PKG-INFO 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365
  1. Metadata-Version: 1.1
  2. Name: mozilla-django-oidc
  3. Version: 1.0.0
  4. Summary: A lightweight authentication and access management library for integration with OpenID Connect enabled authentication services.
  5. Home-page: https://github.com/mozilla/mozilla-django-oidc
  6. Author: Tasos Katsoulas, John Giannelos
  7. Author-email: akatsoulas@mozilla.com, jgiannelos@mozilla.com
  8. License: MPL 2.0
  9. Description: ===================
  10. mozilla-django-oidc
  11. ===================
  12. .. image:: https://badge.fury.io/py/mozilla-django-oidc.svg
  13. :target: https://badge.fury.io/py/mozilla-django-oidc
  14. .. image:: https://travis-ci.org/mozilla/mozilla-django-oidc.svg?branch=master
  15. :target: https://travis-ci.org/mozilla/mozilla-django-oidc
  16. .. image:: https://codecov.io/gh/mozilla/mozilla-django-oidc/branch/master/graph/badge.svg
  17. :target: https://codecov.io/gh/mozilla/mozilla-django-oidc
  18. .. image:: https://circleci.com/gh/mozilla/mozilla-django-oidc/tree/master.svg?style=svg
  19. :target: https://circleci.com/gh/mozilla/mozilla-django-oidc/tree/master
  20. A lightweight authentication and access management library for integration with OpenID Connect enabled authentication services.
  21. Documentation
  22. -------------
  23. The full documentation is at `<https://mozilla-django-oidc.readthedocs.io>`_.
  24. Running Unit Tests
  25. -------------------
  26. Use ``tox`` to run as many different versions of Python you have. If you
  27. don't have ``tox`` installed (and executable) already you can either
  28. install it in your system Python or `<https://pypi.python.org/pypi/pipsi>`_.
  29. Once installed, simply execute in the project root directory.
  30. .. code-block:: shell
  31. $ tox
  32. ``tox`` will do the equivalent of installing virtual environments for every
  33. combination mentioned in the ``tox.ini`` file. If your system, for example,
  34. doesn't have ``python3.4`` those ``tox`` tests will be skipped.
  35. For a faster test-rinse-repeat cycle you can run tests in a specific
  36. environment with a specific version of Python and specific version of
  37. Django of your choice. Here is such an example:
  38. .. code-block:: shell
  39. $ virtualenv -p /path/to/bin/python3.5 venv
  40. $ source venv
  41. (venv) $ pip install Django==1.11.2
  42. (venv) $ pip install -r tests/requirements.txt
  43. (venv) $ DJANGO_SETTINGS_MODULE=tests.settings django-admin.py test
  44. Measuring code coverage, continuing the steps above:
  45. .. code-block:: shell
  46. (venv) $ pip install coverage
  47. (venv) $ DJANGO_SETTINGS_MODULE=tests.settings coverage run --source mozilla_django_oidc `which django-admin.py` test
  48. (venv) $ coverage report
  49. (venv) $ coverage html
  50. (venv) $ open htmlcov/index.html
  51. Local development
  52. -----------------
  53. The local development setup is based on Docker so you need the following installed in your system:
  54. * `docker`
  55. * `docker-compose`
  56. You will also need to edit your ``hosts`` file to resolve ``testrp`` and ``testprovider`` hostnames to ``127.0.0.1``.
  57. Running test services
  58. =====================
  59. To run the `testrp` and `testprovider` instances run the following:
  60. .. code-block:: shell
  61. (venv) $ docker-compose up -d testprovider testrp
  62. Then visit the testing django app on: ``http://testrp:8081``.
  63. The library source code is mounted as a docker volume and source code changes are reflected directly in.
  64. In order to test a change you need to restart the ``testrp`` service.
  65. .. code-block:: shell
  66. (venv) $ docker-compose stop testrp
  67. (venv) $ docker-compose up -d testrp
  68. Running integration tests
  69. =========================
  70. Integration tests are mounted as a volume to the docker containers. Tests can be run using the following command:
  71. .. code-block:: shell
  72. (venv) $ docker-compose run --service-ports testrunner
  73. Linting
  74. -------
  75. All code is checked with `<https://pypi.python.org/pypi/flake8>`_ in
  76. continuous integration. To make sure your code still passes all style guides
  77. install ``flake8`` and check:
  78. .. code-block:: shell
  79. $ flake8 mozilla_django_oidc tests
  80. .. note::
  81. When you run ``tox`` it also does a ``flake8`` run on the main package
  82. files and the tests.
