RedHatTraining/repoze.who.git

Tres Seaver

2016-05-31 41468fbaa81a4658c57bfdee724986fd98592bd0

commit \| author \| age
7141c7	1	repoze.who Changelog
TS	2	====================
aa8755	3
c46a74	4	2.3 (unreleased)
TS	5	----------------
	6
90fd1c	7	- Add support for Python 3.4, Python 3.5, and PyPy3.
c46a74	8
TS	9	- Drop support for Python 2.6 and 3.2.
4f3525	10
41468f	11	- ``_auth_tkt`` / ``plugins.auth_tkt``: add support for any hash algorithm
TS	12	supported by the ``hashlib`` module in Python's standard library.
	13	Fixes #22 via #23.
	14
0a07fc	15	- ``plugins.auth_tkt``: Fix storage of "userdata" to save dict. Fixes
41468f	16	#14 via #18.
7b0a91	17
19d219	18	- middleware: avoid UnboundLocalError when wrapped generater yields no
TS	19	items. See: http://bugs.repoze.org/issue184
	20
4f3525	21	- Make cookie expiration date RFC-2616 compliant (independent of locale,
41468f	22	including 'GMT' zone). See #11.
4f3525	23
9cd0f8	24	2.2 (2013-05-17)
a4b584	25	----------------
TS	26
1d7c19	27	- Parse INI-file configuration using ``SafeConfigParser``: allows
TS	28	escaping the ``'%'`` so that e.g. a query template using for a DB-API
	29	connection using ``pyformat`` preserves the template.
	30
a4b584	31	- Added support for Python 3.3, PyPy.
TS	32
d96616	33
717490	34	2.1 (2013-03-20)
c72bfe	35	----------------
TS	36
5ecc71	37	- ``_compat`` module: tolerate missing ``CONTENT_TYPE`` key in the WSGI
TS	38	environment. Thanks to Dag Hoidal for the patch.
	39
d96616	40	- ``htpasswd`` plugin: add a ``sha1_check`` checker function (the ``crypt``
TS	41	module is not available on Windows). Thanks to Chandrashekar Jayaraman
	42	for the patch.
	43
c72bfe	44	- Documentation typo fixes from Carlos de la Guardia and Atsushi Odagiri.
TS	45
0cfb1a	46
TS	47	2.1b1 (2012-11-05)
	48	------------------
d9f6f4	49
TS	50	- Ported to Py3k using the "compatible subset" mode.
	51	- Dropped support for Python < 2.6.x.
	52	- Dropped dependency on Paste (forking some code from it).
	53	- Added dependency on WebOb instead.
	54	Thanks to Atsushi Odagiri (aodag) for the initial effort.
	55
	56
d03c94	57	2.0 (2011-09-28)
493726	58	----------------
TS	59
7f9907	60	- ``auth_tkt`` plugin: strip any port number from the 'Domain' of generated
TS	61	cookies. http://bugs.repoze.org/issue66
	62
493726	63	- Further harden middleware, calling ``close()`` on the iterable even if
TS	64	raising an exception for a missing challenger.
	65	http://bugs.repoze.org/issue174
	66
	67
1b2443	68	2.0b1 (2011-05-24)
TS	69	------------------
f8ef81	70
d6b53f	71	- Enabled standard use of logging module's configuration mechanism.
TS	72	See http://docs.python.org/dev/howto/logging.html#configuring-logging-for-a-library
	73	Thanks to jgoldsmith for the patch: http://bugs.repoze.org/issue178
	74
	75
f8ef81	76	- ``repoze.who.plugins.htpasswd``: defend against timing-based attacks.
TS	77
	78
2b9b1f	79	2.0a4 (2011-02-02)
TS	80	------------------
9a8e60	81
b01f44	82	- Ensure that the middleware calls ``close()`` (if it exists) on the
TS	83	iterable returned from thw wrapped application, as required by PEP 333.
