CHANGES.rst 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693
  1. repoze.who Changelog
  2. ====================
  3. 2.3 (2016-05-31)
  4. ----------------
  5. - Add support for Python 3.4, Python 3.5, and PyPy3.
  6. - Drop support for Python 2.6 and 3.2.
  7. - ``middleware``: avoid passing extracted ``identity`` to ``remember``
  8. during egress (the app may have called ``api.forget()``). See #21.
  9. - ``_auth_tkt`` / ``plugins.auth_tkt``: add support for any hash algorithm
  10. supported by the ``hashlib`` module in Python's standard library.
  11. Fixes #22 via #23.
  12. - ``plugins.auth_tkt``: Fix storage of "userdata" to save dict. Fixes
  13. #14 via #18.
  14. - middleware: avoid UnboundLocalError when wrapped generater yields no
  15. items. See: http://bugs.repoze.org/issue184
  16. - Make cookie expiration date RFC-2616 compliant (independent of locale,
  17. including 'GMT' zone). See #11.
  18. 2.2 (2013-05-17)
  19. ----------------
  20. - Parse INI-file configuration using ``SafeConfigParser``: allows
  21. escaping the ``'%'`` so that e.g. a query template using for a DB-API
  22. connection using ``pyformat`` preserves the template.
  23. - Added support for Python 3.3, PyPy.
  24. 2.1 (2013-03-20)
  25. ----------------
  26. - ``_compat`` module: tolerate missing ``CONTENT_TYPE`` key in the WSGI
  27. environment. Thanks to Dag Hoidal for the patch.
  28. - ``htpasswd`` plugin: add a ``sha1_check`` checker function (the ``crypt``
  29. module is not available on Windows). Thanks to Chandrashekar Jayaraman
  30. for the patch.
  31. - Documentation typo fixes from Carlos de la Guardia and Atsushi Odagiri.
  32. 2.1b1 (2012-11-05)
  33. ------------------
  34. - Ported to Py3k using the "compatible subset" mode.
  35. - Dropped support for Python < 2.6.x.
  36. - Dropped dependency on Paste (forking some code from it).
  37. - Added dependency on WebOb instead.
  38. Thanks to Atsushi Odagiri (aodag) for the initial effort.
  39. 2.0 (2011-09-28)
  40. ----------------
  41. - ``auth_tkt`` plugin: strip any port number from the 'Domain' of generated
  42. cookies. http://bugs.repoze.org/issue66
  43. - Further harden middleware, calling ``close()`` on the iterable even if
  44. raising an exception for a missing challenger.
  45. http://bugs.repoze.org/issue174
  46. 2.0b1 (2011-05-24)
  47. ------------------
  48. - Enabled standard use of logging module's configuration mechanism.
  49. See http://docs.python.org/dev/howto/logging.html#configuring-logging-for-a-library
  50. Thanks to jgoldsmith for the patch: http://bugs.repoze.org/issue178
  51. - ``repoze.who.plugins.htpasswd``: defend against timing-based attacks.
  52. 2.0a4 (2011-02-02)
  53. ------------------
  54. - Ensure that the middleware calls ``close()`` (if it exists) on the
  55. iterable returned from thw wrapped application, as required by PEP 333.
  56. http://bugs.repoze.org/issue174
  57. - Make ``make_api_factory_with_config`` tolerant of invalid filenames /
  58. content for the config file: in such cases, the API factory will have
  59. *no* configured plugins or policies: it will only be useful for retrieving
  60. the API from an environment populated by middleware.
  61. - Fix bug in ``repoze.who.api`` where the ``remember()`` or ``forget()``
  62. methods could return a None if the identifier plugin returned a None.
  63. - Fix ``auth_tkt`` plugin to not hand over tokens as strings to paste. See
  64. http://lists.repoze.org/pipermail/repoze-dev/2010-November/003680.html
  65. - Fix ``auth_tkt`` plugin to add "secure" and "HttpOnly" to cookies when
  66. configured with ``secure=True``: these attributes prevent the browser from
  67. sending cookies over insecure channels, which could be vulnerable to some
  68. XSS attacks.
  69. - Avoid propagating unicode 'max_age' value into cookie headers. See
  70. https://bugs.launchpad.net/bugs/674123 .
  71. - Added a single-file example BFG application demonstrating the use of
  72. the new 'login' and 'logout' methods of the API object.
