RedHatTraining/repoze.who.git

Tres Seaver

2013-03-20 7174909b7f940f2f653417ff4182cd61d175da07

commit \| author \| age
7141c7	1	repoze.who Changelog
TS	2	====================
aa8755	3
d96616	4
717490	5	2.1 (2013-03-20)
c72bfe	6	----------------
TS	7
5ecc71	8	- ``_compat`` module: tolerate missing ``CONTENT_TYPE`` key in the WSGI
TS	9	environment. Thanks to Dag Hoidal for the patch.
	10
d96616	11	- ``htpasswd`` plugin: add a ``sha1_check`` checker function (the ``crypt``
TS	12	module is not available on Windows). Thanks to Chandrashekar Jayaraman
	13	for the patch.
	14
c72bfe	15	- Documentation typo fixes from Carlos de la Guardia and Atsushi Odagiri.
TS	16
0cfb1a	17
TS	18	2.1b1 (2012-11-05)
	19	------------------
d9f6f4	20
TS	21	- Ported to Py3k using the "compatible subset" mode.
	22	- Dropped support for Python < 2.6.x.
	23	- Dropped dependency on Paste (forking some code from it).
	24	- Added dependency on WebOb instead.
	25	Thanks to Atsushi Odagiri (aodag) for the initial effort.
	26
	27
d03c94	28	2.0 (2011-09-28)
493726	29	----------------
TS	30
7f9907	31	- ``auth_tkt`` plugin: strip any port number from the 'Domain' of generated
TS	32	cookies. http://bugs.repoze.org/issue66
	33
493726	34	- Further harden middleware, calling ``close()`` on the iterable even if
TS	35	raising an exception for a missing challenger.
	36	http://bugs.repoze.org/issue174
	37
	38
1b2443	39	2.0b1 (2011-05-24)
TS	40	------------------
f8ef81	41
d6b53f	42	- Enabled standard use of logging module's configuration mechanism.
TS	43	See http://docs.python.org/dev/howto/logging.html#configuring-logging-for-a-library
	44	Thanks to jgoldsmith for the patch: http://bugs.repoze.org/issue178
	45
	46
f8ef81	47	- ``repoze.who.plugins.htpasswd``: defend against timing-based attacks.
TS	48
	49
2b9b1f	50	2.0a4 (2011-02-02)
TS	51	------------------
9a8e60	52
b01f44	53	- Ensure that the middleware calls ``close()`` (if it exists) on the
TS	54	iterable returned from thw wrapped application, as required by PEP 333.
	55	http://bugs.repoze.org/issue174
	56
03fba8	57	- Make ``make_api_factory_with_config`` tolerant of invalid filenames /
TS	58	content for the config file: in such cases, the API factory will have
	59	no configured plugins or policies: it will only be useful for retrieving
	60	the API from an environment populated by middleware.
	61
c61031	62	- Fix bug in ``repoze.who.api`` where the ``remember()`` or ``forget()``
TS	63	methods could return a None if the identifier plugin returned a None.
cfe26c	64
c61031	65	- Fix ``auth_tkt`` plugin to not hand over tokens as strings to paste. See
fc9a88	66	http://lists.repoze.org/pipermail/repoze-dev/2010-November/003680.html
BS	67
c61031	68	- Fix ``auth_tkt`` plugin to add "secure" and "HttpOnly" to cookies when
TS	69	configured with ``secure=True``: these attributes prevent the browser from
	70	sending cookies over insecure channels, which could be vulnerable to some
3b5782	71	XSS attacks.
d7e647	72
15e365	73	- Avoid propagating unicode 'max_age' value into cookie headers. See
TS	74	https://bugs.launchpad.net/bugs/674123 .
	75
e8080a	76	- Added a single-file example BFG application demonstrating the use of
TS	77	the new 'login' and 'logout' methods of the API object.
