RedHatTraining/repoze.who.git

Tres Seaver

2012-11-05 0cfb1a9cf4cddc76bef484c2a47d4be47e9b47a4

commit \| author \| age
7141c7	1	repoze.who Changelog
TS	2	====================
aa8755	3
0cfb1a	4
TS	5	2.1b1 (2012-11-05)
	6	------------------
d9f6f4	7
TS	8	- Ported to Py3k using the "compatible subset" mode.
	9	- Dropped support for Python < 2.6.x.
	10	- Dropped dependency on Paste (forking some code from it).
	11	- Added dependency on WebOb instead.
	12	Thanks to Atsushi Odagiri (aodag) for the initial effort.
	13
	14
d03c94	15	2.0 (2011-09-28)
493726	16	----------------
TS	17
7f9907	18	- ``auth_tkt`` plugin: strip any port number from the 'Domain' of generated
TS	19	cookies. http://bugs.repoze.org/issue66
	20
493726	21	- Further harden middleware, calling ``close()`` on the iterable even if
TS	22	raising an exception for a missing challenger.
	23	http://bugs.repoze.org/issue174
	24
	25
1b2443	26	2.0b1 (2011-05-24)
TS	27	------------------
f8ef81	28
d6b53f	29	- Enabled standard use of logging module's configuration mechanism.
TS	30	See http://docs.python.org/dev/howto/logging.html#configuring-logging-for-a-library
	31	Thanks to jgoldsmith for the patch: http://bugs.repoze.org/issue178
	32
	33
f8ef81	34	- ``repoze.who.plugins.htpasswd``: defend against timing-based attacks.
TS	35
	36
2b9b1f	37	2.0a4 (2011-02-02)
TS	38	------------------
9a8e60	39
b01f44	40	- Ensure that the middleware calls ``close()`` (if it exists) on the
TS	41	iterable returned from thw wrapped application, as required by PEP 333.
	42	http://bugs.repoze.org/issue174
	43
03fba8	44	- Make ``make_api_factory_with_config`` tolerant of invalid filenames /
TS	45	content for the config file: in such cases, the API factory will have
	46	no configured plugins or policies: it will only be useful for retrieving
	47	the API from an environment populated by middleware.
	48
c61031	49	- Fix bug in ``repoze.who.api`` where the ``remember()`` or ``forget()``
TS	50	methods could return a None if the identifier plugin returned a None.
cfe26c	51
c61031	52	- Fix ``auth_tkt`` plugin to not hand over tokens as strings to paste. See
fc9a88	53	http://lists.repoze.org/pipermail/repoze-dev/2010-November/003680.html
BS	54
c61031	55	- Fix ``auth_tkt`` plugin to add "secure" and "HttpOnly" to cookies when
TS	56	configured with ``secure=True``: these attributes prevent the browser from
	57	sending cookies over insecure channels, which could be vulnerable to some
3b5782	58	XSS attacks.
d7e647	59
15e365	60	- Avoid propagating unicode 'max_age' value into cookie headers. See
TS	61	https://bugs.launchpad.net/bugs/674123 .
	62
e8080a	63	- Added a single-file example BFG application demonstrating the use of
TS	64	the new 'login' and 'logout' methods of the API object.
	65
924f24	66	- Add ``login`` and ``logout`` methods to the ``repoze.who.api.API`` object,
TS	67	as a convenience for application-driven login / logout code, which would
95f147	68	otherwise need to use private methods of the API, and reach down into
TS	69	its plugins.
f8ef81	70
9a8e60	71
2c742e	72	2.0a3 (2010-09-30)
eb7071	73	------------------
f80021	74
a446d6	75	- Deprecated the following plugins, moving their modules, tests, and docs
ff604c	76	to a new project, ``repoze.who.deprecatedplugins``:
a446d6	77
TS	78	- ``repoze.who.plugins.cookie.InsecureCookiePlugin``
	79
630a05	80	- ``repoze.who.plugins.form.FormPlugin``
a446d6	81
630a05	82	- ``repoze.who.plugins.form.RedirectingFormPlugin``
a446d6	83
TS	84	- Made the ``repoze.who.plugins.cookie.InsecureCookiePlugin`` take a
76e951	85	``charset`` argument, and use to to encode / decode login and password.
