Commit graph

829 commits

Author SHA1 Message Date
Juan Ignacio Fiorentino
c8fd9a72fb :Merge branch 'v0.5.x' of https://github.com/juanifioren/django-oidc-provider into v0.5.x 2018-03-22 11:46:24 -03:00
Juan Ignacio Fiorentino
d519e49acb Simplify test suit. 2018-03-22 11:45:56 -03:00
Juan Ignacio Fiorentino
baee747c0d
Update CHANGELOG.md 2018-03-09 17:05:22 -03:00
Juan Ignacio Fiorentino
b32fa6c17c Bump version 0.5.3. 2018-03-09 17:03:25 -03:00
Juan Ignacio Fiorentino
4f0afe27d3
Update installation.rst 2018-02-19 23:43:26 -03:00
Juan Ignacio Fiorentino
72388bb117
Update CHANGELOG.md 2018-02-19 23:41:38 -03:00
Juan Ignacio Fiorentino
33dc30ab0e
Merge pull request #229 from olist/v0.5.x
Update project to support Django 2.0
2018-02-19 23:40:06 -03:00
Juan Ignacio Fiorentino
0e50f82087
Merge pull request #233 from YannikG/patch-1
Fixed wrong Object in Template
2018-02-19 23:36:41 -03:00
Yannik Gartmann
baa53d0c88
Fixed wrong Object in Template
See >> https://github.com/juanifioren/django-oidc-provider/blob/v0.5.x/oidc_provider/views.py#L129
2018-02-19 16:31:30 +01:00
Allisson Azevedo
795ac32257 Update project to support Django 2.0 2018-02-01 14:00:57 -03:00
Wojciech Bartosiak
f052f694c9 Bump version 2017-08-22 17:36:54 +02:00
Wojciech Bartosiak
0e4ba169df Update CHANGELOG.md 2017-08-22 17:36:18 +02:00
Wojciech Bartosiak
8e26248022 Preparing v0.5.2 (#201)
* Fix infinite login loop if "prompt=login" (#198)
* Fix Django 2.0 deprecation warnings (#185)
2017-08-22 17:33:13 +02:00
Wojciech Bartosiak
2e1efc41ed fixed typos 2017-07-11 16:44:24 +02:00
Juan Ignacio Fiorentino
faf64e4e38 Merge pull request #196 from wojtek-fliposports/v0.5.x
Added changedlog and bump version
2017-07-11 10:18:43 -03:00
Wojciech Bartosiak
7407e2c5b0 Bump version 2017-07-11 07:35:52 +02:00
Wojciech Bartosiak
45717a82f2 Merge pull request #4 from juanifioren/v0.5.x
Fetch latest changes
2017-07-11 07:35:08 +02:00
Juan Ignacio Fiorentino
34fe4f2728 Merge pull request #195 from juanifioren/develop
prepare 0.5.1 version
2017-07-10 17:04:58 -03:00
Tuomas Suutari
ea340993b1 Fix scope handling of token endpoint (#193)
The token endpoint handled the scope parameter incorrectly for all of
the three handled grant types:

 1. For "authorization_code" grant type the scope parameter in the token
    request should not be respected but the scope should be taken from
    the authorization code.  It was not totally ignored, but rather the
    scope parameter of the token request was used for the generated ID
    token.  This had two consequences:

      * Spec conforming implementations of authorization code flow
        didn't get correct ID tokens, since they usually don't pass
        scope parameter with the token request.

      * It's possible to get a broader scope for the ID token than what
        is authorized by the user in the original authorization code
        request.

 2. For "refresh_token" grant type the scope parameter in the token
    request should only allow narrowing down the scope.  It wasn't
    narrowed, but rather the original auth code scope was used for the
    access token and the passed in scope parameter was used for the ID
    token (again allowing unauthorized scopes in the ID token).

 3. For "password" grant type the scope parameter in the token request
    should be respected.  The problem with this was that it wasn't
    properly splitted when passed to ID token creation.