	78
924f24	79	- Add ``login`` and ``logout`` methods to the ``repoze.who.api.API`` object,
TS	80	as a convenience for application-driven login / logout code, which would
95f147	81	otherwise need to use private methods of the API, and reach down into
TS	82	its plugins.
f8ef81	83
9a8e60	84
2c742e	85	2.0a3 (2010-09-30)
eb7071	86	------------------
f80021	87
a446d6	88	- Deprecated the following plugins, moving their modules, tests, and docs
ff604c	89	to a new project, ``repoze.who.deprecatedplugins``:
a446d6	90
TS	91	- ``repoze.who.plugins.cookie.InsecureCookiePlugin``
	92
630a05	93	- ``repoze.who.plugins.form.FormPlugin``
a446d6	94
630a05	95	- ``repoze.who.plugins.form.RedirectingFormPlugin``
a446d6	96
TS	97	- Made the ``repoze.who.plugins.cookie.InsecureCookiePlugin`` take a
76e951	98	``charset`` argument, and use to to encode / decode login and password.
TS	99	See http://bugs.repoze.org/issue155
	100
a446d6	101	- Updated ``repoze.who.restrict`` to return headers as a list, to keep
TS	102	``wsgiref`` from complaining.
5b6365	103
a446d6	104	- Helped default request classifier cope with xml submissions with an
6b7b34	105	explicit charset defined: http://bugs.repoze.org/issue145 (Lorenzo
CM	106	M. Catucci)
	107
a446d6	108	- Corrected the handling of type and subtype when matching an XML post
6b7b34	109	to ``xmlpost`` in the default classifier, which, according to RFC
CM	110	2045, must be matched case-insensitively:
	111	http://bugs.repoze.org/issue145 (Lorenzo M. Catucci)
	112
a349a2	113	- Added ``repoze.who.config:make_api_factory_with_config``, a convenience
TS	114	method for applications which want to set up their own API Factory from
	115	a configuration file.
	116
f80021	117	- Fixed example call to ``repoze.who.config:make_middleware_with_config``
TS	118	(added missing ``global_config`` argument). See
	119	http://bugs.repoze.org/issue114
	120
f8ef81	121
c186ae	122	2.0a2 (2010-03-25)
TS	123	------------------
52bc23	124
TS	125	Bugs Fixed
	126	~~~~~~~~~~
	127
	128	- Fixed failure to pass substution values in log message string formatting
	129	for ``repoze.who.api:API.challenge``. Fix included adding tests for all
	130	logging done by the API object. See http://bugs.repoze.org/issue122
	131
	132	Backward Incompatibilities
	133	~~~~~~~~~~~~~~~~~~~~~~~~~~
	134
	135	- Adjusted logging level for some lower-level details from ``info``
	136	to ``debug``.
f8ef81	137
52bc23	138
TS	139
e25b84	140	2.0a1 (2010-02-24)
993216	141	------------------
TS	142
b4b8ee	143	Features
TS	144	~~~~~~~~
62cd25	145
c9c1c6	146	- Restored the ability to create the middleware using the old ``classifier``
TS	147	argument. That argument is now a deprecated-but-will-work-forever alias for
	148	``request_classifier``.
cbc983	149
b0f81f	150	- The ``auth_tkt`` plugin now implements the ``IAuthenticator`` interface,
TS	151	and should normally be used both as an ``IIdentifier`` and an
	152	``IAuthenticator``.
	153
993216	154	- Factored out the API of the middleware object to make it useful from
TS	155	within the application. Applications using ``repoze.who``` now fall into
	156	one of three catgeories:
	157
	158	- "middleware-only" applications are configured with middleware, and
	159	use either ``REMOTE_USER`` or ``repoze.who.identity`` from the environment
	160	to determing the authenticated user.
	161
	162	- "bare metal" applications use no ``repoze.who`` middleware at all:
	163	instead, they configure and an ``APIFactory`` object at startup, and
	164	use it to create an ``API`` object when needed on a per-request basis.
	165
	166	- "hybrid" applications are configured with ``repoze.who`` middleware,
	167	but use a new library function to fetch the ``API`` object from the
c9c1c6	168	environ, e.g. to permit calling ``remember`` after a signup or successful
TS	169	login.
993216	170
b4b8ee	171	Bugs Fixed
TS	172	~~~~~~~~~~
	173
	174	- Fix http://bugs.repoze.org/issue102: when no challengers existed,
	175	logging would cause an exception.
	176
	177	- Remove ``ez_setup.py`` and dependency on it in setup.py (support
	178	distribute).