TS	86	See http://bugs.repoze.org/issue155
	87
a446d6	88	- Updated ``repoze.who.restrict`` to return headers as a list, to keep
TS	89	``wsgiref`` from complaining.
5b6365	90
a446d6	91	- Helped default request classifier cope with xml submissions with an
6b7b34	92	explicit charset defined: http://bugs.repoze.org/issue145 (Lorenzo
CM	93	M. Catucci)
	94
a446d6	95	- Corrected the handling of type and subtype when matching an XML post
6b7b34	96	to ``xmlpost`` in the default classifier, which, according to RFC
CM	97	2045, must be matched case-insensitively:
	98	http://bugs.repoze.org/issue145 (Lorenzo M. Catucci)
	99
a349a2	100	- Added ``repoze.who.config:make_api_factory_with_config``, a convenience
TS	101	method for applications which want to set up their own API Factory from
	102	a configuration file.
	103
f80021	104	- Fixed example call to ``repoze.who.config:make_middleware_with_config``
TS	105	(added missing ``global_config`` argument). See
	106	http://bugs.repoze.org/issue114
	107
f8ef81	108
c186ae	109	2.0a2 (2010-03-25)
TS	110	------------------
52bc23	111
TS	112	Bugs Fixed
	113	~~~~~~~~~~
	114
	115	- Fixed failure to pass substution values in log message string formatting
	116	for ``repoze.who.api:API.challenge``. Fix included adding tests for all
	117	logging done by the API object. See http://bugs.repoze.org/issue122
	118
	119	Backward Incompatibilities
	120	~~~~~~~~~~~~~~~~~~~~~~~~~~
	121
	122	- Adjusted logging level for some lower-level details from ``info``
	123	to ``debug``.
f8ef81	124
52bc23	125
TS	126
e25b84	127	2.0a1 (2010-02-24)
993216	128	------------------
TS	129
b4b8ee	130	Features
TS	131	~~~~~~~~
62cd25	132
c9c1c6	133	- Restored the ability to create the middleware using the old ``classifier``
TS	134	argument. That argument is now a deprecated-but-will-work-forever alias for
	135	``request_classifier``.
cbc983	136
b0f81f	137	- The ``auth_tkt`` plugin now implements the ``IAuthenticator`` interface,
TS	138	and should normally be used both as an ``IIdentifier`` and an
	139	``IAuthenticator``.
	140
993216	141	- Factored out the API of the middleware object to make it useful from
TS	142	within the application. Applications using ``repoze.who``` now fall into
	143	one of three catgeories:
	144
	145	- "middleware-only" applications are configured with middleware, and
	146	use either ``REMOTE_USER`` or ``repoze.who.identity`` from the environment
	147	to determing the authenticated user.
	148
	149	- "bare metal" applications use no ``repoze.who`` middleware at all:
	150	instead, they configure and an ``APIFactory`` object at startup, and
	151	use it to create an ``API`` object when needed on a per-request basis.
	152
	153	- "hybrid" applications are configured with ``repoze.who`` middleware,
	154	but use a new library function to fetch the ``API`` object from the
c9c1c6	155	environ, e.g. to permit calling ``remember`` after a signup or successful
TS	156	login.
993216	157
b4b8ee	158	Bugs Fixed
TS	159	~~~~~~~~~~
	160
	161	- Fix http://bugs.repoze.org/issue102: when no challengers existed,
	162	logging would cause an exception.
	163
	164	- Remove ``ez_setup.py`` and dependency on it in setup.py (support
	165	distribute).
	166
	167	Backward Incompatibilities
	168	~~~~~~~~~~~~~~~~~~~~~~~~~~
	169
b213af	170	- The middleware used to allow identifier plugins to "pre-authenticate"
TS	171	an identity. This feature is no longer supported: the ``auth_tkt``
	172	plugin, which used to use the feature, is now configured to work as
c9c1c6	173	an authenticator plugin (as well as an identifier).
b213af	174
b4b8ee	175	- The ``repoze.who.middleware:PluggableAuthenticationMiddleware`` class
TS	176	no longer has the following (non-API) methods (now made API methods
	177	of the ``repoze.who.api:API`` class):
	178
	179	- ``add_metadata``
	180	- ``authenticate``
	181	- ``challenge``
	182	- ``identify``
	183
	184	- The following (non-API) functions moved from ``repoze.who.middleware`` to
	185	``repoze.who.api``:
	186
	187	- ``make_registries``
	188	- ``match_classification``
	189	- ``verify``
	190
	191
f8ef81	192
060054	193	1.0.18 (2009-11-05)
TS	194	-------------------
798feb	195
TS	196	- Issue #104: AuthTkt plugin was passing an invalid cookie value in
	197	headers from ``forget``, and was not setting the ``Max-Age`` and
	198	``Expires`` attributes of those cookies.