  73. - Add ``login`` and ``logout`` methods to the ``repoze.who.api.API`` object,
  74. as a convenience for application-driven login / logout code, which would
  75. otherwise need to use private methods of the API, and reach down into
  76. its plugins.
  77. 2.0a3 (2010-09-30)
  78. ------------------
  79. - Deprecated the following plugins, moving their modules, tests, and docs
  80. to a new project, ``repoze.who.deprecatedplugins``:
  81. - ``repoze.who.plugins.cookie.InsecureCookiePlugin``
  82. - ``repoze.who.plugins.form.FormPlugin``
  83. - ``repoze.who.plugins.form.RedirectingFormPlugin``
  84. - Made the ``repoze.who.plugins.cookie.InsecureCookiePlugin`` take a
  85. ``charset`` argument, and use to to encode / decode login and password.
  86. See http://bugs.repoze.org/issue155
  87. - Updated ``repoze.who.restrict`` to return headers as a list, to keep
  88. ``wsgiref`` from complaining.
  89. - Helped default request classifier cope with xml submissions with an
  90. explicit charset defined: http://bugs.repoze.org/issue145 (Lorenzo
  91. M. Catucci)
  92. - Corrected the handling of type and subtype when matching an XML post
  93. to ``xmlpost`` in the default classifier, which, according to RFC
  94. 2045, must be matched case-insensitively:
  95. http://bugs.repoze.org/issue145 (Lorenzo M. Catucci)
  96. - Added ``repoze.who.config:make_api_factory_with_config``, a convenience
  97. method for applications which want to set up their own API Factory from
  98. a configuration file.
  99. - Fixed example call to ``repoze.who.config:make_middleware_with_config``
  100. (added missing ``global_config`` argument). See
  101. http://bugs.repoze.org/issue114
  102. 2.0a2 (2010-03-25)
  103. ------------------
  104. Bugs Fixed
  105. ~~~~~~~~~~
  106. - Fixed failure to pass substution values in log message string formatting
  107. for ``repoze.who.api:API.challenge``. Fix included adding tests for all
  108. logging done by the API object. See http://bugs.repoze.org/issue122
  109. Backward Incompatibilities
  110. ~~~~~~~~~~~~~~~~~~~~~~~~~~
  111. - Adjusted logging level for some lower-level details from ``info``
  112. to ``debug``.
  113. 2.0a1 (2010-02-24)
  114. ------------------
  115. Features
  116. ~~~~~~~~
  117. - Restored the ability to create the middleware using the old ``classifier``
  118. argument. That argument is now a deprecated-but-will-work-forever alias for
  119. ``request_classifier``.
  120. - The ``auth_tkt`` plugin now implements the ``IAuthenticator`` interface,
  121. and should normally be used both as an ``IIdentifier`` and an
  122. ``IAuthenticator``.
  123. - Factored out the API of the middleware object to make it useful from
  124. within the application. Applications using ``repoze.who``` now fall into
  125. one of three catgeories:
  126. - "middleware-only" applications are configured with middleware, and
  127. use either ``REMOTE_USER`` or ``repoze.who.identity`` from the environment
  128. to determing the authenticated user.
  129. - "bare metal" applications use no ``repoze.who`` middleware at all:
  130. instead, they configure and an ``APIFactory`` object at startup, and
  131. use it to create an ``API`` object when needed on a per-request basis.
  132. - "hybrid" applications are configured with ``repoze.who`` middleware,
  133. but use a new library function to fetch the ``API`` object from the
  134. environ, e.g. to permit calling ``remember`` after a signup or successful
  135. login.
  136. Bugs Fixed
  137. ~~~~~~~~~~
  138. - Fix http://bugs.repoze.org/issue102: when no challengers existed,
  139. logging would cause an exception.
  140. - Remove ``ez_setup.py`` and dependency on it in setup.py (support
  141. distribute).
  142. Backward Incompatibilities
  143. ~~~~~~~~~~~~~~~~~~~~~~~~~~
  144. - The middleware used to allow identifier plugins to "pre-authenticate"
  145. an identity. This feature is no longer supported: the ``auth_tkt``
  146. plugin, which used to use the feature, is now configured to work as
  147. an authenticator plugin (as well as an identifier).
