HISTORY.rst 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146
  1. .. :changelog:
  2. History
  3. -------
  4. 1.0.0 (unreleased)
  5. ++++++++++++++++++
  6. * Add OIDC_AUTHENTICATION_CALLBACK_URL as a new configuration parameter
  7. * Fail earlier when JWS algorithm does not OIDC_RP_SIGN_ALGO.
  8. Thanks `@anlutro`_
  9. * RS256 verification through ``settings.OIDC_OP_JWKS_ENDPOINT``
  10. Thanks `@GermanoGuerrini`_
  11. * Refactor OIDCAuthenticationBackend so that token retrieval methods can be overridden in a subclass when you need to.
  12. Backwards-incompatible changes:
  13. * ``OIDC_OP_LOGOUT_URL_METHOD`` takes a ``request`` parameter now.
  14. * Changed name of ``RefreshIDToken`` middleware to ``SessionRefresh``.
  15. .. _`@anlutro`: https://github.com/anlutro
  16. 0.6.0 (2018-03-27)
  17. ++++++++++++++++++
  18. * Add e2e tests and automation
  19. * Add caching for exempt URLs
  20. * Fix logout when session refresh fails
  21. 0.5.0 (2018-01-10)
  22. ++++++++++++++++++
  23. * Add Django 2.0 support
  24. * Fix tox configuration
  25. Backwards-incompatible changes:
  26. * Drop Django 1.10 support
  27. 0.4.2 (2017-11-29)
  28. ++++++++++++++++++
  29. * Fix OIDC_USERNAME_ALGO to actually load dotted import path of callback.
  30. * Add verify_claims method for advanced authentication checks
  31. 0.4.1 (2017-10-25)
  32. ++++++++++++++++++
  33. * Send bytes to josepy. Fixes python3 support.
  34. 0.4.0 (2017-10-24)
  35. ++++++++++++++++++
  36. Security issues:
  37. * **High**: Replace python-jose with josepy and use pyca/cryptography instead of pycrypto (CVE-2013-7459).
  38. Backwards-incompatible changes:
  39. * ``OIDC_RP_IDP_SIGN_KEY`` no longer uses the JWK json as ``dict`` but PEM or DER keys instead.
  40. 0.3.2 (2017-10-03)
  41. ++++++++++++++++++
  42. Features:
  43. * Implement RS256 verification
  44. Thanks `@puiterwijk`_
  45. Bugs:
  46. * Use ``settings.OIDC_VERIFY_SSL`` also when validating the token.
  47. Thanks `@GermanoGuerrini`_
  48. * Make OpenID Connect scope configurable.
  49. Thanks `@puiterwijk`_
  50. * Add path host injection unit-test (#171)
  51. * Revisit OIDC_STORE_{ACCESS,ID}_TOKEN config entries
  52. * Allow configuration of additional auth parameters
  53. .. _`@GermanoGuerrini`: https://github.com/GermanoGuerrini
  54. .. _`@puiterwijk`: https://github.com/puiterwijk
  55. 0.3.1 (2017-06-15)
  56. ++++++++++++++++++
  57. Security issues:
  58. * **Medium**: Sanitize next url for authentication view
  59. 0.3.0 (2017-06-13)
  60. ++++++++++++++++++
  61. Security issues:
  62. * **Low**: Logout using POST not GET (#126)
  63. Backwards-incompatible changes:
  64. * The ``settings.SITE_URL`` is no longer used. Instead the absolute URL is
  65. derived from the request's ``get_host()``.
  66. * Only log out by HTTP POST allowed.
  67. Bugs:
  68. * Test suite maintenance (#108, #109, #142)
  69. 0.2.0 (2017-06-07)
  70. ++++++++++++++++++
  71. Backwards-incompatible changes:
  72. * Drop support for Django 1.9 (#130)
  73. If you're using Django 1.9, you should update Django first.
  74. * Move middleware to ``mozilla_django_oidc.middleware`` and
  75. change it to use authentication endpoint with ``prompt=none`` (#94)
  76. You'll need to update your ``MIDDLEWARE_CLASSES``/``MIDDLEWARE``
  77. setting accordingly.
  78. * Remove legacy ``base64`` handling of OIDC secret. Now RP secret
  79. should be plaintext.
  80. Features:
  81. * Add support for Django 1.11 and Python 3.6 (#85)
  82. * Update middleware to work with Django 1.10+ (#90)
  83. * Documentation updates
  84. * Rework test infrastructure so it's tox-based (#100)
  85. Bugs:
  86. * always decode verified token before ``json.load()`` (#116)
  87. * always redirect to logout_url even when logged out (#121)
  88. * Change email matching to be case-insensitive (#102)
  89. * Allow combining OIDCAuthenticationBackend with other backends (#87)
  90. * fix is_authenticated usage for Django 1.10+ (#125)
  91. 0.1.0 (2016-10-12)
  92. ++++++++++++++++++
  93. * First release on PyPI.