	199
b4b8ee	200
f8ef81	201
6e136f	202	1.0.17 (2009-11-05)
TS	203	-------------------
e0d138	204
TS	205	- Fixed the ``repoze.who.plugins.form.make_plugin`` factory's ``formcallable``
	206	argument handling, to allow passing in a dotted name (e.g., from a config
	207	file).
	208
b4b8ee	209
f8ef81	210
6b15ee	211	1.0.16 (2009-11-04)
028e4d	212	-------------------
1ec83d	213
8dd881	214	- Exposed ``formcallable`` argument for ``repoze.who.plugins.form.FormPlugin``
TS	215	to the callers of the ``repoze.who.plugins.form.make_plugin`` factory.
	216	Thanks to Roland Hedburg for the report.
21a9c5	217
8dd881	218	- Fixed an issue that caused the following symptom when using the
TS	219	ini configuration parser::
	220
	221	TypeError: _makePlugin() got multiple values for keyword argument 'name'
21a9c5	222
CM	223	See http://bugs.repoze.org/issue92 for more details. Thanks to vaab
	224	for the bug report and initial fix.
	225
1ec83d	226
7141c7	227	1.0.15 (2009-06-25)
TS	228	-------------------
299b4c	229
a14163	230	- If the form post value ``max_age`` exists while in the ``identify``
CM	231	method is handling the ``login_handler_path``, pass the max_age
	232	value in the returned identity dictionary as ``max_age``. See the
	233	below bullet point for why.
	234
299b4c	235	- If the ``identity`` dict passed to the ``auth_tkt`` ``remember``
CM	236	method contains a ``max_age`` key with a string (or integer) value,
	237	treat it as a cue to set the ``Max-Age`` and ``Expires`` headers in
	238	the returned cookies. The cookie ``Max-Age`` is set to the value
	239	and the ``Expires`` is computed from the current time.
	240
7141c7	241
TS	242	1.0.14 (2009-06-17)
	243	-------------------
9318dd	244
1810b2	245	- Fix test breakage on Windows. See http://bugs.repoze.org/issue79 .
TS	246
00a6d9	247	- Documented issue with using ``include_ip`` setting in the ``auth_tkt``
TS	248	plugin. See http://bugs.repoze.org/issue81 .
	249
0dd808	250	- Added 'passthrough_challenge_decider', which avoids re-challenging 401
TS	251	responses which have been "pre-challenged" by the application.
	252
9318dd	253	- One-hundred percent unit test coverage.
TS	254
a6f6dc	255	- Add ``timeout`` and ``reissue_time`` arguments to the auth_tkt
CM	256	identifier plugin, courtesty of Paul Johnston.
	257
	258	- Add a ``userid_checker`` argument to the auth_tkt identifier plugin,
	259	courtesty of Gustavo Narea.
	260
	261	If ``userid_checker`` is provided, it must be a dotted Python name
	262	that resolves to a function which accepts a userid and returns a
	263	boolean True or False, indicating whether that user exists in a
	264	database. This is a workaround. Due to a design bug in repoze.who,
	265	the only way who can check for user existence is to use one or more
	266	IAuthenticator plugin ``authenticate`` methods. If an
	267	IAuthenticator's ``authenticate`` method returns true, it means that
	268	the user exists. However most IAuthenticator plugins expect both
	269	a username and a password, and will return False unconditionally if
	270	both aren't supplied. This means that an authenticator can't be
	271	used to check if the user "only" exists. The identity provided by
	272	an auth_tkt does not contain a password to check against. The
	273	actual design bug in repoze.who is this: when a user presents
	274	credentials from an auth_tkt, he is considered "preauthenticated".