  148. - The ``repoze.who.middleware:PluggableAuthenticationMiddleware`` class
  149. no longer has the following (non-API) methods (now made API methods
  150. of the ``repoze.who.api:API`` class):
  151. - ``add_metadata``
  152. - ``authenticate``
  153. - ``challenge``
  154. - ``identify``
  155. - The following (non-API) functions moved from ``repoze.who.middleware`` to
  156. ``repoze.who.api``:
  157. - ``make_registries``
  158. - ``match_classification``
  159. - ``verify``
  160. 1.0.18 (2009-11-05)
  161. -------------------
  162. - Issue #104: AuthTkt plugin was passing an invalid cookie value in
  163. headers from ``forget``, and was not setting the ``Max-Age`` and
  164. ``Expires`` attributes of those cookies.
  165. 1.0.17 (2009-11-05)
  166. -------------------
  167. - Fixed the ``repoze.who.plugins.form.make_plugin`` factory's ``formcallable``
  168. argument handling, to allow passing in a dotted name (e.g., from a config
  169. file).
  170. 1.0.16 (2009-11-04)
  171. -------------------
  172. - Exposed ``formcallable`` argument for ``repoze.who.plugins.form.FormPlugin``
  173. to the callers of the ``repoze.who.plugins.form.make_plugin`` factory.
  174. Thanks to Roland Hedburg for the report.
  175. - Fixed an issue that caused the following symptom when using the
  176. ini configuration parser::
  177. TypeError: _makePlugin() got multiple values for keyword argument 'name'
  178. See http://bugs.repoze.org/issue92 for more details. Thanks to vaab
  179. for the bug report and initial fix.
  180. 1.0.15 (2009-06-25)
  181. -------------------
  182. - If the form post value ``max_age`` exists while in the ``identify``
  183. method is handling the ``login_handler_path``, pass the max_age
  184. value in the returned identity dictionary as ``max_age``. See the
  185. below bullet point for why.
  186. - If the ``identity`` dict passed to the ``auth_tkt`` ``remember``
  187. method contains a ``max_age`` key with a string (or integer) value,
  188. treat it as a cue to set the ``Max-Age`` and ``Expires`` headers in
  189. the returned cookies. The cookie ``Max-Age`` is set to the value
  190. and the ``Expires`` is computed from the current time.
  191. 1.0.14 (2009-06-17)
  192. -------------------
  193. - Fix test breakage on Windows. See http://bugs.repoze.org/issue79 .
  194. - Documented issue with using ``include_ip`` setting in the ``auth_tkt``
  195. plugin. See http://bugs.repoze.org/issue81 .
  196. - Added 'passthrough_challenge_decider', which avoids re-challenging 401
  197. responses which have been "pre-challenged" by the application.
  198. - One-hundred percent unit test coverage.
  199. - Add ``timeout`` and ``reissue_time`` arguments to the auth_tkt
  200. identifier plugin, courtesty of Paul Johnston.
  201. - Add a ``userid_checker`` argument to the auth_tkt identifier plugin,
  202. courtesty of Gustavo Narea.
  203. If ``userid_checker`` is provided, it must be a dotted Python name
  204. that resolves to a function which accepts a userid and returns a
  205. boolean True or False, indicating whether that user exists in a
  206. database. This is a workaround. Due to a design bug in repoze.who,
  207. the only way who can check for user existence is to use one or more
  208. IAuthenticator plugin ``authenticate`` methods. If an
  209. IAuthenticator's ``authenticate`` method returns true, it means that
  210. the user exists. However most IAuthenticator plugins expect *both*
  211. a username and a password, and will return False unconditionally if
  212. both aren't supplied. This means that an authenticator can't be
  213. used to check if the user "only" exists. The identity provided by
  214. an auth_tkt does not contain a password to check against. The
  215. actual design bug in repoze.who is this: when a user presents
  216. credentials from an auth_tkt, he is considered "preauthenticated".
  217. IAuthenticator.authenticate is just never called for a
  218. "preauthenticated" identity, which works fine, but it means that the
  219. user will be considered authenticated even if you deleted the user's
  220. record from whatever database you happen to be using. However, if
  221. you use a userid_checker, you can ensure that a user exists for the
  222. auth_tkt supplied userid. If the userid_checker returns False, the
  223. auth_tkt credentials are considered "no good".
  224. 1.0.13 (2009-04-24)
  225. -------------------
  226. - Added a paragraph to ``IAuthenticator`` docstring, documenting that plugins
  227. are allowed to add keys to the ``identity`` dictionary (e.g., to save a
  228. second database query in an ``IMetadataProvider`` plugin).
  229. - Patch supplied for issue #71 (http://bugs.repoze.org/issue71)
  230. whereby a downstream app can return a generator, relying on an
  231. upstream component to call start_response. We do this because the
  232. challenge decider needs the status and headers to decide what to do.
