Commit 902dd103 authored by Valentin Samir's avatar Valentin Samir Committed by GitHub

Merge pull request #12 from nitmir/dev

Update version to 0.7.0
parents 282e3a83 5b2795ae
Change Log
##########
All notable changes to this project will be documented in this file.
.. contents:: Table of Contents
:depth: 2
v0.7.0 - 2016-08-24
===================
Added
-----
* Add a CHANGELOG.rst file.
* Add a validator to models CharField that should be regular expressions checking that user input
are valids regular expressions.
* Add a CAS_INFO_MESSAGES and CAS_INFO_MESSAGES_ORDER settings allowing to display messages in
info-boxes on the html pages of the default templates.
Changed
-------
* Allow the user defined CAS_COMPONENT_URLS to omit not changed values.
* replace code-block without language indication by literal blocks.
* Update french translation
Fixed
-----
* Some README.rst typos.
* some english typos
v0.6.4 - 2016-08-14
===================
commit: 282e3a831b3c0b0818881c2f16d056850d572b89
Added
-----
* Add a forgotten migration (only change help_text)
v0.6.3 - 2016-08-14
===================
commit: 07a537b403c5c5e39a4ddd084f90e3a4de88a54e
Added
-----
* Add powered by footer
* Add a github version badge
* documents templatetags
Changed
-------
* Usage of the documented API for models _meta in auth.DjangoAuthUser
* set warn cookie using javascript if possible
* Unfold many to many attributes in auth.DjangoAuthUser attributes
Fixed
-----
* typos in README.rst
* w3c validation
Cleaned
-------
* Code factorisation (models.py, views.py)
v0.6.2 - 2016-08-02
===================
commit: 773707e6c3c3fa20f697c946e31cafc591e8fee8
Added
-----
* Support authentication renewal in federate mode
* Add new version email and info box then new version is available
* Add SqlAuthUser and LdapAuthUser auth classes.
Deprecate the usage of MysqlAuthUser in favor of SqlAuthUser.
* Add pytest-warning to tests
* Add a checkbox to forget the identity provider if we checked "remember the identity provider"
* Add dependancies correspondance between python pypi, debian and centos packages in README
Changed
-------
* Move coverage computation last in travis
* Enable logging to stderr then running tests
* Remember "warn me before…" using a cookie
* Put favicon (shortcut icon) URL in settings
Deprecated
----------
* The auth class MysqlAuthUser is deprecated in favor of the SqlAuthUser class.
Fixed
-----
* Use custom templatetags instead settings custom attributes to Boundfields
(As it do not work with django 1.7)
* Display an error message on bad response from identity provider in federate mode
instead of crashing. (e.g. Bad XML document)
* Catch base64 decode error on b64decode to raise our custom exception BadHash
* Add secret as sensitive variables/post parameter for /auth
* Only set "remember my provider" in federated mode upon successful authentication
* Since we drop django-boostrap3 dependancies, Django default minimal version is 1.7.1
* [cas.py] Append renew=true when validating tickets
Cleaned
-------
* code factorization (cas.py, forms.py)
v0.6.1 - 2016-07-27
===================
commit: b168e0a6423c53de31aae6c444fa1d1c5083afa6
Added
-----
* Add sphinx docs + autodoc
* Add the possibility to run tests with "setup.py test"
* Include docs, Makefile, coverage config and tests config to source package
* Add serviceValidate ProxyTicket tests
* Add python 3.5 tox/travis tests
Changed
-------
* Use https://badges.genua.fr for badges
Fixed
-----
* Keep LoginTicket list upon fail authentication
(It prevent the next login attemps to fail because of bad LT)
Cleaned
-------
* Compact federated mode migration
* Reformat default_settings.py for documentation using sphinx autodoc
* Factorize some code (from views.py to Ticket models class methods)
* Update urlpattern for django 1.10
* Drop dependancies django-picklefield and django-bootstrap3
v0.6.0 - 2016-07-06
===================
commit: 4ad4d13baa4236c5cd72cc5216d7ff08dd361476
Added
-----
* Add a section describing service patterns options to README.rst
* Add a federation mode:
When the settings CAS_FEDERATE is True, django-cas-server will offer to the user to choose its
CAS backend to authenticate. Hence the login page do not display anymore a username/password form
but a select form with configured CASs backend.