	275	IAuthenticator.authenticate is just never called for a
	276	"preauthenticated" identity, which works fine, but it means that the
	277	user will be considered authenticated even if you deleted the user's
	278	record from whatever database you happen to be using. However, if
	279	you use a userid_checker, you can ensure that a user exists for the
	280	auth_tkt supplied userid. If the userid_checker returns False, the
	281	auth_tkt credentials are considered "no good".
	282
7141c7	283
TS	284	1.0.13 (2009-04-24)
	285	-------------------
64ba13	286
TS	287	- Added a paragraph to ``IAuthenticator`` docstring, documenting that plugins
	288	are allowed to add keys to the ``identity`` dictionary (e.g., to save a
ced7bd	289	second database query in an ``IMetadataProvider`` plugin).
64ba13	290
08b2ae	291	- Patch supplied for issue #71 (http://bugs.repoze.org/issue71)
CM	292	whereby a downstream app can return a generator, relying on an
	293	upstream component to call start_response. We do this because the
	294	challenge decider needs the status and headers to decide what to do.
	295
56d0c5	296
7141c7	297	1.0.12 (2009-04-19)
TS	298	-------------------
56d0c5	299	- auth_tkt plugin tried to append REMOTE_USER_TOKENS data to
CM	300	existing tokens data returned by auth_tkt.parse_tkt; this was
	301	incorrect; just overwrite.
0ee58d	302
TS	303	- Extended auth_tkt plugin factory to allow passing secret in a separate
	304	file from the main config file. See http://bugs.repoze.org/issue40 .
	305
7141c7	306
TS	307	1.0.11 (2009-04-10)
	308	-------------------
afbbcd	309
8c20ba	310	- Fix auth_tkt plugin; cookie values are now quoted, making it possible
CM	311	to put spaces and other whitespace, etc in usernames. (thanks to Michael
95736b	312	Pedersen).
8c20ba	313
afbbcd	314	- Fix corner case issue of an exception raised when attempting to log
CM	315	when there are no identifiers or authenticators.
	316
7141c7	317
TS	318	1.0.10 (2009-01-23)
	319	-------------------
7b931d	320
CM	321	- The RedirectingFormPlugin now passes along SetCookie headers set
	322	into the response by the application within the NotFound response
	323	(fixes TG2 "flash" issue).
	324
7141c7	325
TS	326	1.0.9 (2008-12-18)
	327	------------------
30ab69	328
9238cd	329	- The RedirectingFormPlugin now attempts to find a header named
CM	330	``X-Authentication-Failure-Reason`` among the response headers set
	331	by the application when a challenge is issued. If a value for this
	332	header exists (and is non-blank), the value is attached to the
	333	redirect URL's query string as the ``reason`` parameter (or a
	334	user-settable key). This makes it possible for downstream
	335	applications to issue a response that initiates a challenge with
	336	this header and subsequently display the reason in the login form
	337	rendered as a result of the challenge.
30ab69	338
7141c7	339
TS	340	1.0.8 (2008-12-13)
	341	------------------
186ff6	342
9238cd	343	- The ``PluggableAuthenticationMiddleware`` constructor accepts a
CM	344	``log_stream`` argument, which is typically a file. After this
	345	release, it can also be a PEP 333 ``Logger`` instance; if it is a
	346	PEP 333 ``Logger`` instance, this logger will be used as the
	347	repoze.who logger (instead of one being constructed by the
	348	middleware, as was previously always the case). When the
	349	``log_stream`` argument is a PEP 333 Logger object, the
	350	``log_level`` argument is ignored.
186ff6	351
7141c7	352
TS	353	1.0.7 (2008-08-28)
	354	------------------
37de44	355
9238cd	356	- ``repoze.who`` and ``repoze.who.plugins`` were not added to the
CM	357	``namespace_packages`` list in setup.py, potentially making 1.0.6 a
	358	brownbag release, given that making these packages namespace
	359	packages was the only reason for its release.