  233. 1.0.12 (2009-04-19)
  234. -------------------
  235. - auth_tkt plugin tried to append REMOTE_USER_TOKENS data to
  236. existing tokens data returned by auth_tkt.parse_tkt; this was
  237. incorrect; just overwrite.
  238. - Extended auth_tkt plugin factory to allow passing secret in a separate
  239. file from the main config file. See http://bugs.repoze.org/issue40 .
  240. 1.0.11 (2009-04-10)
  241. -------------------
  242. - Fix auth_tkt plugin; cookie values are now quoted, making it possible
  243. to put spaces and other whitespace, etc in usernames. (thanks to Michael
  244. Pedersen).
  245. - Fix corner case issue of an exception raised when attempting to log
  246. when there are no identifiers or authenticators.
  247. 1.0.10 (2009-01-23)
  248. -------------------
  249. - The RedirectingFormPlugin now passes along SetCookie headers set
  250. into the response by the application within the NotFound response
  251. (fixes TG2 "flash" issue).
  252. 1.0.9 (2008-12-18)
  253. ------------------
  254. - The RedirectingFormPlugin now attempts to find a header named
  255. ``X-Authentication-Failure-Reason`` among the response headers set
  256. by the application when a challenge is issued. If a value for this
  257. header exists (and is non-blank), the value is attached to the
  258. redirect URL's query string as the ``reason`` parameter (or a
  259. user-settable key). This makes it possible for downstream
  260. applications to issue a response that initiates a challenge with
  261. this header and subsequently display the reason in the login form
  262. rendered as a result of the challenge.
  263. 1.0.8 (2008-12-13)
  264. ------------------
  265. - The ``PluggableAuthenticationMiddleware`` constructor accepts a
  266. ``log_stream`` argument, which is typically a file. After this
  267. release, it can also be a PEP 333 ``Logger`` instance; if it is a
  268. PEP 333 ``Logger`` instance, this logger will be used as the
  269. repoze.who logger (instead of one being constructed by the
  270. middleware, as was previously always the case). When the
  271. ``log_stream`` argument is a PEP 333 Logger object, the
  272. ``log_level`` argument is ignored.
  273. 1.0.7 (2008-08-28)
  274. ------------------
  275. - ``repoze.who`` and ``repoze.who.plugins`` were not added to the
  276. ``namespace_packages`` list in setup.py, potentially making 1.0.6 a
  277. brownbag release, given that making these packages namespace
  278. packages was the only reason for its release.
  279. 1.0.6 (2008-08-28)
  280. ------------------
  281. - Make repoze.who and repoze.who.plugins into namespace packages
  282. mainly so we can allow plugin authors to distribute packages in the
  283. repoze.who.plugins namespace.
  284. 1.0.5 (2008-08-23)
  285. ------------------
  286. - Fix auth_tkt plugin to set the same cookies in its ``remember``
  287. method that it does in its ``forget`` method. Previously, logging
  288. out and relogging back in to a site that used auth_tkt identifier
  289. plugin was slightly dicey and would only work sometimes.
  290. - The FormPlugin plugin has grown a redirect-on-unauthorized feature.
  291. Any response from a downstream application that causes a challenge
  292. and includes a Location header will cause a redirect to the value of
  293. the Location header.
  294. 1.0.4 (2008-08-22)
  295. ------------------
  296. - Added a key to the '[general]' config section: ``remote_user_key``.
  297. If you use this key in the config file, it tells who to 1) not
  298. perform any authentication if it exists in the environment during
  299. ingress and 2) to set the key in the environment for the downstream
  300. app to use as the REMOTE_USER variable. The default is
  301. ``REMOTE_USER``.
  302. - Using unicode user ids in combination with the auth_tkt plugin would
  303. cause problems under mod_wsgi.
  304. - Allowed 'cookie_path' argument to InsecureCookiePlugin (and config
  305. constructor). Thanks to Gustavo Narea.
  306. 1.0.3 (2008-08-16)
  307. ------------------
  308. - A bug in the middleware's ``authenticate`` method made it impossible
  309. to authenticate a user with a userid that was null (e.g. 0, False),
  310. which are valid identifiers. The only invalid userid is now None.
  311. - Applied patch from Olaf Conradi which logs an error when an invalid
  312. filename is passed to the HTPasswdPlugin.
