Skip to content
This repository has been archived by the owner on Mar 9, 2023. It is now read-only.

Latest commit

 

History

History
340 lines (284 loc) · 14.8 KB

CHANGELOG.md

File metadata and controls

340 lines (284 loc) · 14.8 KB
Raw

Change Log

All notable changes to this project will be documented in this file.

The format is based on the KeepAChangeLog project.

Unreleased

Fixed

  • #341 Using constant time comparison for password verification
  • #598 Move alabaster from runtime dependencies to docs
  • #398 Do not echo cookies that do not belong to us
  • #607 Fixed key recovery on encryption of payload
  • #618 Prettified client_management.py CLI and wrapped it as a setup.py console script oic-client-management
  • #615 Fix ROPC grant in the extensions provider
  • #640 Use more secure random generator for client_secret
  • #639 Make sure symmetric keys are available after server restart

Changed

  • #578 Dropped python 2.7 support
  • #612 Dropped python 3.4 support
  • #588 Switch to defusedxml for XML parsing
  • #605 Message.c_param dictionary values have to be a ParamDefinition namedtuple type
  • #56 Updated README, CLI help texts, pip requirements.txt and such for OP2, making it into a stand-alone example easy for beginners to take on
  • #624 token_endpoint implementation and kwargs have been changed
  • #629 Duplicated methods in oic.oic classes were removed.
  • #642 Deprecated bearer_auth method.
  • #631 Refactored message type handling in Client/Provider.

Added

  • #655 Host can be forced on webfinger discovery
  • #441 CookieDealer now accepts secure and httponly params
  • #638 Moved providerinfo_endpoint from oic.extensions to oic.oauth2

0.15.1 [2019-01-31]

Fixed

  • #592 Do not append cookie header if there is nothing to append
  • #591 Fix verification of encrypted id_token
  • #601 Fix headers od encrypted id_token

0.15.0 [2019-01-17]

Fixed

  • #553 Made sure a reload would not lead to duplicated keys in a keybundle.
  • #557 Fixed PKCE verification
  • #562 Fixed error response from oic request with invalid params
  • #565 Fixed checking token_type in AuthorizationResponse
  • #547 Fixed get_userinfo_claims method
  • #268 Fixed SessionDB.revoke_token implementation
  • #571 Return error when when resolving request_uri fails
  • #579 Fix error with unicode chars in redirect_uris
  • #581 Fix error in verification of sector_identifier
  • #542 Updated examples
  • #587 Fix JWKS content type detection
  • #582 Handling import of non-compliant JWKS

Added

  • #577 Check that issuer of a signed JWT exists in the KeyJar used to verify the signature.
  • #566 Added timeout to communications to remote servers
  • #590 Worked on support for RP initiated logout

0.14.0 [2018-05-15]

Fixed

  • #534 Fixed a bug in client_secret_basic authentication
  • #503 Fix error on UserInfo endpoint for removed clients
  • #508 JWT now uses verify keys for JWT verification
  • #502 IntrospectionEndpoint now returns False if it encounters any error as per specs
  • #481 Loading AuthnEvent from session
  • #492 Do not verify JWT signature on distributed claims
  • #526 Cleaned up extra claims from UserInfo with distributed claims
  • #528 Fix faulty redirect_uri with query
  • #532 Fix userinfo endpoint without auhtn_event in session
  • #528 Fix faulty redirect_uri with query
  • #498 Clean up replaced tokens on refresh and add Client.clean_tokens to clean old and replaced tokens

Removed

  • #494 Methods and functions deprecated in previous releases have been removed

Changed

  • #507 Altered structure of client_db. It no longer stores mapping of registration_access_token to client_id
  • #481 AuthnEvent in session is now represented as JSON

Added

  • #496 Ability to specify additional supported scopes for oic.Provider
  • #432 Ability to specify Initial Access Token for Client.register

0.13.1 [2018-04-06]

Fixed

  • #515: Fix arguments to WSGI start_response

0.13.0 [2018-02-19]

Added

  • #493 grant_types specification should follow the response_types specification in a client registration request.
  • #469 Allow endpoints to have query parts
  • #443 Ability to specify additional supported claims for oic.Provider
  • #134 Added method kwarg to registration_endpoint that enables the client to read/modify registration
  • #478 Addedd base-class for Client databases oic.utils.clientdb.BaseClientDatabase
  • #334 Ability to specify custom template rendering function for form_post and verify_logout

