Commit graph

360 commits

Author SHA1 Message Date
cdb4a60e3c
Django 5.0 compatibility: UTC timezone import
Added a try-except block to handle ImportError for Django's timezone.utc in migrations. This ensures compatibility with versions of Django where utc is not available directly under django.utils.timezone and uses datetime.timezone.utc as a fallback. This change maintains forward compatibility and avoids migration errors in different Django environments.
2023-12-19 20:01:14 +01:00
35c5f1962a
Version bump 2022-11-27 16:44:38 +00:00
ad4dc369f1
URLs 2022-11-27 16:39:32 +00:00
99e25fd93c
Signals! 2022-11-27 16:37:17 +00:00
3fed609a8e
Fix ugettext import 2022-11-27 16:31:32 +00:00
e2eeae5cef
Fix ugettext import 2022-11-27 16:30:33 +00:00
Juan Ignacio Fiorentino
f0daed07b2 Merge branch 'develop' of https://github.com/juanifioren/django-oidc-provider 2018-10-17 19:21:43 -03:00
Juan Ignacio Fiorentino
20282904e2 Merge branch 'master' of https://github.com/juanifioren/django-oidc-provider 2018-10-17 19:13:44 -03:00
Juan Ignacio Fiorentino
4d0c12286a Bump version v0.7.0. 2018-10-17 19:09:56 -03:00
Christian Bouvier
32302f066b Added newline at new file version.py 2018-10-15 08:44:40 -03:00
Christian Bouvier
d21d8c29b0 Make version available in code (#282)
It seems like there are multi ways to achieve that, all of them highliting
the importance of maintain a single source of truth for the version number.

More info: https://packaging.python.org/guides/single-sourcing-package-version/.

This PR includes one possible approach, open to discussion.
2018-10-14 15:02:58 -03:00
Christian Bouvier
4c63cc67e0 Enhancement: Increment RSA key size to 2048.
It seems like many lead institutions related with security are
recommending a minimum key length of 112-bits since 2013.
In order to achieve that, a RSA key size of 2048 (or more) is required.
2018-10-05 11:55:35 -03:00
Christian Bouvier
eb2f272a0b Enhancement: AuthorizeView's static method strip-prompt-login was moved to a new file oidc_provider/lib/utils/authorize.py in order to be more consistent with the implementation of other Views 2018-10-04 10:40:23 -03:00
Juan Ignacio Fiorentino
1a0f068f2e
Merge pull request #289 from octobot-dev/fix-strip-prompt-login
Fix #283: bug in strip_prompt_login
2018-10-03 16:19:54 -03:00
Christian Bouvier
37e6df8306 Fix #283: bug in strip_prompt_login
AuthorizeView's static method strip_prompt_login fails to remove prompt login when other prompt values appear in the request.
2018-10-03 14:51:51 -03:00
Juan Ignacio Fiorentino
76f6348142
Merge pull request #288 from impak-finance/issue-285
Fixed #285 -- Ensured standard and custom claims can be used at the same time when using the OIDC_IDTOKEN_INCLUDE_CLAIMS setting
2018-09-29 13:32:11 -03:00
Juan Ignacio Fiorentino
64e395c5b6
Revert "Fixed #285 -- Ensured standard and custom claims can be used at the same time when using the OIDC_IDTOKEN_INCLUDE_CLAIMS setting" 2018-09-29 13:27:07 -03:00
Morgan Aubert
88aa190763
Fixed #285 -- Ensured standard and custom claims can be used at the same time when using the OIDC_IDTOKEN_INCLUDE_CLAIMS setting 2018-09-28 19:36:21 -04:00
Juan Ignacio Fiorentino
6997e19687
Merge pull request #260 from dcollinsn/django-2.1
Django 2.1
2018-09-14 16:34:15 -03:00
Juan Ignacio Fiorentino
458eb2e3ea
Merge pull request #279 from ByteInternet/make_authorization_endpoint_and_client_more_easily_adjustable
Make it easier to change AuthorizeEndpoint and Client
2018-09-14 10:10:12 -03:00
Juan Ignacio Fiorentino
db0acf3107
Merge pull request #277 from isms/fix-typo
Add missing space
2018-09-14 10:06:41 -03:00
Bono de Visser
69b793a363 Make it easier to change AuthorizeEndpoint and Client
To make it easier to change the AuthorizeEndpoint and Client we set them as class variables. Then people inheriting from the view are able to easily change them. In my personal case this helps with skipping consent more explicitly as defined in issue https://github.com/juanifioren/django-oidc-provider/issues/278
2018-09-14 11:21:57 +02:00
Isaac Slavitt
e36a2c96f8 Add missing space 2018-09-13 15:58:42 -04:00
Andy Clayton
4e7116ca9e add natural key support to ResponseType
Have the option to use the more readable response type value rather than
the ResponseType id integer in fixtures and dumpdata output.

