Single sign-on is preserved across upgrades

Upgrading no longer drops a configured single sign-on. An install coming from an older version with OpenID Connect set up could find SSO gone after the upgrade, because the older version derived the return address automatically and the newer one requires it explicitly. The provider is now carried over intact — issuer, client id, and secret — and only the sign-in button is withheld until you supply the return address on the SSO page.

An identity provider can now also be created and saved first and have its return address filled in afterward, instead of requiring everything up front.

No action required.