	84	http://bugs.repoze.org/issue174
	85
03fba8	86	- Make ``make_api_factory_with_config`` tolerant of invalid filenames /
TS	87	content for the config file: in such cases, the API factory will have
	88	no configured plugins or policies: it will only be useful for retrieving
	89	the API from an environment populated by middleware.
	90
c61031	91	- Fix bug in ``repoze.who.api`` where the ``remember()`` or ``forget()``
TS	92	methods could return a None if the identifier plugin returned a None.
cfe26c	93
c61031	94	- Fix ``auth_tkt`` plugin to not hand over tokens as strings to paste. See
fc9a88	95	http://lists.repoze.org/pipermail/repoze-dev/2010-November/003680.html
BS	96
c61031	97	- Fix ``auth_tkt`` plugin to add "secure" and "HttpOnly" to cookies when
TS	98	configured with ``secure=True``: these attributes prevent the browser from
	99	sending cookies over insecure channels, which could be vulnerable to some
3b5782	100	XSS attacks.
d7e647	101
15e365	102	- Avoid propagating unicode 'max_age' value into cookie headers. See
TS	103	https://bugs.launchpad.net/bugs/674123 .
	104
e8080a	105	- Added a single-file example BFG application demonstrating the use of
TS	106	the new 'login' and 'logout' methods of the API object.
	107
924f24	108	- Add ``login`` and ``logout`` methods to the ``repoze.who.api.API`` object,
TS	109	as a convenience for application-driven login / logout code, which would
95f147	110	otherwise need to use private methods of the API, and reach down into
TS	111	its plugins.
f8ef81	112
9a8e60	113
2c742e	114	2.0a3 (2010-09-30)
eb7071	115	------------------
f80021	116
a446d6	117	- Deprecated the following plugins, moving their modules, tests, and docs
ff604c	118	to a new project, ``repoze.who.deprecatedplugins``:
a446d6	119
TS	120	- ``repoze.who.plugins.cookie.InsecureCookiePlugin``
	121
630a05	122	- ``repoze.who.plugins.form.FormPlugin``
a446d6	123
630a05	124	- ``repoze.who.plugins.form.RedirectingFormPlugin``
a446d6	125
TS	126	- Made the ``repoze.who.plugins.cookie.InsecureCookiePlugin`` take a
76e951	127	``charset`` argument, and use to to encode / decode login and password.
TS	128	See http://bugs.repoze.org/issue155
	129
a446d6	130	- Updated ``repoze.who.restrict`` to return headers as a list, to keep
TS	131	``wsgiref`` from complaining.
5b6365	132
a446d6	133	- Helped default request classifier cope with xml submissions with an
6b7b34	134	explicit charset defined: http://bugs.repoze.org/issue145 (Lorenzo
CM	135	M. Catucci)
	136
a446d6	137	- Corrected the handling of type and subtype when matching an XML post
6b7b34	138	to ``xmlpost`` in the default classifier, which, according to RFC
CM	139	2045, must be matched case-insensitively:
	140	http://bugs.repoze.org/issue145 (Lorenzo M. Catucci)
	141
a349a2	142	- Added ``repoze.who.config:make_api_factory_with_config``, a convenience
TS	143	method for applications which want to set up their own API Factory from
	144	a configuration file.
	145
f80021	146	- Fixed example call to ``repoze.who.config:make_middleware_with_config``
TS	147	(added missing ``global_config`` argument). See
	148	http://bugs.repoze.org/issue114
	149
f8ef81	150
c186ae	151	2.0a2 (2010-03-25)
TS	152	------------------
52bc23	153
TS	154	Bugs Fixed
	155	~~~~~~~~~~
	156
	157	- Fixed failure to pass substution values in log message string formatting
	158	for ``repoze.who.api:API.challenge``. Fix included adding tests for all
	159	logging done by the API object. See http://bugs.repoze.org/issue122
	160
	161	Backward Incompatibilities
	162	~~~~~~~~~~~~~~~~~~~~~~~~~~
	163
	164	- Adjusted logging level for some lower-level details from ``info``
	165	to ``debug``.