This allow to give access to CAS supported applications to users from multiple organization
seamlessly.
It was originally developped to mach the need of https://ares.fr (Federated CAS at
https://cas.ares.fr, example of an application using it as https://chat.myares.fr)
Fixed
-----
* Then a ticket was marked as obtained with the user entering its credentials (aka not by SSO), and
the service did not require it, ticket validation was failing. Now, if the service do not require
authentication to be renewed, both ticket with renewed authentication and non renewed
authentication validate successfully.
v0.5.0 - 2016-07-01
===================
commit: e3ab64271b718a17e4cbbbabda0a2453107a83df
Added
-----
* Add more password scheme support to the mysql authentication backend: ldap user
attribute scheme encoding and simple password hash in hexa for md5, sha1, sha224,
sha256, sha384, sha512.
* Add a main heading to template "Central Authentication Service" with a logo controled
by CAS_LOGO_URL
* Add logos to the project (svg, png)
* Add coverage computation
* link project to codacy
* Update doc: add debian requirement, correct typos, correct links
Changed
-------
* Use settings to set tests username password and attributes
* Tweak the css and html for small screens
* Update travis cache for faster build
* clean Makefile, use pip to install, add target for tests
Fixed
-----
* Fix "warn me": we generate the ticket after the user agree to be connected to the service.
we were generating first and the connect button was a link to the service url with the ?ticket=
this could lead to situation where the ticket validity expire if the user is slow to click the
connect button.
* Fix authentication renewal: the renew parameter were not transmited when POST the login request
and self.renew (aks for auth renewal) was use instead of self.renewed (auth was renewd)
when generating a ticket.
* Fix attribute value replacement when generating a ticket: we were using the 'name' attribute
instead of the 'attribut' attribut on ReplaceAttributValue
* Fix attribute value replacement when generating a ticket then the value is a list: iterate over
each element of the list.
* Fix a NameError in utils.import_attr
* Fix serviceValidate and samlValidate when user_field is an attribute that is a list: we use
the first element of the list as username. we were serializing the list before that.
* Correct typos
Cleaned
-------
* Clean some useless conditional branches found with coverage
* Clean cas.js: use compact object declararion
* Use six for python{2|3} compatibility
* Move all unit tests to cas_server.tests and use django primitive. We also have a 100% tests
coverage now. Using the django classes for tests, we do not need to use our own dirty mock.
* Move mysql backend password check to a function in utils
v0.4.4 - 2016-04-30
===================
commit: 77d1607b0beefe8b171adcd8e2dcd974e3cdc72a
Added
-----
* Add sensitive_post_parameters and sensitive_variables for passwords, so passwords are anonymised
before django send an error report.
Fixed
-----
* Before commit 77fc5b5 the User model had a foreign key to the Session model. After the commit,
Only the session_key is store, allowing to use different backend than the Session SQL backend.
So the first migration (which is 21 migrations combined) was creating the User model with the
foreign key, then delete it and add the field session_key. Somehow, MySQL did not like it.
Now the first migration directly create the User model with the session_key and without the
foreign key to the Session SQL backend.
* Evaluate attributes variables in the template samlValidate.xml. the {{ }} was missing causing
the variable name to be displyed instead of the variable content.
* Return username in CAS 1.0 on the second ligne of the CAS response as specified.
Changed
-------
* Update tests
v0.4.3 - 2016-03-18
===================
commit: f6d436acb49f8d32b5457c316c18c4892accfd3b
Fixed
-----
* Currently, one of our dependancy, django-boostrap3, do not support django 1.7 in its last version.
So there is some detection of the current django installed version in setup.py to pin
django-boostrap3 to a version supported by django 1.7 if django 1.7 is installed, or to require
at least django 1.8.
The detection did not handle the case where django was not installed.
* [PEP8] Put line breaks after binary operator and not before.
v0.4.2 - 2016-03-18
===================
commit: d1cd17d6103281b03a8c57013671057eab80d21c
Added
-----
* On logout, display the number of sessions we are logged out from.
Fixed
-----
* One of our dependancy, django-boostrap3, do not support django 1.7 in its last version.
Some django version detection is added to setup.py to handle that.
