NEWS 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225
  1. What's New in Python OpenID 2.1.0
  2. =================================
  3. This implementation of OpenID has been upgraded to support version 2.0
  4. of the OpenID Authentication specification.
  5. New in this version is:
  6. * Verification of relying party return_to addresses, to screen out RPs
  7. hiding behind open redirect relays. Server code can invoke this with
  8. the returnToVerified method on CheckIDRequest.
  9. * Helper module for the Provider Authentication Policy Extension (PAPE) in
  10. openid.extensions.pape.
  11. * Helper module for Attribute Exchange in openid.extensions.ax.
  12. Bugfixes:
  13. * Allow the use of lxml as an ElementTree implemenation.
  14. * Provide compatability with a wider range of versions for SQL stores.
  15. Upgrading from 2.0.1
  16. --------------------
  17. The third argument to Consumer.complete() is required.
  18. The sreg module should be imported from openid.extensions.sreg instead of
  19. openid.sreg.
  20. The ax module should likewise be imported from openid.extensions.ax
  21. instead of openid.ax
  22. The openid.extensions.ax.FetchRequest.fromOpenIDRequest method now
  23. takes a CheckIDRequest object instead of a Message object
  24. The OpenID response (the result of Consumer.complete()) now has a
  25. getDisplayIdentifier() method which should be called instead of
  26. accessing response.identity_url. The value of getDisplayIdentifier()
  27. will be the XRI i-name if XRI is used. The value of
  28. response.identity_url SHOULD, however, be used as the application's
  29. database key for storing account information.
  30. What's New in Python OpenID 2.0
  31. ===============================
  32. The big news here is compatibility with svn revision 313 of the OpenID 2.0
  33. draft specification.
  34. Highlights include:
  35. * Simple Registration support in a new module openid.sreg. (Those
  36. previously using SuccessResponse.extensionResponse are advised to
  37. look here.)
  38. * OpenID provider-driven identifier selection.
  39. * "Negotiators" allow you to define which association types to use.
  40. * Examples for Django.
  41. Dependencies
  42. ------------
  43. Python 2.5 is now supported. Support for Python 2.2 discontinued.
  44. Seperate installation of yadis and urljr packages is no longer
  45. required; they have been included in this package.
  46. Upgrading from 1.1 or 1.2
  47. -------------------------
  48. One of the additions to the OpenID protocol was a specified nonce
  49. format for one-way nonces. As a result, the nonce table in the store
  50. has changed. You'll need to run contrib/upgrade-store-1.1-to-2.0 to
  51. upgrade your store, or you'll encounter errors about the wrong number
  52. of columns in the oid_nonces table.
  53. If you've written your own custom store or code that interacts directly with it,
  54. you'll need to review the change notes in openid.store.interface.
  55. Consumers should now pass an additional parameter to Consumer.complete()
  56. to defend against return_to tampering.
  57. What's New in Python OpenID 1.1.2
  58. =================================
  59. i-name Support
  60. --------------
  61. This version of the library allows the use of XRI as OpenID identifiers,
  62. allowing users to log in with their i-names. For full XRI compatibility,
  63. relying parties integrating this library should take note of the user's
  64. CanonicalID, as described in the "Identifying the End User" section of the
  65. OpenID 2.0 specification.
  66. Bug Fixes
  67. ---------
  68. A variety of bug fixes were included in this release, mostly relating to
  69. international issues such as dealing with other character sets, Unicode,
  70. incorrectly flagging certain Norwegian trust roots as suspect, and operation
  71. of the filesystem-backed store on exotic platforms.
  72. Dependencies
  73. ------------
  74. * urljr 1.0.1
  75. * yadis 1.1.0
  76. What's New in Python OpenID 1.1.0
  77. =================================
  78. Version 1.1 of the Python OpenID library implements recent changes to
  79. the OpenID specification as well as making API changes that should
  80. make integration with applications easier.