f8ef81	166
52bc23	167
TS	168
e25b84	169	2.0a1 (2010-02-24)
993216	170	------------------
TS	171
b4b8ee	172	Features
TS	173	~~~~~~~~
62cd25	174
c9c1c6	175	- Restored the ability to create the middleware using the old ``classifier``
TS	176	argument. That argument is now a deprecated-but-will-work-forever alias for
	177	``request_classifier``.
cbc983	178
b0f81f	179	- The ``auth_tkt`` plugin now implements the ``IAuthenticator`` interface,
TS	180	and should normally be used both as an ``IIdentifier`` and an
	181	``IAuthenticator``.
	182
993216	183	- Factored out the API of the middleware object to make it useful from
TS	184	within the application. Applications using ``repoze.who``` now fall into
	185	one of three catgeories:
	186
	187	- "middleware-only" applications are configured with middleware, and
	188	use either ``REMOTE_USER`` or ``repoze.who.identity`` from the environment
	189	to determing the authenticated user.
	190
	191	- "bare metal" applications use no ``repoze.who`` middleware at all:
	192	instead, they configure and an ``APIFactory`` object at startup, and
	193	use it to create an ``API`` object when needed on a per-request basis.
	194
	195	- "hybrid" applications are configured with ``repoze.who`` middleware,
	196	but use a new library function to fetch the ``API`` object from the
c9c1c6	197	environ, e.g. to permit calling ``remember`` after a signup or successful
TS	198	login.
993216	199
b4b8ee	200	Bugs Fixed
TS	201	~~~~~~~~~~
	202
	203	- Fix http://bugs.repoze.org/issue102: when no challengers existed,
	204	logging would cause an exception.
	205
	206	- Remove ``ez_setup.py`` and dependency on it in setup.py (support
	207	distribute).
	208
	209	Backward Incompatibilities
	210	~~~~~~~~~~~~~~~~~~~~~~~~~~
	211
b213af	212	- The middleware used to allow identifier plugins to "pre-authenticate"
TS	213	an identity. This feature is no longer supported: the ``auth_tkt``
	214	plugin, which used to use the feature, is now configured to work as
c9c1c6	215	an authenticator plugin (as well as an identifier).
b213af	216
b4b8ee	217	- The ``repoze.who.middleware:PluggableAuthenticationMiddleware`` class
TS	218	no longer has the following (non-API) methods (now made API methods
	219	of the ``repoze.who.api:API`` class):
	220
	221	- ``add_metadata``
	222	- ``authenticate``
	223	- ``challenge``
	224	- ``identify``
	225
	226	- The following (non-API) functions moved from ``repoze.who.middleware`` to
	227	``repoze.who.api``:
	228
	229	- ``make_registries``
	230	- ``match_classification``
	231	- ``verify``
	232
	233
f8ef81	234
060054	235	1.0.18 (2009-11-05)
TS	236	-------------------
798feb	237
TS	238	- Issue #104: AuthTkt plugin was passing an invalid cookie value in
	239	headers from ``forget``, and was not setting the ``Max-Age`` and
	240	``Expires`` attributes of those cookies.
	241
b4b8ee	242
f8ef81	243
6e136f	244	1.0.17 (2009-11-05)
TS	245	-------------------
e0d138	246
TS	247	- Fixed the ``repoze.who.plugins.form.make_plugin`` factory's ``formcallable``
	248	argument handling, to allow passing in a dotted name (e.g., from a config
	249	file).
	250
b4b8ee	251
f8ef81	252
6b15ee	253	1.0.16 (2009-11-04)
028e4d	254	-------------------
1ec83d	255
8dd881	256	- Exposed ``formcallable`` argument for ``repoze.who.plugins.form.FormPlugin``
TS	257	to the callers of the ``repoze.who.plugins.form.make_plugin`` factory.