  313. 1.0.2 (2008-06-16)
  314. ------------------
  315. - Fix bug found by Chris Perkins: the auth_tkt plugin's "remember"
  316. method didn't handle userids which are Python "long" instances
  317. properly. Symptom: TypeError: cannot concatenate 'str' and 'long'
  318. objects in "paste.auth.auth_tkt".
  319. - Added predicate-based "restriction" middleware support
  320. (repoze.who.restrict), allowing configuratio-driven authorization as
  321. a WSGI filter. One example predicate, 'authenticated_predicate', is
  322. supplied, which requires that the user be authenticated either via
  323. 'REMOTE_USER' or via 'repoze.who.identity'. To use the filter to
  324. restrict access::
  325. [filter:authenticated_only]
  326. use = egg:repoze.who#authenticated
  327. or::
  328. [filter:some_predicate]
  329. use = egg:repoze.who#predicate
  330. predicate = my.module:some_predicate
  331. some_option = a value
  332. 1.0.1 (2008-05-24)
  333. ------------------
  334. - Remove dependency-link to dist.repoze.org to prevent easy_install
  335. from inserting that path into its search paths (the dependencies are
  336. available from PyPI).
  337. 1.0 (2008-05-04)
  338. -----------------
  339. - The plugin at plugins.form.FormPlugin didn't redirect properly after
  340. collecting identification information. Symptom: a downstream app
  341. would receive a POST request with a blank body, which would
  342. sometimes result in a Bad Request error.
  343. - Fixed interface declarations of
  344. 'classifiers.default_request_classifier' and
  345. 'classifiers.default_password_compare'.
  346. - Added actual config-driven middleware factory,
  347. 'config.make_middleware_with_config'
  348. - Removed fossilized 'who_conf' argument from plugin factory functions.
  349. - Added ConfigParser-based WhoConfig, implementing the spec outlined at
  350. http://www.plope.com/static/misc/sphinxtest/intro.html#middleware-configuration-via-config-file,
  351. with the following changes:
  352. - "Bare" plugins (requiring no configuration options) may be specified
  353. as either egg entry points (e.g., 'egg:distname#entry_point_name') or
  354. as dotted-path-with-colon (e.g., 'dotted.name:object_id').
  355. - Therefore, the separator between a plugin and its classifier is now
  356. a semicolon, rather than a colon. E.g.::
  357. [plugins:id_plugin]
  358. use = egg:another.package#identify_with_frobnatz
  359. frobnatz = baz
  360. [identifiers]
  361. plugins =
  362. egg:my.egg#identify;browser
  363. dotted.name:identifier
  364. id_plugin
  365. 0.9.1 (2008-04-27)
  366. ------------------
  367. - Fix auth_tkt plugin to be able to encode and decode integer user
  368. ids.
  369. 0.9 (2008-04-01)
  370. ----------------
  371. - Fix bug introduced in FormPlugin in 0.8 release (rememberer headers
  372. not set).
  373. - Add PATH_INFO to started and ended log info.
  374. - Add a SQLMetadataProviderPlugin (in plugins/sql).
  375. - Change constructor of SQLAuthenticatorPlugin: it now accepts only
  376. "query", "conn_factory", and "compare_fn". The old constructor
  377. accepted a DSN, but some database systems don't use DBAPI DSNs. The
  378. new constructor accepts no DSN; the conn_factory is assumed to do
  379. all the work to make a connection, including knowing the DSN if one
  380. is required. The "conn_factory" should return something that, when
  381. called with no arguments, returns a database connection.
  382. - The "make_plugin" helper in plugins/sql has been renamed
  383. "make_authenticator_plugin". When called, this helper will return a
  384. SQLAuthenticatorPlugin. A bit of helper logic in the
  385. "make_authenticator_plugin" allows a connection factory to be
  386. computed. The top-level callable referred to by conn_factory in
  387. this helper should return a function that, when called with no
  388. arguments, returns a datbase connection. The top-level callable
  389. itself is called with "who_conf" (global who configuration) and any
  390. number of non-top-level keyword arguments as they are passed into
  391. the helper, to allow for a DSN or URL or whatever to be passed in.
  392. - A "make_metatata_plugin" helper has been added to plugins/sql. When
  393. called, this will make a SQLMetadataProviderPlugin. See the
  394. implementation for details. It is similar to the
  395. "make_authenticator_plugin" helper.