  83. You can also run linting with ``tox``:
  84. .. code-block:: shell
  85. $ tox -e lint
  86. Releasing a new version
  87. ------------------------
  88. ``mozilla-django-oidc`` releases are hosted in `PyPI <https://pypi.python.org/pypi/mozilla-django-oidc>`_.
  89. Here are the steps you need to follow in order to push a new release:
  90. * Make sure that ``HISTORY.rst`` is up-to-date focusing mostly on backwards incompatible changes.
  91. Security vulnerabilities should be clearly marked in a "Security issues" section along with
  92. a level indicator of:
  93. * High: vulnerability facilitates data loss, data access, impersonation of admin, or allows access
  94. to other sites or components
  95. Users should upgrade immediately.
  96. * Medium: vulnerability endangers users by sending them to malicious sites or stealing browser
  97. data.
  98. Users should upgrade immediately.
  99. * Low: vulnerability is a nuissance to site staff and/or users
  100. Users should upgrade.
  101. * Bump the project version and create a commit for the new version.
  102. * You can use ``bumpversion`` for that. It is a tool to automate this procedure following the `semantic versioning scheme <http://semver.org/>`_.
  103. * For a patch version update (eg 0.1.1 to 0.1.2) you can run ``bumpversion patch``.
  104. * For a minor version update (eg 0.1.0 to 0.2.0) you can run ``bumpversion minor``.
  105. * For a major version update (eg 0.1.0 to 1.0.0) you can run ``bumpversion major``.
  106. * Create a `signed tag <https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work>`_ for that version
  107. Example::
  108. git tag -s 0.1.1 -m "Bump version: 0.1.0 to 0.1.1"
  109. * Push the signed tag to Github
  110. Example::
  111. git push origin 0.1.1
  112. The release is pushed automatically to PyPI using a travis deployment hook on every new tag.
  113. License
  114. -------
  115. This software is licensed under the MPL 2.0 license. For more info check the LICENSE file.
  116. Credits
  117. -------
  118. Tools used in rendering this package:
  119. * Cookiecutter_
  120. * `cookiecutter-djangopackage`_
  121. .. _Cookiecutter: https://github.com/audreyr/cookiecutter
  122. .. _`cookiecutter-djangopackage`: https://github.com/pydanny/cookiecutter-djangopackage
  123. History
  124. -------
  125. 1.0.0 (unreleased)
  126. ++++++++++++++++++
  127. * Add OIDC_AUTHENTICATION_CALLBACK_URL as a new configuration parameter
  128. * Fail earlier when JWS algorithm does not OIDC_RP_SIGN_ALGO.
  129. Thanks `@anlutro`_
  130. * RS256 verification through ``settings.OIDC_OP_JWKS_ENDPOINT``
  131. Thanks `@GermanoGuerrini`_
  132. * Refactor OIDCAuthenticationBackend so that token retrieval methods can be overridden in a subclass when you need to.
  133. Backwards-incompatible changes:
  134. * ``OIDC_OP_LOGOUT_URL_METHOD`` takes a ``request`` parameter now.
  135. * Changed name of ``RefreshIDToken`` middleware to ``SessionRefresh``.
  136. .. _`@anlutro`: https://github.com/anlutro
  137. 0.6.0 (2018-03-27)
  138. ++++++++++++++++++
  139. * Add e2e tests and automation
  140. * Add caching for exempt URLs
  141. * Fix logout when session refresh fails
  142. 0.5.0 (2018-01-10)
  143. ++++++++++++++++++
  144. * Add Django 2.0 support
  145. * Fix tox configuration
  146. Backwards-incompatible changes:
  147. * Drop Django 1.10 support
  148. 0.4.2 (2017-11-29)
  149. ++++++++++++++++++
  150. * Fix OIDC_USERNAME_ALGO to actually load dotted import path of callback.
  151. * Add verify_claims method for advanced authentication checks
  152. 0.4.1 (2017-10-25)
  153. ++++++++++++++++++
  154. * Send bytes to josepy. Fixes python3 support.