	179
	180	Backward Incompatibilities
	181	~~~~~~~~~~~~~~~~~~~~~~~~~~
	182
b213af	183	- The middleware used to allow identifier plugins to "pre-authenticate"
TS	184	an identity. This feature is no longer supported: the ``auth_tkt``
	185	plugin, which used to use the feature, is now configured to work as
c9c1c6	186	an authenticator plugin (as well as an identifier).
b213af	187
b4b8ee	188	- The ``repoze.who.middleware:PluggableAuthenticationMiddleware`` class
TS	189	no longer has the following (non-API) methods (now made API methods
	190	of the ``repoze.who.api:API`` class):
	191
	192	- ``add_metadata``
	193	- ``authenticate``
	194	- ``challenge``
	195	- ``identify``
	196
	197	- The following (non-API) functions moved from ``repoze.who.middleware`` to
	198	``repoze.who.api``:
	199
	200	- ``make_registries``
	201	- ``match_classification``
	202	- ``verify``
	203
	204
f8ef81	205
060054	206	1.0.18 (2009-11-05)
TS	207	-------------------
798feb	208
TS	209	- Issue #104: AuthTkt plugin was passing an invalid cookie value in
	210	headers from ``forget``, and was not setting the ``Max-Age`` and
	211	``Expires`` attributes of those cookies.
	212
b4b8ee	213
f8ef81	214
6e136f	215	1.0.17 (2009-11-05)
TS	216	-------------------
e0d138	217
TS	218	- Fixed the ``repoze.who.plugins.form.make_plugin`` factory's ``formcallable``
	219	argument handling, to allow passing in a dotted name (e.g., from a config
	220	file).
	221
b4b8ee	222
f8ef81	223
6b15ee	224	1.0.16 (2009-11-04)
028e4d	225	-------------------
1ec83d	226
8dd881	227	- Exposed ``formcallable`` argument for ``repoze.who.plugins.form.FormPlugin``
TS	228	to the callers of the ``repoze.who.plugins.form.make_plugin`` factory.
	229	Thanks to Roland Hedburg for the report.
21a9c5	230
8dd881	231	- Fixed an issue that caused the following symptom when using the
TS	232	ini configuration parser::
	233
	234	TypeError: _makePlugin() got multiple values for keyword argument 'name'
21a9c5	235
CM	236	See http://bugs.repoze.org/issue92 for more details. Thanks to vaab
	237	for the bug report and initial fix.
	238
1ec83d	239
7141c7	240	1.0.15 (2009-06-25)
TS	241	-------------------
299b4c	242
a14163	243	- If the form post value ``max_age`` exists while in the ``identify``
CM	244	method is handling the ``login_handler_path``, pass the max_age
	245	value in the returned identity dictionary as ``max_age``. See the
	246	below bullet point for why.
	247
299b4c	248	- If the ``identity`` dict passed to the ``auth_tkt`` ``remember``
CM	249	method contains a ``max_age`` key with a string (or integer) value,
	250	treat it as a cue to set the ``Max-Age`` and ``Expires`` headers in
	251	the returned cookies. The cookie ``Max-Age`` is set to the value
	252	and the ``Expires`` is computed from the current time.
	253
7141c7	254
TS	255	1.0.14 (2009-06-17)
	256	-------------------
9318dd	257
1810b2	258	- Fix test breakage on Windows. See http://bugs.repoze.org/issue79 .
TS	259
00a6d9	260	- Documented issue with using ``include_ip`` setting in the ``auth_tkt``
TS	261	plugin. See http://bugs.repoze.org/issue81 .
	262
0dd808	263	- Added 'passthrough_challenge_decider', which avoids re-challenging 401
TS	264	responses which have been "pre-challenged" by the application.
	265
9318dd	266	- One-hundred percent unit test coverage.
TS	267
a6f6dc	268	- Add ``timeout`` and ``reissue_time`` arguments to the auth_tkt
CM	269	identifier plugin, courtesty of Paul Johnston.
	270
	271	- Add a ``userid_checker`` argument to the auth_tkt identifier plugin,
	272	courtesty of Gustavo Narea.
	273
	274	If ``userid_checker`` is provided, it must be a dotted Python name
	275	that resolves to a function which accepts a userid and returns a
	276	boolean True or False, indicating whether that user exists in a
	277	database. This is a workaround. Due to a design bug in repoze.who,
	278	the only way who can check for user existence is to use one or more
	279	IAuthenticator plugin ``authenticate`` methods. If an
	280	IAuthenticator's ``authenticate`` method returns true, it means that
	281	the user exists. However most IAuthenticator plugins expect both
	282	a username and a password, and will return False unconditionally if
	283	both aren't supplied. This means that an authenticator can't be
	284	used to check if the user "only" exists. The identity provided by
	285	an auth_tkt does not contain a password to check against. The
	286	actual design bug in repoze.who is this: when a user presents
	287	credentials from an auth_tkt, he is considered "preauthenticated".