Fixes #186
2017-07-10 17:48:12 +02:00
Wojciech Bartosiak
eed581399e Fixes #192 2017-07-07 17:47:11 +02:00
Tuomas Suutari
5165312d01 Use stored user consent for public clients too (#189)
When using Implicit Flow, it should be OK to use the stored user consent
even if the client is public.  The redirect uri checks should make sure
that the stored consent of another client cannot be misused to get a
consent to a site that is not related to the client.

It is also important to support this, since public clients using
Implicit Flow do not have a refresh token to update their access tokens,
so only way to keep their login session open is by issuing authorization
requests from an iframe with the "prompt=none" parameter (which does not
work without the previously stored consent).  See the following links
for more info and examples on how to renew the access token with SPAs:

https://auth0.com/docs/api-auth/tutorials/silent-authentication#refresh-expired-tokens

https://damienbod.com/2017/06/02/

https://github.com/IdentityServer/IdentityServer3/issues/719#issuecomment-230145034
2017-07-07 13:18:36 +02:00
Jan Brauer
1215c27d7e Redirect URIs must match exactly. (#191)
* Test redirect_uri construction

This was a test marked as TODO.

* Remove duplicate test

* Add tests to exactly match redirect URIs

* Redirect URIs must match exactly.

To quote from the specification at
http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest:

Redirection URI to which the response will be sent. This URI MUST
exactly match one of the Redirection URI values for the Client
pre-registered at the OpenID Provider, with the matching performed as
described in Section 6.2.1 of [RFC3986] (Simple String Comparison).
2017-07-07 09:07:21 +02:00
Wojciech Bartosiak
f07327a713 Bug #187 prompt handling (#188)
prompt parameter changed to list of strings not a simple string
2017-06-06 11:12:37 +02:00
Wojciech Bartosiak
f3dac75f74 Merge pull request #1 from juanifioren/v0.5.x
Merge v0.5.x
2017-06-05 14:53:09 +02:00
Juan Ignacio Fiorentino
127bf8045d Merge pull request #176 from qedsoftware/develop
Don't pin exact versions in install_requires.
2017-05-18 23:57:10 -03:00
Ignacio Fiorentino
1397439b09 Bump version v0.5.1. 2017-05-18 23:49:06 -03:00
Wojciech Bartosiak
fd7bbab96d Bump version 0.5.1 2017-05-09 00:40:24 +02:00
Wojciech Bartosiak
4d00144ca0 Adding python 3.6 and Django 1.11
Adding python 3.6 and Django 1.11
2017-05-09 00:38:42 +02:00
Wojciech Bartosiak
2efd38cb64 Merge pull request #183 from wojtek-fliposports/feature-django-and-python-upgrade
Feature django 1.11 and python 3.6 upgrade
2017-05-08 18:20:26 +02:00
Wojciech Bartosiak
3cc211a2c9 Merge pull request #182 from juanifioren/revert-180-feature-django-and-python-upgrade
reverted wrong commit
2017-05-08 18:18:42 +02:00
Wojciech Bartosiak
8c55cf0cb6 Revert "added TOX for Django 1.11 and Python 3.6 (#180)"
This reverts commit 2bb4229cfe.
2017-05-08 17:59:03 +02:00
Wojciech Bartosiak
2bb4229cfe added TOX for Django 1.11 and Python 3.6 (#180)
* added TOX for Django 1.11 and PYthon 3.6

* added python 3.6 and django 1.11
2017-05-08 17:54:50 +02:00
Wojciech Bartosiak
2e36d2a161 added python 3.6 and django 1.11 2017-05-08 16:25:44 +02:00
Wojciech Bartosiak
baad8246c7 added TOX for Django 1.11 and PYthon 3.6 2017-05-05 05:43:39 +02:00
Wojciech Bartosiak
a829726be8 Merge develop to v0.5.x (#179)
* Log create_uri_response exceptions to logger.exception