Changed

  • #134 l_registration_enpoint has been deprecated, use create_registration instead
  • #457 pyldap is now an optional dependency. oic.utils.authn.ldapc and oic.utils.userinfo.ldap_info raise ImportError on import if pyldap is not present
  • #471 ca_certs option has been removed, use verify_ssl instead
  • #483 oic.oauth2.uril.verify_header now raises ValueError insteaad of AssertionError.
  • #491 oic.utils.http_util.Response.status is deprecated in favor of status_code
  • #491 Some functions and kwargs in oic.oauth2 module are deprecated

Removed

  • #334 Removed template_lookup and template kwargs from oic.Provider

Fixed

  • #430 Audience of a client assertion is endpoint dependent.
  • #427 Made matching for response_types order independent for authorization requests
  • #399 Matching response_types for authz requests is too strict
  • #436 Fixed client.read_registration
  • #446 Fixed provider.read_registration
  • #449 Fixed creation of error_response on client registration
  • #445 Fixed get_client_id
  • #421 Fixed handling of unicode in sanitize function
  • #145 Successful token endpoint responses have correct no-cache headers
  • #352 Fixed broken windows test for test_provider_key_setup.
  • #475 get_verify_key returns inactive sig keys for verification
  • #429 An expired token is not possible to use.
  • #485 Skip import of improperly defined keys
  • #370 Use oic.oic.Provider.endp instead of dynamic provider.endpoints in examples

Security

  • #486 SystemRandom is not imported correctly, so various secrets get initialized with bad randomness

0.12.0 [2017-09-25]

Fixed

  • #419: Inconsistent release numbers/tags
  • #420: Distributed claims

0.11.1.0 [2017-08-26]

Fixed

  • #405: Fix generation of endpoint urls
  • #411: Empty lists not indexable
  • #413: Fix error when wrong response_mode requested
  • #418: Made phone_number_claim be boolean and fixed a bug when importing JSON (non-boolean where boolean expected)

0.11.0.0 [2017-07-07]

Changed

  • #318: oic.utils.authn.saml raises ImportError on import if optional saml2 dependency is not present.
  • #324: Make the Provider symkey argument optional.
  • #325: oic.oic.claims_match implementation refactored.
  • #368: oic.oauth2.Client.construct_AccessTokenRequest() as well as oic.oic.Client are now able to perform proper Resource Owner Password Credentials Grant
  • #374: Made the to_jwe/from_jwe methods of Message accept list of keys value of parameter keys.
  • #387: Refactored the oic.utils.sdb.SessionDB constructor API.
  • #380: Made cookie_path and cookie_domain configurable via Provider like the cookie_name.
  • #386: An exception will now be thrown if a sub claim received from the userinfo endpoint is not the same as a sub claim previously received in an ID Token.
  • #392: Made sid creation simpler and faster

Fixed

  • #317: Resolved an AttibuteError exception under Python 2.
  • #313: Catch exception correctly
  • #319: Fix sanitize on strings starting with "B" or "U"
  • #330: Fix client_management user input being eval'd under Python 2
  • #358: Fixed claims_match
  • #362: Fix bad package settings URL
  • #369: The AuthnEvent object is now serialized to JSON for the session.
  • #373: Made the standard way the default when dealing with signed JWTs without 'kid'. Added the possibility to override this behavior if necessary.
  • #401: Fixed message decoding and verifying errors.

Security

  • #349: Changed crypto algorithm used by oic.utils.sdb.Crypt for token encryption to Fernet. Old stored tokens are incompatible.
  • #363: Fixed IV reuse for CookieDealer class. Replaced the encrypt-then-mac construction with a proper AEAD (AES-SIV).

0.10.0.0 [2017-03-28]

Changed

  • #291: Testing more relevant Python versions.
  • #296: parse_qs import from future.backports to future.moves.
  • #188: Added future dependency, updated dependecies
  • #305: Some import were removed from oic.oauth2 and oic.oic.provider, please import them from respective modules (oic.oath2.message and oic.exception).

Removed

  • #294: Generating code indices in documentation.

Fixed

  • #295: Access token issuance and typo/exception handling.

0.9.5.0 [2017-03-22]

Added

  • #276: Use a Change log for change history.
  • #277: Use pip-tools for dependency management.

Removed

Changed

  • #273: Allow webfinger accept kwargs.

Fixed

  • #286: Account for missing code in the SessionDB.

0.9.4.0 [2016-12-22]

No change log folks. Sorry.