	258	Thanks to Roland Hedburg for the report.
21a9c5	259
8dd881	260	- Fixed an issue that caused the following symptom when using the
TS	261	ini configuration parser::
	262
	263	TypeError: _makePlugin() got multiple values for keyword argument 'name'
21a9c5	264
CM	265	See http://bugs.repoze.org/issue92 for more details. Thanks to vaab
	266	for the bug report and initial fix.
	267
1ec83d	268
7141c7	269	1.0.15 (2009-06-25)
TS	270	-------------------
299b4c	271
a14163	272	- If the form post value ``max_age`` exists while in the ``identify``
CM	273	method is handling the ``login_handler_path``, pass the max_age
	274	value in the returned identity dictionary as ``max_age``. See the
	275	below bullet point for why.
	276
299b4c	277	- If the ``identity`` dict passed to the ``auth_tkt`` ``remember``
CM	278	method contains a ``max_age`` key with a string (or integer) value,
	279	treat it as a cue to set the ``Max-Age`` and ``Expires`` headers in
	280	the returned cookies. The cookie ``Max-Age`` is set to the value
	281	and the ``Expires`` is computed from the current time.
	282
7141c7	283
TS	284	1.0.14 (2009-06-17)
	285	-------------------
9318dd	286
1810b2	287	- Fix test breakage on Windows. See http://bugs.repoze.org/issue79 .
TS	288
00a6d9	289	- Documented issue with using ``include_ip`` setting in the ``auth_tkt``
TS	290	plugin. See http://bugs.repoze.org/issue81 .
	291
0dd808	292	- Added 'passthrough_challenge_decider', which avoids re-challenging 401
TS	293	responses which have been "pre-challenged" by the application.
	294
9318dd	295	- One-hundred percent unit test coverage.
TS	296
a6f6dc	297	- Add ``timeout`` and ``reissue_time`` arguments to the auth_tkt
CM	298	identifier plugin, courtesty of Paul Johnston.
	299
	300	- Add a ``userid_checker`` argument to the auth_tkt identifier plugin,
	301	courtesty of Gustavo Narea.
	302
	303	If ``userid_checker`` is provided, it must be a dotted Python name
	304	that resolves to a function which accepts a userid and returns a
	305	boolean True or False, indicating whether that user exists in a
	306	database. This is a workaround. Due to a design bug in repoze.who,
	307	the only way who can check for user existence is to use one or more
	308	IAuthenticator plugin ``authenticate`` methods. If an
	309	IAuthenticator's ``authenticate`` method returns true, it means that
	310	the user exists. However most IAuthenticator plugins expect both
	311	a username and a password, and will return False unconditionally if
	312	both aren't supplied. This means that an authenticator can't be
	313	used to check if the user "only" exists. The identity provided by
	314	an auth_tkt does not contain a password to check against. The
	315	actual design bug in repoze.who is this: when a user presents
	316	credentials from an auth_tkt, he is considered "preauthenticated".
	317	IAuthenticator.authenticate is just never called for a
	318	"preauthenticated" identity, which works fine, but it means that the
	319	user will be considered authenticated even if you deleted the user's
	320	record from whatever database you happen to be using. However, if
	321	you use a userid_checker, you can ensure that a user exists for the
	322	auth_tkt supplied userid. If the userid_checker returns False, the
	323	auth_tkt credentials are considered "no good".
	324
7141c7	325
TS	326	1.0.13 (2009-04-24)
	327	-------------------
64ba13	328
TS	329	- Added a paragraph to ``IAuthenticator`` docstring, documenting that plugins
	330	are allowed to add keys to the ``identity`` dictionary (e.g., to save a
ced7bd	331	second database query in an ``IMetadataProvider`` plugin).
64ba13	332
08b2ae	333	- Patch supplied for issue #71 (http://bugs.repoze.org/issue71)
CM	334	whereby a downstream app can return a generator, relying on an
	335	upstream component to call start_response. We do this because the
	336	challenge decider needs the status and headers to decide what to do.