37de44	360
7141c7	361
TS	362	1.0.6 (2008-08-28)
	363	------------------
facdf8	364
9238cd	365	- Make repoze.who and repoze.who.plugins into namespace packages
CM	366	mainly so we can allow plugin authors to distribute packages in the
	367	repoze.who.plugins namespace.
facdf8	368
7141c7	369
TS	370	1.0.5 (2008-08-23)
	371	------------------
519300	372
9238cd	373	- Fix auth_tkt plugin to set the same cookies in its ``remember``
CM	374	method that it does in its ``forget`` method. Previously, logging
	375	out and relogging back in to a site that used auth_tkt identifier
	376	plugin was slightly dicey and would only work sometimes.
facdf8	377
9238cd	378	- The FormPlugin plugin has grown a redirect-on-unauthorized feature.
CM	379	Any response from a downstream application that causes a challenge
	380	and includes a Location header will cause a redirect to the value of
	381	the Location header.
dee08c	382
7141c7	383
TS	384	1.0.4 (2008-08-22)
	385	------------------
b95a59	386
9238cd	387	- Added a key to the '[general]' config section: ``remote_user_key``.
CM	388	If you use this key in the config file, it tells who to 1) not
	389	perform any authentication if it exists in the environment during
	390	ingress and 2) to set the key in the environment for the downstream
	391	app to use as the REMOTE_USER variable. The default is
	392	``REMOTE_USER``.
b95a59	393
9238cd	394	- Using unicode user ids in combination with the auth_tkt plugin would
CM	395	cause problems under mod_wsgi.
55dc7a	396
9238cd	397	- Allowed 'cookie_path' argument to InsecureCookiePlugin (and config
CM	398	constructor). Thanks to Gustavo Narea.
55dc7a	399
7141c7	400
TS	401	1.0.3 (2008-08-16)
	402	------------------
f693fe	403
9238cd	404	- A bug in the middleware's ``authenticate`` method made it impossible
CM	405	to authenticate a user with a userid that was null (e.g. 0, False),
	406	which are valid identifiers. The only invalid userid is now None.
c7e12d	407
9238cd	408	- Applied patch from Olaf Conradi which logs an error when an invalid
CM	409	filename is passed to the HTPasswdPlugin.
c7e12d	410
7141c7	411
TS	412	1.0.2 (2008-06-16)
	413	------------------
cad90d	414
9238cd	415	- Fix bug found by Chris Perkins: the auth_tkt plugin's "remember"
CM	416	method didn't handle userids which are Python "long" instances
	417	properly. Symptom: TypeError: cannot concatenate 'str' and 'long'
	418	objects in "paste.auth.auth_tkt".
a2c030	419
9238cd	420	- Added predicate-based "restriction" middleware support
CM	421	(repoze.who.restrict), allowing configuratio-driven authorization as
	422	a WSGI filter. One example predicate, 'authenticated_predicate', is
	423	supplied, which requires that the user be authenticated either via
	424	'REMOTE_USER' or via 'repoze.who.identity'. To use the filter to
	425	restrict access::
cad90d	426
TS	427	[filter:authenticated_only]
	428	use = egg:repoze.who#authenticated
	429
	430	or::
	431
	432	[filter:some_predicate]
	433	use = egg:repoze.who#predicate
	434	predicate = my.module:some_predicate
	435	some_option = a value
	436
7141c7	437
TS	438	1.0.1 (2008-05-24)
	439	------------------
8199a1	440
9238cd	441	- Remove dependency-link to dist.repoze.org to prevent easy_install
CM	442	from inserting that path into its search paths (the dependencies are
	443	available from PyPI).
8199a1	444
7141c7	445
TS	446	1.0 (2008-05-04)
	447	-----------------
419946	448
9238cd	449	- The plugin at plugins.form.FormPlugin didn't redirect properly after
CM	450	collecting identification information. Symptom: a downstream app
	451	would receive a POST request with a blank body, which would
	452	sometimes result in a Bad Request error.
f39349	453
9238cd	454	- Fixed interface declarations of
CM	455	'classifiers.default_request_classifier' and
	456	'classifiers.default_password_compare'.
515c69	457
9238cd	458	- Added actual config-driven middleware factory,
CM	459	'config.make_middleware_with_config'
515c69	460
9238cd	461	- Removed fossilized 'who_conf' argument from plugin factory functions.