  396. 0.8 (2008-03-27)
  397. ----------------
  398. - Add a RedirectingFormIdentifier plugin. This plugin is willing to
  399. redirect to an external (or downstream application) login form to
  400. perform identification. The external login form must post to the
  401. "login_handler_path" of the plugin (optimally with a "came_from"
  402. value to tell the plugin where to redirect the response to if the
  403. authentication works properly). The "logout_handler_path" of this
  404. plugin can be visited to perform a logout. The "came_from" value
  405. also works there.
  406. - Identifier plugins are now permitted to set a key in the environment
  407. named 'repoze.who.application' on ingress (in 'identify'). If an
  408. identifier plugin does so, this application is used instead of the
  409. "normal" downstream application. This feature was added to more
  410. simply support the redirecting form identifier plugin.
  411. 0.7 (2008-03-26)
  412. ----------------
  413. - Change the IMetadataProvider interface: this interface used to have
  414. a "metadata" method which returned a dictionary. This method is not
  415. part of that API anymore. It's been replaced with an "add_metadata"
  416. method which has the signature::
  417. def add_metadata(environ, identity):
  418. """
  419. Add metadata to the identity (which is a dictionary)
  420. """
  421. The return value is ignored. IMetadataProvider plugins are now
  422. assumed to be responsible for 'scribbling' directly on the identity
  423. that is passed in (it's a dictionary). The user id can always be
  424. retrieved from the identity via identity['repoze.who.userid'] for
  425. metadata plugins that rely on that value.
  426. 0.6 (2008-03-20)
  427. ----------------
  428. - Renaming: repoze.pam is now repoze.who
  429. - Bump ez_setup.py version.
  430. - Add IMetadataProvider plugin type. Chris says 'Whit rules'.
  431. 0.5 (2008-03-09)
  432. ----------------
  433. - Allow "remote user key" (default: REMOTE_USER) to be overridden
  434. (pass in remote_user_key to middleware constructor).
  435. - Allow form plugin to override the default form.
  436. - API change: IIdentifiers are no longer required to put both 'login'
  437. and 'password' in a returned identity dictionary. Instead, an
  438. IIdentifier can place arbitrary key/value pairs in the identity
  439. dictionary (or return an empty dictionary).
  440. - API return value change: the "failure" identity which IIdentifiers
  441. return is now None rather than an empty dictionary.
  442. - The IAuthenticator interface now specifies that IAuthenticators must
  443. not raise an exception when evaluating an identity that does not
  444. have "expected" key/value pairs (e.g. when an IAuthenticator that
  445. expects login and password inspects an identity returned by an
  446. IP-based auth system which only puts the IP address in the
  447. identity); instead they fail gracefully by returning None.
  448. - Add (cookie) "auth_tkt" identification plugin.
  449. - Stamp identity dictionaries with a userid by placing a key named
  450. 'repoze.pam.userid' into the identity for each authenticated
  451. identity.
  452. - If an IIdentifier plugin inserts a 'repoze.pam.userid' key into the
  453. identity dictionary, consider this identity "preauthenticated". No
  454. authenticator plugins will be asked to authenticate this identity.
  455. This is designed for things like the recently added auth_tkt plugin,
  456. which embeds the user id into the ticket. This effectively alllows
  457. an IIdentifier plugin to become an IAuthenticator plugin when
  458. breaking apart the responsibility into two separate plugins is
  459. "make-work". Preauthenticated identities will be selected first
  460. when deciding which identity to use for any given request.
  461. - Insert a 'repoze.pam.identity' key into the WSGI environment on
  462. ingress if an identity is found. Its value will be the identity
  463. dictionary related to the identity selected by repoze.pam on
  464. ingress. Downstream consumers are allowed to mutate this
  465. dictionary; this value is passed to "remember" and "forget", so its
  466. main use is to do a "credentials reset"; e.g. a user has changed his
  467. username or password within the application, but we don't want to
  468. force him to log in again after he does so.
  469. 0.4 (03-07-2008)
  470. ----------------
  471. - Allow plugins to specify a classifiers list per interface (instead
  472. of a single classifiers list per plugin).
  473. 0.3 (03-05-2008)
  474. ----------------
  475. - Make SQLAuthenticatorPlugin's default_password_compare use hexdigest
  476. sha instead of base64'ed binary sha for simpler conversion.
  477. 0.2 (03-04-2008)
  478. ----------------
  479. - Added SQLAuthenticatorPlugin (see plugins/sql.py).
  480. 0.1 (02-27-2008)
  481. ----------------
  482. - Initial release (no configuration file support yet).