	337
56d0c5	338
7141c7	339	1.0.12 (2009-04-19)
TS	340	-------------------
56d0c5	341	- auth_tkt plugin tried to append REMOTE_USER_TOKENS data to
CM	342	existing tokens data returned by auth_tkt.parse_tkt; this was
	343	incorrect; just overwrite.
0ee58d	344
TS	345	- Extended auth_tkt plugin factory to allow passing secret in a separate
	346	file from the main config file. See http://bugs.repoze.org/issue40 .
	347
7141c7	348
TS	349	1.0.11 (2009-04-10)
	350	-------------------
afbbcd	351
8c20ba	352	- Fix auth_tkt plugin; cookie values are now quoted, making it possible
CM	353	to put spaces and other whitespace, etc in usernames. (thanks to Michael
95736b	354	Pedersen).
8c20ba	355
afbbcd	356	- Fix corner case issue of an exception raised when attempting to log
CM	357	when there are no identifiers or authenticators.
	358
7141c7	359
TS	360	1.0.10 (2009-01-23)
	361	-------------------
7b931d	362
CM	363	- The RedirectingFormPlugin now passes along SetCookie headers set
	364	into the response by the application within the NotFound response
	365	(fixes TG2 "flash" issue).
	366
7141c7	367
TS	368	1.0.9 (2008-12-18)
	369	------------------
30ab69	370
9238cd	371	- The RedirectingFormPlugin now attempts to find a header named
CM	372	``X-Authentication-Failure-Reason`` among the response headers set
	373	by the application when a challenge is issued. If a value for this
	374	header exists (and is non-blank), the value is attached to the
	375	redirect URL's query string as the ``reason`` parameter (or a
	376	user-settable key). This makes it possible for downstream
	377	applications to issue a response that initiates a challenge with
	378	this header and subsequently display the reason in the login form
	379	rendered as a result of the challenge.
30ab69	380
7141c7	381
TS	382	1.0.8 (2008-12-13)
	383	------------------
186ff6	384
9238cd	385	- The ``PluggableAuthenticationMiddleware`` constructor accepts a
CM	386	``log_stream`` argument, which is typically a file. After this
	387	release, it can also be a PEP 333 ``Logger`` instance; if it is a
	388	PEP 333 ``Logger`` instance, this logger will be used as the
	389	repoze.who logger (instead of one being constructed by the
	390	middleware, as was previously always the case). When the
	391	``log_stream`` argument is a PEP 333 Logger object, the
	392	``log_level`` argument is ignored.
186ff6	393
7141c7	394
TS	395	1.0.7 (2008-08-28)
	396	------------------
37de44	397
9238cd	398	- ``repoze.who`` and ``repoze.who.plugins`` were not added to the
CM	399	``namespace_packages`` list in setup.py, potentially making 1.0.6 a
	400	brownbag release, given that making these packages namespace
	401	packages was the only reason for its release.
37de44	402
7141c7	403
TS	404	1.0.6 (2008-08-28)
	405	------------------
facdf8	406
9238cd	407	- Make repoze.who and repoze.who.plugins into namespace packages
CM	408	mainly so we can allow plugin authors to distribute packages in the
	409	repoze.who.plugins namespace.
facdf8	410
7141c7	411
TS	412	1.0.5 (2008-08-23)
	413	------------------
519300	414
9238cd	415	- Fix auth_tkt plugin to set the same cookies in its ``remember``
CM	416	method that it does in its ``forget`` method. Previously, logging
	417	out and relogging back in to a site that used auth_tkt identifier
	418	plugin was slightly dicey and would only work sometimes.
facdf8	419
9238cd	420	- The FormPlugin plugin has grown a redirect-on-unauthorized feature.
CM	421	Any response from a downstream application that causes a challenge
	422	and includes a Location header will cause a redirect to the value of
	423	the Location header.
dee08c	424
7141c7	425
TS	426	1.0.4 (2008-08-22)
	427	------------------
b95a59	428
9238cd	429	- Added a key to the '[general]' config section: ``remote_user_key``.
