state cookie renamed to wordpress_access_sso_state and state logins return through the uncached admin-post.php?action=access_sso_callback endpoint.
• Access-initiated dashboard launches land on the page Access configured for the site (signed redirect_to, same-site only) instead of always the plugin default.

Version 1.2.1

v1.2.1

v 1.2.1

v1.2.0

v 1.2.0

Access Platform SSO 1.1.9

Fixes WordPress-to-application login continuations so Access SSO returns members to the authorization flow and original application route.

Security hardening:

• browser-bound, one-time login state
• safe local redirect validation
• single-use, short-lived JWT callbacks
• WordPress-owned roles and authorization
• hashed session and request fingerprints
• rate limiting, no-store responses, and cache exclusions
• redacted diagnostics and stricter admin nonces

Install wp-access-sso-1.1.9.zip on each WordPress site using Access SSO.

Version 1.1.8

Admin SSO now propagates to wp user

Version 1.1.7

Fixing Site ID mismatch

Version 1.1.6

Added an impersonation banner to allow admins to exit impersonation and return back to access