Prior to this change dumpdata represents response types like so:

    "response_types": [2]

And after this change when using `dumpdata --natural-foreign`:

    "response_types": [["code"]]
2018-08-20 10:49:00 -05:00
Andy Clayton
64a8b935e6 document response_type_descriptions needs to be a list 2018-08-16 15:47:47 -05:00
Andy Clayton
036c4fc9b3 document non-obvious string check 2018-08-16 15:47:14 -05:00
Andy Clayton
36018d19ae support multiple response types per client
The Dynamic Client Registration spec specifies multiple response_types
and grant_types per client
(https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata).
Since grant_types can be inferred from response_types we should be able
to support both without needing to store grant_types.

This also helps with oidc-client-js which expects a client that supports
both "id_token" and "id_token token".
2018-08-16 11:38:46 -05:00
Andy Clayton
f1ed3328f8 Accept lowercase "bearer" in Authorization header
We ran into a client that blindly takes the value of token_type, which
is lowercase "bearer", and passes that back in the Authorization header.
In an earlier PR #99 there seemed to be some support for this change to
simply accept "bearer" in addition to "Bearer".
2018-08-02 13:42:21 -05:00
Dan Collins
972071e370 Add support for Django 2.1, drop support for Django < 1.11
Django 1.11 deprecated the django.contrib.auth.views.logout
function-based view, which django-oidc-provider relied on. This
patchset instead subclasses the new LogoutView.

LogoutView was introduced in Django 1.11. logout() was deprecated in
1.11 and removed in 2.1. Accordingly, this patch adds Django 2.1 to
CI and removes 1.8, 1.9, and 1.10.

Resolves #258
2018-08-01 14:13:11 -04:00
Juan Ignacio Fiorentino
bf7f380033 Fix scopeclaims class. 2018-07-26 23:12:45 -03:00
Juan Ignacio Fiorentino
59581f50d9
Merge pull request #256 from q3aiml/client-credentials-introspection
support introspection on client credentials tokens
2018-07-19 11:18:35 -03:00
Andy Clayton
9d5c2b39fa support introspection on client credentials tokens
The response can simply omit fields that require id_token as the only
required field is "active" according to RFC 7662. I think it would be
nice for introspection of client credentials tokens to be supported by
default without needing to override
OIDC_INTROSPECTION_VALIDATE_AUDIENCE_SCOPE, but this is a start.
2018-07-06 11:41:09 -05:00
Juan Ignacio Fiorentino
d825061508 Fix: Token Model crashes in Django Admin when a token has been given to a Client using Client Credentials. 2018-07-05 18:37:01 -03:00
Andy Clayton
b1e994aa7e Fix token introspection "aud" and "client_id" response
Based on the OAuth 2.0 Token Introspection spec the "aud" field should
be based on the token. Previously "aud" was populated with the id of the
client making the introspection request which seems wrong. This changes
the endpoint to return the value from the token.

The "client_id" field is then changed to return the client id for the
client that originally requested the token rather than returning the
"aud" value from the token.

From the spec https://tools.ietf.org/html/rfc7662:

   client_id
      OPTIONAL.  Client identifier for the OAuth 2.0 client that
      requested this token.