515c69	462
7141c7	463	- Added ConfigParser-based WhoConfig, implementing the spec outlined at
9238cd	464	http://www.plope.com/static/misc/sphinxtest/intro.html#middleware-configuration-via-config-file,
CM	465	with the following changes:
419946	466
7141c7	467	- "Bare" plugins (requiring no configuration options) may be specified
419946	468	as either egg entry points (e.g., 'egg:distname#entry_point_name') or
TS	469	as dotted-path-with-colon (e.g., 'dotted.name:object_id').
	470
7141c7	471	- Therefore, the separator between a plugin and its classifier is now
TS	472	a semicolon, rather than a colon. E.g.::
419946	473
TS	474	[plugins:id_plugin]
	475	use = egg:another.package#identify_with_frobnatz
	476	frobnatz = baz
	477
	478	[identifiers]
	479	plugins =
	480	egg:my.egg#identify;browser
	481	dotted.name:identifier
	482	id_plugin
	483
7141c7	484
779caf	485	0.9.1 (2008-04-27)
7141c7	486	------------------
779caf	487
9238cd	488	- Fix auth_tkt plugin to be able to encode and decode integer user
CM	489	ids.
779caf	490
7141c7	491
88e646	492	0.9 (2008-04-01)
7141c7	493	----------------
88e646	494
9238cd	495	- Fix bug introduced in FormPlugin in 0.8 release (rememberer headers
CM	496	not set).
88e646	497
9238cd	498	- Add PATH_INFO to started and ended log info.
d9f046	499
9238cd	500	- Add a SQLMetadataProviderPlugin (in plugins/sql).
d9f046	501
9238cd	502	- Change constructor of SQLAuthenticatorPlugin: it now accepts only
CM	503	"query", "conn_factory", and "compare_fn". The old constructor
	504	accepted a DSN, but some database systems don't use DBAPI DSNs. The
	505	new constructor accepts no DSN; the conn_factory is assumed to do
	506	all the work to make a connection, including knowing the DSN if one
	507	is required. The "conn_factory" should return something that, when
	508	called with no arguments, returns a database connection.
d9f046	509
9238cd	510	- The "make_plugin" helper in plugins/sql has been renamed
CM	511	"make_authenticator_plugin". When called, this helper will return a
	512	SQLAuthenticatorPlugin. A bit of helper logic in the
	513	"make_authenticator_plugin" allows a connection factory to be
	514	computed. The top-level callable referred to by conn_factory in
	515	this helper should return a function that, when called with no
	516	arguments, returns a datbase connection. The top-level callable
	517	itself is called with "who_conf" (global who configuration) and any
	518	number of non-top-level keyword arguments as they are passed into
	519	the helper, to allow for a DSN or URL or whatever to be passed in.
d9f046	520
9238cd	521	- A "make_metatata_plugin" helper has been added to plugins/sql. When
CM	522	called, this will make a SQLMetadataProviderPlugin. See the
	523	implementation for details. It is similar to the
	524	"make_authenticator_plugin" helper.
d9f046	525
7141c7	526
cbe4e3	527	0.8 (2008-03-27)
7141c7	528	----------------
b5a331	529
9238cd	530	- Add a RedirectingFormIdentifier plugin. This plugin is willing to
CM	531	redirect to an external (or downstream application) login form to
	532	perform identification. The external login form must post to the
	533	"login_handler_path" of the plugin (optimally with a "came_from"
	534	value to tell the plugin where to redirect the response to if the
	535	authentication works properly). The "logout_handler_path" of this
	536	plugin can be visited to perform a logout. The "came_from" value
	537	also works there.
a400b0	538
9238cd	539	- Identifier plugins are now permitted to set a key in the environment
CM	540	named 'repoze.who.application' on ingress (in 'identify'). If an
	541	identifier plugin does so, this application is used instead of the
	542	"normal" downstream application. This feature was added to more
	543	simply support the redirecting form identifier plugin.
a400b0	544
7141c7	545
a400b0	546	0.7 (2008-03-26)
7141c7	547	----------------
a400b0	548
9238cd	549	- Change the IMetadataProvider interface: this interface used to have
CM	550	a "metadata" method which returned a dictionary. This method is not
	551	part of that API anymore. It's been replaced with an "add_metadata"
	552	method which has the signature::
b5a331	553
CM	554	def add_metadata(environ, identity):
	555	"""
	556	Add metadata to the identity (which is a dictionary)
	557	"""
	558
	559	The return value is ignored. IMetadataProvider plugins are now
	560	assumed to be responsible for 'scribbling' directly on the identity
	561	that is passed in (it's a dictionary). The user id can always be
	562	retrieved from the identity via identity['repoze.who.userid'] for
	563	metadata plugins that rely on that value.