	288	IAuthenticator.authenticate is just never called for a
	289	"preauthenticated" identity, which works fine, but it means that the
	290	user will be considered authenticated even if you deleted the user's
	291	record from whatever database you happen to be using. However, if
	292	you use a userid_checker, you can ensure that a user exists for the
	293	auth_tkt supplied userid. If the userid_checker returns False, the
	294	auth_tkt credentials are considered "no good".
	295
7141c7	296
TS	297	1.0.13 (2009-04-24)
	298	-------------------
64ba13	299
TS	300	- Added a paragraph to ``IAuthenticator`` docstring, documenting that plugins
	301	are allowed to add keys to the ``identity`` dictionary (e.g., to save a
ced7bd	302	second database query in an ``IMetadataProvider`` plugin).
64ba13	303
08b2ae	304	- Patch supplied for issue #71 (http://bugs.repoze.org/issue71)
CM	305	whereby a downstream app can return a generator, relying on an
	306	upstream component to call start_response. We do this because the
	307	challenge decider needs the status and headers to decide what to do.
	308
56d0c5	309
7141c7	310	1.0.12 (2009-04-19)
TS	311	-------------------
56d0c5	312	- auth_tkt plugin tried to append REMOTE_USER_TOKENS data to
CM	313	existing tokens data returned by auth_tkt.parse_tkt; this was
	314	incorrect; just overwrite.
0ee58d	315
TS	316	- Extended auth_tkt plugin factory to allow passing secret in a separate
	317	file from the main config file. See http://bugs.repoze.org/issue40 .
	318
7141c7	319
TS	320	1.0.11 (2009-04-10)
	321	-------------------
afbbcd	322
8c20ba	323	- Fix auth_tkt plugin; cookie values are now quoted, making it possible
CM	324	to put spaces and other whitespace, etc in usernames. (thanks to Michael
95736b	325	Pedersen).
8c20ba	326
afbbcd	327	- Fix corner case issue of an exception raised when attempting to log
CM	328	when there are no identifiers or authenticators.
	329
7141c7	330
TS	331	1.0.10 (2009-01-23)
	332	-------------------
7b931d	333
CM	334	- The RedirectingFormPlugin now passes along SetCookie headers set
	335	into the response by the application within the NotFound response
	336	(fixes TG2 "flash" issue).
	337
7141c7	338
TS	339	1.0.9 (2008-12-18)
	340	------------------
30ab69	341
9238cd	342	- The RedirectingFormPlugin now attempts to find a header named
CM	343	``X-Authentication-Failure-Reason`` among the response headers set
	344	by the application when a challenge is issued. If a value for this
	345	header exists (and is non-blank), the value is attached to the
	346	redirect URL's query string as the ``reason`` parameter (or a
	347	user-settable key). This makes it possible for downstream
	348	applications to issue a response that initiates a challenge with
	349	this header and subsequently display the reason in the login form
	350	rendered as a result of the challenge.
30ab69	351
7141c7	352
TS	353	1.0.8 (2008-12-13)
	354	------------------
186ff6	355
9238cd	356	- The ``PluggableAuthenticationMiddleware`` constructor accepts a
CM	357	``log_stream`` argument, which is typically a file. After this
	358	release, it can also be a PEP 333 ``Logger`` instance; if it is a
	359	PEP 333 ``Logger`` instance, this logger will be used as the
	360	repoze.who logger (instead of one being constructed by the
	361	middleware, as was previously always the case). When the
	362	``log_stream`` argument is a PEP 333 Logger object, the
	363	``log_level`` argument is ignored.
186ff6	364
7141c7	365
TS	366	1.0.7 (2008-08-28)
	367	------------------
37de44	368
9238cd	369	- ``repoze.who`` and ``repoze.who.plugins`` were not added to the
CM	370	``namespace_packages`` list in setup.py, potentially making 1.0.6 a
	371	brownbag release, given that making these packages namespace
	372	packages was the only reason for its release.