* Support grant type password - basics

* Add tests for Resource Owner Password Credentials Flow

* Password Grant -Response according to specification

* Better tests for errors, disable grant type password by default

* Add documentation for grant type password

* User authentication failure to return 403

* Add id_token to response

* skipping consent only works for confidential clients

* fix URI fragment

example not working URL `http://localhost:8100/#/auth/callback/`

* OIDC_POST_END_SESSION_HOOK + tests

* Explicit function naming

* Remove print statements

* No need for semicolons, this is Python

* Update CHANGELOG.md

* fixed logger message

* Improved `exp` value calculation

* rename OIDC_POST_END_SESSION_HOOK to OIDC_AFTER_END_SESSION_HOOK

* added docs for OIDC_AFTER_END_SESSION_HOOK

*  Replaces `LOGIN_URL` with `OIDC_LOGIN_URL`
so users can use a different login path for their oidc requests.

* Adds a setting variable for custom template paths

* Updates documentation

* Fixed bad try/except/finally block

* Adds test for OIDC_TEMPLATES settings

* Determine value for op_browser_state from session_key or default

* Do not use cookie for browser_state. It may not yet be there

* Add docs on new setting

OIDC_UNAUTHENTICATED_SESSION_MANAGEMENT_KEY

* Fix compatibility for older versions of Django

* solved merging typo for missing @property
2017-05-05 05:19:57 +02:00
Wojciech Bartosiak
38ee8f15fd solved merging typo for missing @property 2017-05-05 05:10:38 +02:00
Wojciech Bartosiak
101130e47a Merge branch 'v0.5.x' into develop 2017-05-05 04:57:21 +02:00
Franciszek Piszcz
ba7a4fbb96 Don't pin exact versions in install_requires.
According to this: https://packaging.python.org/requirements/#install-requires-vs-requirements-files , dependencies should not be pinned to exact versions.
2017-04-23 15:27:59 +02:00
Wojciech Bartosiak
0559648b4a Merge pull request #173 from gertjanol/bugfix-keyerror-on-cookie
Use value from setting to determine browser state
2017-04-18 15:43:50 +02:00
Gertjan Oude Lohuis
26b2efe361 Fix compatibility for older versions of Django 2017-04-18 14:24:43 +02:00
Gertjan Oude Lohuis
35532634fa Add docs on new setting
OIDC_UNAUTHENTICATED_SESSION_MANAGEMENT_KEY
2017-04-18 14:24:43 +02:00
Gertjan Oude Lohuis
542479a227 Do not use cookie for browser_state. It may not yet be there 2017-04-18 14:24:43 +02:00
Gertjan Oude Lohuis
62a0a48678 Determine value for op_browser_state from session_key or default 2017-04-18 14:24:37 +02:00
Wojciech Bartosiak
e7947e2738 Merge pull request #163 from ka7eh/feature-skip-consent-per-client
Adds per-client consent customization
2017-04-12 10:25:53 +02:00
Wojciech Bartosiak
748a8bdfb8 Merge pull request #167 from ka7eh/feature-templates-in-settings
Adds OIDC_TEMPLATES to settings
2017-04-12 10:20:36 +02:00
kaveh
e090db2d6c Adds test for OIDC_TEMPLATES settings 2017-04-11 15:20:37 -07:00
kaveh
b164388e15 Adds per-client consent customization 2017-04-11 13:16:06 -07:00
Wojciech Bartosiak
8e8d41bf43 Merge pull request #166 from ka7eh/feature-separate-login-url
Replaces `LOGIN_URL` with `OIDC_LOGIN_URL`
2017-04-09 15:02:36 +02:00
kaveh
959c7a0929 Fixed bad try/except/finally block 2017-04-07 16:59:40 -07:00
kaveh
cca8c81c67 Updates documentation 2017-04-07 16:54:31 -07:00