   aud
      OPTIONAL.  Service-specific string identifier or list of string
      identifiers representing the intended audience for this token, as
      defined in JWT [RFC7519].
2018-07-04 09:53:30 -05:00
Andy Clayton
6900e637ab add OIDC_INTROSPECTION_VALIDATE_AUDIENCE_SCOPE test
Missing test exposed as part of 0750429 bug fix.
2018-07-03 15:15:12 -05:00
Andy Clayton
0750429992 fix settings to support falsy valued overrides
Up until recently there were settings with truthy defaults but with no
need to be set to a false value. That changed with
OIDC_INTROSPECTION_VALIDATE_AUDIENCE_SCOPE. Now there is a setting that
has both a true default and a meaningful false value, and without this
fix that setting cannot be changed making it not much of a setting at
all.
2018-07-03 13:17:10 -05:00
Juan Ignacio Fiorentino
055a007cda
Merge pull request #251 from q3aiml/userinfo-cors-preflight
example fix for userinfo CORS preflight request
2018-07-02 14:20:21 -03:00
Andy Clayton
0adb95d25f example fix for userinfo CORS preflight request
Example for
https://github.com/juanifioren/django-oidc-provider/issues/249. If this
approach seems acceptable I can add/update tests.
2018-06-19 15:59:28 -05:00
Juan Ignacio Fiorentino
2ed0d21f12
Merge branch 'develop' into patch-1 2018-06-04 10:54:55 -03:00
Alexander Klimenko
76c169e73e
fix little docstring typo 2018-06-04 10:56:31 +03:00
Tuomas Suutari
c95497dbd9 Remove scope param from OIDC_IDTOKEN_PROCESSING_HOOK
There is no need to pass in the scope parameter separately, since the
scope is available via the token parameter already.
2018-05-31 10:23:58 +03:00
Tuomas Suutari
b0a82aa4ab Pass token and request to OIDC_ID_TOKEN_PROCESSING_HOOK
The ID token processing hook might need the token or request too, so
make them available.
2018-05-24 09:31:05 +03:00
Tuomas Suutari
93420461b4 Merge branch 'develop' of github.com:juanifioren/django-oidc-provider
* 'develop' of github.com:juanifioren/django-oidc-provider:
  Update changelog.rst
  include request in password grant authenticate call
  Update setup.py
  Update changelog.rst
  Update changelog.rst
  Adjust import order and method order in introspection tests
  Replace resource with client in docs.
  Update settings docs to add extra introspection setting
  Update README.md
  Update README.md
  Remove the Resource model
  Skip csrf protection on introspection endpoint
  Add token introspection endpoint to satisfy https://tools.ietf.org/html/rfc7662
  Test docs with tox.
  Remove Django 1.7 for travis.
  Drop support for Django 1.7.
  Move extract_client_auth to oauth2 utils.
  Remove duplicate link in docs.
  Bump version v0.6.0.
  Fix BaseCodeTokenModel and user attr.
  Update README.md
  Edit README and contribute doc.
  Edit changelog.
  Update changelog.rst
  Add protected_resource_view test using client_credentials.
  Fix docs.
  Improve docs.
  Client credentials implementation.
  Move changelog into docs.
  Update README.md
  Update CHANGELOG.md
  Fixed infinite callback loop in check-session iframe
  Fix PEP8. New migration.
  Update example project.
  Fix PEP8.
  Fix PEP8.
  PEP8 errors and urls.
  PEP8 models.
  Fix contribute docs.
  Fix tox for checking PEP8 all files.
  Update README.md
  Update README.md
  Simplify test suit.
  Update CHANGELOG.md
  Bump version 0.5.3.
  Update installation.rst
  Update CHANGELOG.md
  Fixed wrong Object in Template
  Update project to support Django 2.0
  Now passing along the token to create_id_token function.
  Made token and token_refresh endpoint return requested claims.
  Sphinx documentation fixes (#219)
  Use request.user.is_authenticated as a bool with recent Django (#216)
  Fixed client id retrieval when aud is a list of str. (#210)
  Add owner field to Client (#211)
  Update CHANGELOG
  removed tab char
  Add pep8 compliance and checker
  Bump version
  Update CHANGELOG.md
  Preparing v0.5.2 (#201)
  Fix Django 2.0 deprecation warnings (#185)
  Fix infinite login loop if "prompt=login" (#198)
  fixed typos
  Bump version
  Fix scope handling of token endpoint (#193)
  Fixes #192
  Use stored user consent for public clients too (#189)
  Redirect URIs must match exactly. (#191)
  Bug #187 prompt handling (#188)
  Don't pin exact versions in install_requires.
2018-05-24 00:16:26 +03:00
Andy Clayton
713d15297c include request in password grant authenticate call
An an example this can be used to help implement measures against brute
force attacks and to alert on or mitigate other untrusted authentication
attempts.
2018-05-12 09:18:56 -05:00
Maxim Daniline
eed58197bd Adjust import order and method order in introspection tests 2018-04-26 10:12:52 +01:00
Maxim Daniline
8eeaf5cf33 Remove the Resource model 2018-04-23 14:59:56 +01:00
Maxim Daniline
00f3efa158 Skip csrf protection on introspection endpoint 2018-04-23 10:47:01 +01:00
Maxim Daniline
180aad9a36 Add token introspection endpoint to satisfy https://tools.ietf.org/html/rfc7662 2018-04-23 10:47:01 +01:00
Juan Ignacio Fiorentino
21a64b262c Move extract_client_auth to oauth2 utils. 2018-04-20 12:00:38 -03:00
Juan Ignacio Fiorentino
776f040624 Fix BaseCodeTokenModel and user attr. 2018-04-13 16:36:51 -03:00