37de44	373
7141c7	374
TS	375	1.0.6 (2008-08-28)
	376	------------------
facdf8	377
9238cd	378	- Make repoze.who and repoze.who.plugins into namespace packages
CM	379	mainly so we can allow plugin authors to distribute packages in the
	380	repoze.who.plugins namespace.
facdf8	381
7141c7	382
TS	383	1.0.5 (2008-08-23)
	384	------------------
519300	385
9238cd	386	- Fix auth_tkt plugin to set the same cookies in its ``remember``
CM	387	method that it does in its ``forget`` method. Previously, logging
	388	out and relogging back in to a site that used auth_tkt identifier
	389	plugin was slightly dicey and would only work sometimes.
facdf8	390
9238cd	391	- The FormPlugin plugin has grown a redirect-on-unauthorized feature.
CM	392	Any response from a downstream application that causes a challenge
	393	and includes a Location header will cause a redirect to the value of
	394	the Location header.
dee08c	395
7141c7	396
TS	397	1.0.4 (2008-08-22)
	398	------------------
b95a59	399
9238cd	400	- Added a key to the '[general]' config section: ``remote_user_key``.
CM	401	If you use this key in the config file, it tells who to 1) not
	402	perform any authentication if it exists in the environment during
	403	ingress and 2) to set the key in the environment for the downstream
	404	app to use as the REMOTE_USER variable. The default is
	405	``REMOTE_USER``.
b95a59	406
9238cd	407	- Using unicode user ids in combination with the auth_tkt plugin would
CM	408	cause problems under mod_wsgi.
55dc7a	409
9238cd	410	- Allowed 'cookie_path' argument to InsecureCookiePlugin (and config
CM	411	constructor). Thanks to Gustavo Narea.
55dc7a	412
7141c7	413
TS	414	1.0.3 (2008-08-16)
	415	------------------
f693fe	416
9238cd	417	- A bug in the middleware's ``authenticate`` method made it impossible
CM	418	to authenticate a user with a userid that was null (e.g. 0, False),
	419	which are valid identifiers. The only invalid userid is now None.
c7e12d	420
9238cd	421	- Applied patch from Olaf Conradi which logs an error when an invalid
CM	422	filename is passed to the HTPasswdPlugin.
c7e12d	423
7141c7	424
TS	425	1.0.2 (2008-06-16)
	426	------------------
cad90d	427
9238cd	428	- Fix bug found by Chris Perkins: the auth_tkt plugin's "remember"
CM	429	method didn't handle userids which are Python "long" instances
	430	properly. Symptom: TypeError: cannot concatenate 'str' and 'long'
	431	objects in "paste.auth.auth_tkt".
a2c030	432
9238cd	433	- Added predicate-based "restriction" middleware support
CM	434	(repoze.who.restrict), allowing configuratio-driven authorization as
	435	a WSGI filter. One example predicate, 'authenticated_predicate', is
	436	supplied, which requires that the user be authenticated either via
	437	'REMOTE_USER' or via 'repoze.who.identity'. To use the filter to
	438	restrict access::
cad90d	439
TS	440	[filter:authenticated_only]
	441	use = egg:repoze.who#authenticated
	442
	443	or::
	444
	445	[filter:some_predicate]
	446	use = egg:repoze.who#predicate
	447	predicate = my.module:some_predicate
	448	some_option = a value
	449
7141c7	450
TS	451	1.0.1 (2008-05-24)
	452	------------------
8199a1	453
9238cd	454	- Remove dependency-link to dist.repoze.org to prevent easy_install
CM	455	from inserting that path into its search paths (the dependencies are
	456	available from PyPI).
8199a1	457
7141c7	458
TS	459	1.0 (2008-05-04)
	460	-----------------
419946	461
9238cd	462	- The plugin at plugins.form.FormPlugin didn't redirect properly after
CM	463	collecting identification information. Symptom: a downstream app
	464	would receive a POST request with a blank body, which would
	465	sometimes result in a Bad Request error.
f39349	466
9238cd	467	- Fixed interface declarations of
CM	468	'classifiers.default_request_classifier' and
	469	'classifiers.default_password_compare'.
515c69	470
9238cd	471	- Added actual config-driven middleware factory,
CM	472	'config.make_middleware_with_config'
515c69	473
9238cd	474	- Removed fossilized 'who_conf' argument from plugin factory functions.