CM	430	If you use this key in the config file, it tells who to 1) not
	431	perform any authentication if it exists in the environment during
	432	ingress and 2) to set the key in the environment for the downstream
	433	app to use as the REMOTE_USER variable. The default is
	434	``REMOTE_USER``.
b95a59	435
9238cd	436	- Using unicode user ids in combination with the auth_tkt plugin would
CM	437	cause problems under mod_wsgi.
55dc7a	438
9238cd	439	- Allowed 'cookie_path' argument to InsecureCookiePlugin (and config
CM	440	constructor). Thanks to Gustavo Narea.
55dc7a	441
7141c7	442
TS	443	1.0.3 (2008-08-16)
	444	------------------
f693fe	445
9238cd	446	- A bug in the middleware's ``authenticate`` method made it impossible
CM	447	to authenticate a user with a userid that was null (e.g. 0, False),
	448	which are valid identifiers. The only invalid userid is now None.
c7e12d	449
9238cd	450	- Applied patch from Olaf Conradi which logs an error when an invalid
CM	451	filename is passed to the HTPasswdPlugin.
c7e12d	452
7141c7	453
TS	454	1.0.2 (2008-06-16)
	455	------------------
cad90d	456
9238cd	457	- Fix bug found by Chris Perkins: the auth_tkt plugin's "remember"
CM	458	method didn't handle userids which are Python "long" instances
	459	properly. Symptom: TypeError: cannot concatenate 'str' and 'long'
	460	objects in "paste.auth.auth_tkt".
a2c030	461
9238cd	462	- Added predicate-based "restriction" middleware support
CM	463	(repoze.who.restrict), allowing configuratio-driven authorization as
	464	a WSGI filter. One example predicate, 'authenticated_predicate', is
	465	supplied, which requires that the user be authenticated either via
	466	'REMOTE_USER' or via 'repoze.who.identity'. To use the filter to
	467	restrict access::
cad90d	468
TS	469	[filter:authenticated_only]
	470	use = egg:repoze.who#authenticated
	471
	472	or::
	473
	474	[filter:some_predicate]
	475	use = egg:repoze.who#predicate
	476	predicate = my.module:some_predicate
	477	some_option = a value
	478
7141c7	479
TS	480	1.0.1 (2008-05-24)
	481	------------------
8199a1	482
9238cd	483	- Remove dependency-link to dist.repoze.org to prevent easy_install
CM	484	from inserting that path into its search paths (the dependencies are
	485	available from PyPI).
8199a1	486
7141c7	487
TS	488	1.0 (2008-05-04)
	489	-----------------
419946	490
9238cd	491	- The plugin at plugins.form.FormPlugin didn't redirect properly after
CM	492	collecting identification information. Symptom: a downstream app
	493	would receive a POST request with a blank body, which would
	494	sometimes result in a Bad Request error.
f39349	495
9238cd	496	- Fixed interface declarations of
CM	497	'classifiers.default_request_classifier' and
	498	'classifiers.default_password_compare'.
515c69	499
9238cd	500	- Added actual config-driven middleware factory,
CM	501	'config.make_middleware_with_config'
515c69	502
9238cd	503	- Removed fossilized 'who_conf' argument from plugin factory functions.
515c69	504
7141c7	505	- Added ConfigParser-based WhoConfig, implementing the spec outlined at
9238cd	506	http://www.plope.com/static/misc/sphinxtest/intro.html#middleware-configuration-via-config-file,
CM	507	with the following changes:
419946	508
7141c7	509	- "Bare" plugins (requiring no configuration options) may be specified
419946	510	as either egg entry points (e.g., 'egg:distname#entry_point_name') or
TS	511	as dotted-path-with-colon (e.g., 'dotted.name:object_id').