	564
7141c7	565
a400b0	566	0.6 (2008-03-20)
7141c7	567	----------------
e35c64	568
9238cd	569	- Renaming: repoze.pam is now repoze.who
cb5426	570
9238cd	571	- Bump ez_setup.py version.
e35c64	572
9238cd	573	- Add IMetadataProvider plugin type. Chris says 'Whit rules'.
fa9581	574
7141c7	575
3b67e9	576	0.5 (2008-03-09)
7141c7	577	----------------
db4cf5	578
9238cd	579	- Allow "remote user key" (default: REMOTE_USER) to be overridden
CM	580	(pass in remote_user_key to middleware constructor).
db4cf5	581
9238cd	582	- Allow form plugin to override the default form.
db4cf5	583
9238cd	584	- API change: IIdentifiers are no longer required to put both 'login'
CM	585	and 'password' in a returned identity dictionary. Instead, an
	586	IIdentifier can place arbitrary key/value pairs in the identity
	587	dictionary (or return an empty dictionary).
40a968	588
9238cd	589	- API return value change: the "failure" identity which IIdentifiers
CM	590	return is now None rather than an empty dictionary.
40a968	591
9238cd	592	- The IAuthenticator interface now specifies that IAuthenticators must
CM	593	not raise an exception when evaluating an identity that does not
	594	have "expected" key/value pairs (e.g. when an IAuthenticator that
	595	expects login and password inspects an identity returned by an
	596	IP-based auth system which only puts the IP address in the
	597	identity); instead they fail gracefully by returning None.
40a968	598
9238cd	599	- Add (cookie) "auth_tkt" identification plugin.
a5b033	600
9238cd	601	- Stamp identity dictionaries with a userid by placing a key named
CM	602	'repoze.pam.userid' into the identity for each authenticated
	603	identity.
a5b033	604
9238cd	605	- If an IIdentifier plugin inserts a 'repoze.pam.userid' key into the
CM	606	identity dictionary, consider this identity "preauthenticated". No
	607	authenticator plugins will be asked to authenticate this identity.
	608	This is designed for things like the recently added auth_tkt plugin,
	609	which embeds the user id into the ticket. This effectively alllows
	610	an IIdentifier plugin to become an IAuthenticator plugin when
	611	breaking apart the responsibility into two separate plugins is
	612	"make-work". Preauthenticated identities will be selected first
	613	when deciding which identity to use for any given request.
a5b033	614
9238cd	615	- Insert a 'repoze.pam.identity' key into the WSGI environment on
CM	616	ingress if an identity is found. Its value will be the identity
	617	dictionary related to the identity selected by repoze.pam on
	618	ingress. Downstream consumers are allowed to mutate this
	619	dictionary; this value is passed to "remember" and "forget", so its
	620	main use is to do a "credentials reset"; e.g. a user has changed his
	621	username or password within the application, but we don't want to
	622	force him to log in again after he does so.
a5b033	623
7141c7	624
247f34	625	0.4 (03-07-2008)
7141c7	626	----------------
247f34	627
9238cd	628	- Allow plugins to specify a classifiers list per interface (instead
CM	629	of a single classifiers list per plugin).
247f34	630
7141c7	631
fb510d	632	0.3 (03-05-2008)
7141c7	633	----------------
fb510d	634
9238cd	635	- Make SQLAuthenticatorPlugin's default_password_compare use hexdigest
CM	636	sha instead of base64'ed binary sha for simpler conversion.
fb510d	637
7141c7	638
196bc2	639	0.2 (03-04-2008)
7141c7	640	----------------
196bc2	641
9238cd	642	- Added SQLAuthenticatorPlugin (see plugins/sql.py).
196bc2	643
7141c7	644
318832	645	0.1 (02-27-2008)
7141c7	646	----------------
318832	647
9238cd	648	- Initial release (no configuration file support yet).