515c69	475
7141c7	476	- Added ConfigParser-based WhoConfig, implementing the spec outlined at
9238cd	477	http://www.plope.com/static/misc/sphinxtest/intro.html#middleware-configuration-via-config-file,
CM	478	with the following changes:
419946	479
7141c7	480	- "Bare" plugins (requiring no configuration options) may be specified
419946	481	as either egg entry points (e.g., 'egg:distname#entry_point_name') or
TS	482	as dotted-path-with-colon (e.g., 'dotted.name:object_id').
	483
7141c7	484	- Therefore, the separator between a plugin and its classifier is now
TS	485	a semicolon, rather than a colon. E.g.::
419946	486
TS	487	[plugins:id_plugin]
	488	use = egg:another.package#identify_with_frobnatz
	489	frobnatz = baz
	490
	491	[identifiers]
	492	plugins =
	493	egg:my.egg#identify;browser
	494	dotted.name:identifier
	495	id_plugin
	496
7141c7	497
779caf	498	0.9.1 (2008-04-27)
7141c7	499	------------------
779caf	500
9238cd	501	- Fix auth_tkt plugin to be able to encode and decode integer user
CM	502	ids.
779caf	503
7141c7	504
88e646	505	0.9 (2008-04-01)
7141c7	506	----------------
88e646	507
9238cd	508	- Fix bug introduced in FormPlugin in 0.8 release (rememberer headers
CM	509	not set).
88e646	510
9238cd	511	- Add PATH_INFO to started and ended log info.
d9f046	512
9238cd	513	- Add a SQLMetadataProviderPlugin (in plugins/sql).
d9f046	514
9238cd	515	- Change constructor of SQLAuthenticatorPlugin: it now accepts only
CM	516	"query", "conn_factory", and "compare_fn". The old constructor
	517	accepted a DSN, but some database systems don't use DBAPI DSNs. The
	518	new constructor accepts no DSN; the conn_factory is assumed to do
	519	all the work to make a connection, including knowing the DSN if one
	520	is required. The "conn_factory" should return something that, when
	521	called with no arguments, returns a database connection.
d9f046	522
9238cd	523	- The "make_plugin" helper in plugins/sql has been renamed
CM	524	"make_authenticator_plugin". When called, this helper will return a
	525	SQLAuthenticatorPlugin. A bit of helper logic in the
	526	"make_authenticator_plugin" allows a connection factory to be
	527	computed. The top-level callable referred to by conn_factory in
	528	this helper should return a function that, when called with no
	529	arguments, returns a datbase connection. The top-level callable
	530	itself is called with "who_conf" (global who configuration) and any
	531	number of non-top-level keyword arguments as they are passed into
	532	the helper, to allow for a DSN or URL or whatever to be passed in.
d9f046	533
9238cd	534	- A "make_metatata_plugin" helper has been added to plugins/sql. When
CM	535	called, this will make a SQLMetadataProviderPlugin. See the
	536	implementation for details. It is similar to the
	537	"make_authenticator_plugin" helper.
d9f046	538
7141c7	539
cbe4e3	540	0.8 (2008-03-27)
7141c7	541	----------------
b5a331	542
9238cd	543	- Add a RedirectingFormIdentifier plugin. This plugin is willing to
CM	544	redirect to an external (or downstream application) login form to
	545	perform identification. The external login form must post to the
	546	"login_handler_path" of the plugin (optimally with a "came_from"
	547	value to tell the plugin where to redirect the response to if the
	548	authentication works properly). The "logout_handler_path" of this
	549	plugin can be visited to perform a logout. The "came_from" value
	550	also works there.
a400b0	551
9238cd	552	- Identifier plugins are now permitted to set a key in the environment
CM	553	named 'repoze.who.application' on ingress (in 'identify'). If an
	554	identifier plugin does so, this application is used instead of the
	555	"normal" downstream application. This feature was added to more
	556	simply support the redirecting form identifier plugin.
a400b0	557
7141c7	558
a400b0	559	0.7 (2008-03-26)
7141c7	560	----------------
a400b0	561
9238cd	562	- Change the IMetadataProvider interface: this interface used to have
CM	563	a "metadata" method which returned a dictionary. This method is not
	564	part of that API anymore. It's been replaced with an "add_metadata"
	565	method which has the signature::
b5a331	566
CM	567	def add_metadata(environ, identity):
	568	"""
	569	Add metadata to the identity (which is a dictionary)
	570	"""
	571
	572	The return value is ignored. IMetadataProvider plugins are now
	573	assumed to be responsible for 'scribbling' directly on the identity
	574	that is passed in (it's a dictionary). The user id can always be
	575	retrieved from the identity via identity['repoze.who.userid'] for
	576	metadata plugins that rely on that value.