	512
7141c7	513	- Therefore, the separator between a plugin and its classifier is now
TS	514	a semicolon, rather than a colon. E.g.::
419946	515
TS	516	[plugins:id_plugin]
	517	use = egg:another.package#identify_with_frobnatz
	518	frobnatz = baz
	519
	520	[identifiers]
	521	plugins =
	522	egg:my.egg#identify;browser
	523	dotted.name:identifier
	524	id_plugin
	525
7141c7	526
779caf	527	0.9.1 (2008-04-27)
7141c7	528	------------------
779caf	529
9238cd	530	- Fix auth_tkt plugin to be able to encode and decode integer user
CM	531	ids.
779caf	532
7141c7	533
88e646	534	0.9 (2008-04-01)
7141c7	535	----------------
88e646	536
9238cd	537	- Fix bug introduced in FormPlugin in 0.8 release (rememberer headers
CM	538	not set).
88e646	539
9238cd	540	- Add PATH_INFO to started and ended log info.
d9f046	541
9238cd	542	- Add a SQLMetadataProviderPlugin (in plugins/sql).
d9f046	543
9238cd	544	- Change constructor of SQLAuthenticatorPlugin: it now accepts only
CM	545	"query", "conn_factory", and "compare_fn". The old constructor
	546	accepted a DSN, but some database systems don't use DBAPI DSNs. The
	547	new constructor accepts no DSN; the conn_factory is assumed to do
	548	all the work to make a connection, including knowing the DSN if one
	549	is required. The "conn_factory" should return something that, when
	550	called with no arguments, returns a database connection.
d9f046	551
9238cd	552	- The "make_plugin" helper in plugins/sql has been renamed
CM	553	"make_authenticator_plugin". When called, this helper will return a
	554	SQLAuthenticatorPlugin. A bit of helper logic in the
	555	"make_authenticator_plugin" allows a connection factory to be
	556	computed. The top-level callable referred to by conn_factory in
	557	this helper should return a function that, when called with no
	558	arguments, returns a datbase connection. The top-level callable
	559	itself is called with "who_conf" (global who configuration) and any
	560	number of non-top-level keyword arguments as they are passed into
	561	the helper, to allow for a DSN or URL or whatever to be passed in.
d9f046	562
9238cd	563	- A "make_metatata_plugin" helper has been added to plugins/sql. When
CM	564	called, this will make a SQLMetadataProviderPlugin. See the
	565	implementation for details. It is similar to the
	566	"make_authenticator_plugin" helper.
d9f046	567
7141c7	568
cbe4e3	569	0.8 (2008-03-27)
7141c7	570	----------------
b5a331	571
9238cd	572	- Add a RedirectingFormIdentifier plugin. This plugin is willing to
CM	573	redirect to an external (or downstream application) login form to
	574	perform identification. The external login form must post to the
	575	"login_handler_path" of the plugin (optimally with a "came_from"
	576	value to tell the plugin where to redirect the response to if the
	577	authentication works properly). The "logout_handler_path" of this
	578	plugin can be visited to perform a logout. The "came_from" value
	579	also works there.
a400b0	580
9238cd	581	- Identifier plugins are now permitted to set a key in the environment
CM	582	named 'repoze.who.application' on ingress (in 'identify'). If an
	583	identifier plugin does so, this application is used instead of the
	584	"normal" downstream application. This feature was added to more
	585	simply support the redirecting form identifier plugin.
a400b0	586
7141c7	587
a400b0	588	0.7 (2008-03-26)
7141c7	589	----------------
a400b0	590
9238cd	591	- Change the IMetadataProvider interface: this interface used to have
CM	592	a "metadata" method which returned a dictionary. This method is not
	593	part of that API anymore. It's been replaced with an "add_metadata"
	594	method which has the signature::
b5a331	595
CM	596	def add_metadata(environ, identity):
	597	"""
	598	Add metadata to the identity (which is a dictionary)
	599	"""
	600
	601	The return value is ignored. IMetadataProvider plugins are now
	602	assumed to be responsible for 'scribbling' directly on the identity
	603	that is passed in (it's a dictionary). The user id can always be
	604	retrieved from the identity via identity['repoze.who.userid'] for
	605	metadata plugins that rely on that value.