  155. 0.4.0 (2017-10-24)
  156. ++++++++++++++++++
  157. Security issues:
  158. * **High**: Replace python-jose with josepy and use pyca/cryptography instead of pycrypto (CVE-2013-7459).
  159. Backwards-incompatible changes:
  160. * ``OIDC_RP_IDP_SIGN_KEY`` no longer uses the JWK json as ``dict`` but PEM or DER keys instead.
  161. 0.3.2 (2017-10-03)
  162. ++++++++++++++++++
  163. Features:
  164. * Implement RS256 verification
  165. Thanks `@puiterwijk`_
  166. Bugs:
  167. * Use ``settings.OIDC_VERIFY_SSL`` also when validating the token.
  168. Thanks `@GermanoGuerrini`_
  169. * Make OpenID Connect scope configurable.
  170. Thanks `@puiterwijk`_
  171. * Add path host injection unit-test (#171)
  172. * Revisit OIDC_STORE_{ACCESS,ID}_TOKEN config entries
  173. * Allow configuration of additional auth parameters
  174. .. _`@GermanoGuerrini`: https://github.com/GermanoGuerrini
  175. .. _`@puiterwijk`: https://github.com/puiterwijk
  176. 0.3.1 (2017-06-15)
  177. ++++++++++++++++++
  178. Security issues:
  179. * **Medium**: Sanitize next url for authentication view
  180. 0.3.0 (2017-06-13)
  181. ++++++++++++++++++
  182. Security issues:
  183. * **Low**: Logout using POST not GET (#126)
  184. Backwards-incompatible changes:
  185. * The ``settings.SITE_URL`` is no longer used. Instead the absolute URL is
  186. derived from the request's ``get_host()``.
  187. * Only log out by HTTP POST allowed.
  188. Bugs:
  189. * Test suite maintenance (#108, #109, #142)
  190. 0.2.0 (2017-06-07)
  191. ++++++++++++++++++
  192. Backwards-incompatible changes:
  193. * Drop support for Django 1.9 (#130)
  194. If you're using Django 1.9, you should update Django first.
  195. * Move middleware to ``mozilla_django_oidc.middleware`` and
  196. change it to use authentication endpoint with ``prompt=none`` (#94)
  197. You'll need to update your ``MIDDLEWARE_CLASSES``/``MIDDLEWARE``
  198. setting accordingly.
  199. * Remove legacy ``base64`` handling of OIDC secret. Now RP secret
  200. should be plaintext.
  201. Features:
  202. * Add support for Django 1.11 and Python 3.6 (#85)
  203. * Update middleware to work with Django 1.10+ (#90)
  204. * Documentation updates
  205. * Rework test infrastructure so it's tox-based (#100)
  206. Bugs:
  207. * always decode verified token before ``json.load()`` (#116)
  208. * always redirect to logout_url even when logged out (#121)
  209. * Change email matching to be case-insensitive (#102)
  210. * Allow combining OIDCAuthenticationBackend with other backends (#87)
  211. * fix is_authenticated usage for Django 1.10+ (#125)
  212. 0.1.0 (2016-10-12)
  213. ++++++++++++++++++
  214. * First release on PyPI.
  215. Keywords: mozilla-django-oidc
  216. Platform: UNKNOWN
  217. Classifier: Development Status :: 3 - Alpha
  218. Classifier: Framework :: Django
  219. Classifier: Framework :: Django :: 1.8
  220. Classifier: Framework :: Django :: 1.11
  221. Classifier: Framework :: Django :: 2.0
  222. Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)
  223. Classifier: Intended Audience :: Developers
  224. Classifier: Operating System :: MacOS
  225. Classifier: Operating System :: POSIX :: Linux
  226. Classifier: Natural Language :: English
  227. Classifier: Programming Language :: Python :: 2
  228. Classifier: Programming Language :: Python :: 2.7
  229. Classifier: Programming Language :: Python :: 3
  230. Classifier: Programming Language :: Python :: 3.3
  231. Classifier: Programming Language :: Python :: 3.4
  232. Classifier: Programming Language :: Python :: 3.5
  233. Classifier: Programming Language :: Python :: 3.6