	577
7141c7	578
a400b0	579	0.6 (2008-03-20)
7141c7	580	----------------
e35c64	581
9238cd	582	- Renaming: repoze.pam is now repoze.who
cb5426	583
9238cd	584	- Bump ez_setup.py version.
e35c64	585
9238cd	586	- Add IMetadataProvider plugin type. Chris says 'Whit rules'.
fa9581	587
7141c7	588
3b67e9	589	0.5 (2008-03-09)
7141c7	590	----------------
db4cf5	591
9238cd	592	- Allow "remote user key" (default: REMOTE_USER) to be overridden
CM	593	(pass in remote_user_key to middleware constructor).
db4cf5	594
9238cd	595	- Allow form plugin to override the default form.
db4cf5	596
9238cd	597	- API change: IIdentifiers are no longer required to put both 'login'
CM	598	and 'password' in a returned identity dictionary. Instead, an
	599	IIdentifier can place arbitrary key/value pairs in the identity
	600	dictionary (or return an empty dictionary).
40a968	601
9238cd	602	- API return value change: the "failure" identity which IIdentifiers
CM	603	return is now None rather than an empty dictionary.
40a968	604
9238cd	605	- The IAuthenticator interface now specifies that IAuthenticators must
CM	606	not raise an exception when evaluating an identity that does not
	607	have "expected" key/value pairs (e.g. when an IAuthenticator that
	608	expects login and password inspects an identity returned by an
	609	IP-based auth system which only puts the IP address in the
	610	identity); instead they fail gracefully by returning None.
40a968	611
9238cd	612	- Add (cookie) "auth_tkt" identification plugin.
a5b033	613
9238cd	614	- Stamp identity dictionaries with a userid by placing a key named
CM	615	'repoze.pam.userid' into the identity for each authenticated
	616	identity.
a5b033	617
9238cd	618	- If an IIdentifier plugin inserts a 'repoze.pam.userid' key into the
CM	619	identity dictionary, consider this identity "preauthenticated". No
	620	authenticator plugins will be asked to authenticate this identity.
	621	This is designed for things like the recently added auth_tkt plugin,
	622	which embeds the user id into the ticket. This effectively alllows
	623	an IIdentifier plugin to become an IAuthenticator plugin when
	624	breaking apart the responsibility into two separate plugins is
	625	"make-work". Preauthenticated identities will be selected first
	626	when deciding which identity to use for any given request.
a5b033	627
9238cd	628	- Insert a 'repoze.pam.identity' key into the WSGI environment on
CM	629	ingress if an identity is found. Its value will be the identity
	630	dictionary related to the identity selected by repoze.pam on
	631	ingress. Downstream consumers are allowed to mutate this
	632	dictionary; this value is passed to "remember" and "forget", so its
	633	main use is to do a "credentials reset"; e.g. a user has changed his
	634	username or password within the application, but we don't want to
	635	force him to log in again after he does so.
a5b033	636
7141c7	637
247f34	638	0.4 (03-07-2008)
7141c7	639	----------------
247f34	640
9238cd	641	- Allow plugins to specify a classifiers list per interface (instead
CM	642	of a single classifiers list per plugin).
247f34	643
7141c7	644
fb510d	645	0.3 (03-05-2008)
7141c7	646	----------------
fb510d	647
9238cd	648	- Make SQLAuthenticatorPlugin's default_password_compare use hexdigest
CM	649	sha instead of base64'ed binary sha for simpler conversion.
fb510d	650
7141c7	651
196bc2	652	0.2 (03-04-2008)
7141c7	653	----------------
196bc2	654
9238cd	655	- Added SQLAuthenticatorPlugin (see plugins/sql.py).
196bc2	656
7141c7	657
318832	658	0.1 (02-27-2008)
7141c7	659	----------------
318832	660
9238cd	661	- Initial release (no configuration file support yet).