	606
7141c7	607
a400b0	608	0.6 (2008-03-20)
7141c7	609	----------------
e35c64	610
9238cd	611	- Renaming: repoze.pam is now repoze.who
cb5426	612
9238cd	613	- Bump ez_setup.py version.
e35c64	614
9238cd	615	- Add IMetadataProvider plugin type. Chris says 'Whit rules'.
fa9581	616
7141c7	617
3b67e9	618	0.5 (2008-03-09)
7141c7	619	----------------
db4cf5	620
9238cd	621	- Allow "remote user key" (default: REMOTE_USER) to be overridden
CM	622	(pass in remote_user_key to middleware constructor).
db4cf5	623
9238cd	624	- Allow form plugin to override the default form.
db4cf5	625
9238cd	626	- API change: IIdentifiers are no longer required to put both 'login'
CM	627	and 'password' in a returned identity dictionary. Instead, an
	628	IIdentifier can place arbitrary key/value pairs in the identity
	629	dictionary (or return an empty dictionary).
40a968	630
9238cd	631	- API return value change: the "failure" identity which IIdentifiers
CM	632	return is now None rather than an empty dictionary.
40a968	633
9238cd	634	- The IAuthenticator interface now specifies that IAuthenticators must
CM	635	not raise an exception when evaluating an identity that does not
	636	have "expected" key/value pairs (e.g. when an IAuthenticator that
	637	expects login and password inspects an identity returned by an
	638	IP-based auth system which only puts the IP address in the
	639	identity); instead they fail gracefully by returning None.
40a968	640
9238cd	641	- Add (cookie) "auth_tkt" identification plugin.
a5b033	642
9238cd	643	- Stamp identity dictionaries with a userid by placing a key named
CM	644	'repoze.pam.userid' into the identity for each authenticated
	645	identity.
a5b033	646
9238cd	647	- If an IIdentifier plugin inserts a 'repoze.pam.userid' key into the
CM	648	identity dictionary, consider this identity "preauthenticated". No
	649	authenticator plugins will be asked to authenticate this identity.
	650	This is designed for things like the recently added auth_tkt plugin,
	651	which embeds the user id into the ticket. This effectively alllows
	652	an IIdentifier plugin to become an IAuthenticator plugin when
	653	breaking apart the responsibility into two separate plugins is
	654	"make-work". Preauthenticated identities will be selected first
	655	when deciding which identity to use for any given request.
a5b033	656
9238cd	657	- Insert a 'repoze.pam.identity' key into the WSGI environment on
CM	658	ingress if an identity is found. Its value will be the identity
	659	dictionary related to the identity selected by repoze.pam on
	660	ingress. Downstream consumers are allowed to mutate this
	661	dictionary; this value is passed to "remember" and "forget", so its
	662	main use is to do a "credentials reset"; e.g. a user has changed his
	663	username or password within the application, but we don't want to
	664	force him to log in again after he does so.
a5b033	665
7141c7	666
247f34	667	0.4 (03-07-2008)
7141c7	668	----------------
247f34	669
9238cd	670	- Allow plugins to specify a classifiers list per interface (instead
CM	671	of a single classifiers list per plugin).
247f34	672
7141c7	673
fb510d	674	0.3 (03-05-2008)
7141c7	675	----------------
fb510d	676
9238cd	677	- Make SQLAuthenticatorPlugin's default_password_compare use hexdigest
CM	678	sha instead of base64'ed binary sha for simpler conversion.
fb510d	679
7141c7	680
196bc2	681	0.2 (03-04-2008)
7141c7	682	----------------
196bc2	683
9238cd	684	- Added SQLAuthenticatorPlugin (see plugins/sql.py).
196bc2	685
7141c7	686
318832	687	0.1 (02-27-2008)
7141c7	688	----------------
318832	689
9238cd	690	- Initial release (no configuration file support yet).