  81. Yadis Support
  82. -------------
  83. One of the major changes to OpenID since the last release has been the
  84. approval of Yadis discovery as the preferred way to specify the OpenID
  85. metadata for an identity URL instead of using <link> tags in
  86. HTML. This library does Yadis discovery, and if that fails, it falls
  87. back to old-style discovery.
  88. Some advantages of Yadis support are:
  89. * Support for fallback if your primary OpenID provider is not available
  90. * Support for load-balancing between OpenID servers
  91. * Easy interoperability for different identity services
  92. For more information about Yadis, see http://yadis.org/
  93. Extension Support
  94. -----------------
  95. OpenID also has formalized support for extensions. Extensions are a
  96. mechanism for transferring information from the consumer to the server
  97. and from the server to the consumer in the process of performing
  98. OpenID authentication. Extensions are implemented as additional
  99. namespaced query arguments that go along with standard OpenID requests
  100. and responses. This library provides a simple API for adding extension
  101. arguments to requests and extracting extension responses from replies.
  102. Dependencies
  103. ------------
  104. These dependencies should be available from wherever you acquired the
  105. OpenID library.
  106. * urljr - The fetcher abstraction from the previous OpenID library
  107. has been extended and is also used for the Yadis library. Because
  108. the Yadis library is useful without the OpenID library, the HTTP
  109. fetching code has been rolled into its own package. Additionally,
  110. the library now has the concept of a default fetcher to make APIs
  111. simpler.
  112. * yadis - The Yadis library provides a general discovery layer that
  113. has been adopted by OpenID as well as other identity-related
  114. protocols. Most OpenID identity URLs will work without the Yadis
  115. library, but as time goes on, this library will be more and more
  116. important.
  117. Consumer API
  118. ------------
  119. The consumer API has been changed for more natural use as well as to
  120. support extension arguments.
  121. * OpenIDConsumer(store, [fetcher], [immediate]) is now
  122. Consumer(session, store)
  123. - The session object is a dictionary-like object that should be
  124. tied to the requesting HTTP agent, for example, using a session
  125. ID cookie. It is used for Yadis fallback and holding the state
  126. of the OpenID transaction between the redirect to the server
  127. and the response. The values that are placed in the session are
  128. namespaced, so there should not be a conflict with other uses
  129. of the same session. The session namespace is an attribute of
  130. the Consumer object.
  131. - Because the consumer object now does session management, it is
  132. necessary to construct a new consumer object for every
  133. request. Creating consumer objects is light-weight.
  134. * OpenIDConsumer.beginAuth(user_url) is now Consumer.begin(user_url)
  135. and either returns an AuthRequest object or raises an
  136. exception. There is no more tuple unpacking or status codes.
  137. * OpenIDConsumer.constructRedirect(authreq, return_to, trust_root) is
  138. now AuthRequest.redirectURL(trust_root, return_to, [immediate]).
  139. * OpenIDConsumer.completeAuth(token, query) is now
  140. Consumer.complete(query). It no longer returns a tuple. Instead it
  141. returns an object that has a status code and additional information
  142. about the response. See the API documentation for more information.
  143. Server API
  144. ----------
  145. The server API has been changed for greater extensibility. Instead
  146. of taking an "is_authorized" callback, processing happens in several
  147. stages, allowing you to insert extension data into the response
  148. before it is signed and returned. See the documentation for the
  149. openid.server.server module.
  150. Fetcher API
  151. -----------
  152. * fetcher was openid.consumer.fetchers.OpenIDHTTPFetcher, is now
  153. urljr.fetchers.HTTPFetcher. get() and post() have been replaced by
  154. fetch(), see urljr.fetchers for details.
  155. Upgrading from 1.0
  156. ------------------
  157. The server changed the way it indexes associations in the store, so if
  158. you're upgrading a server installation, we recommend you clear the old
  159. records from your store when you do so. As a consequence, consumers
  160. will re-establish associations with your server a little sooner than
  161. they would have otherwise.