* Some typos
* Make errors returned by utils.import_attr clearer (as they are likely to be displayed to the
django admin)
v0.4.1 - 2015-12-23
===================
commit: 5e63f39f9b7c678a300ad2f8132166be34d1d35b
Added
-----
* Add a run_test_server target to make file. Running make run_test_server will build a virtualenv,
create a django projet with django-cas-server and lauch ./management.py runserver. It is quite
handy to test developement version.
* Add verbose name for cas_server app and models
* Add Makefile clean targets for tox tests and test virtualenv.
* Add link on license badge to the GPLv3
Changed
-------
* Make Makefile clean targets modular
* Use img.shields.io for PyPi badges
* Get django-cas-server version in Makefile directly from setup.py (so now, the version is only
written in one place)
Fixed
-----
* Fix MysqlAuthUser when number of results != 1: In that case, call super anyway this the provided
username.
v0.4.0 - 2015-12-15
===================
commit: 7b4fac575449e50c2caff07f5798dba7f4e4857c
Added
-----
* Add a help_text to pattern of ServicePattern
* Add a timeout to SLO requests
* Add logging capabilities (see README.rst for instruction)
* Add management commands that should be called on a regular basis to README.rst
v0.3.5 - 2015-12-12
===================
commit: 51fa0861f550723171e52d58025fa789dccb8cde
Added
-----
* Add badges to README.rst
* Document settings parameter in README.rst
* Add a "Features" section in README.rst
Changed
-------
* Add a AuthUser auth class and use it as auth classes base class instead of DummyAuthUser
Fixed
-----
* Fix minor errors and typos in README.rst
v0.3.4 - 2015-12-12
===================
commit: 9fbfe19c550b147e8d0377108cdac8231cf0fb27
Added
-----
* Add static files, templates and locales to the PyPi release by adding them to MANIFEST.in
* Add a Makefile with the build/install/clean/dist targets
v0.3.3 - 2015-12-12
===================
commit: 16b700d0127abe33a1eabf5d5fe890aeb5167e5a
Added
-----
* Add management commands and migrations to the package by adding there packages to setup.py
packages list.
v0.3.2 - 2015-12-12 [YANKED]
============================
commit: eef9490885bf665a53349573ddb9cbe844319b3e
Added
-----
* Add migrations to setup.py package_data
v0.3.1 - 2015-12-12
===================
commit: d0f6ed9ea3a4b3e2bf715fd218c460892c32e39f
Added
-----
* Add a forgotten migration (remove auto_now_add=True from the User model)
v0.3.0 - 2015-12-12
===================
commit: b69769d71a99806a69e300eca0d7c6744a2b327e
Added
-----
* Django 1.9 compatibility (add tox and travis tests and fix some decrecated)
v0.2.1 - 2015-12-12
===================
commit: 90e077dedb991d651822e9bb283470de8bddd7dd
First github and PyPi release
Fixed
-----
* Prune .tox in MANIFEST.in
* add dist/ to .gitignore
* typo in setup.cfg
v0.2.0 - 2015-12-12 [YANKED]
============================
commit: a071ad46d7cd76fc97eb86f2f538d330457c6767
v0.1.0 - 2015-05-22 [YANKED]
============================
commit: 6981433bdf8a406992ba0c5e844a47d06ccc08fb
include tox.ini
include LICENSE
include README.rst
include CHANGELOG.rst
include .coveragerc
include Makefile
include pytest.ini
......@@ -15,6 +16,7 @@ include docs/conf.py
include docs/index.rst
include docs/Makefile
include docs/README.rst
include docs/CHANGELOG.rst
recursive-include docs/_ext *
recursive-include docs/package *
recursive-include docs/_static *
......
......@@ -7,7 +7,7 @@ CAS Server is a Django application implementing the `CAS Protocol 3.0 Specificat
<https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html>`_.
By default, the authentication process use django internal users but you can easily
use any sources (see auth classes in the auth.py file)
use any sources (see the `Authentication backend`_ section and auth classes in the auth.py file)
.. contents:: Table of Contents
......@@ -38,7 +38,7 @@ Dependencies
Minimal version of packages dependancy are just indicative and meens that ``django-cas-server`` has
been tested with it. Previous versions of dependencies may or may not work.
Additionally, denpending of the authentication backend you plan to use, you may need the following
Additionally, denpending of the `Authentication backend`_ you plan to use, you may need the following
python packages:
* ldap3
......@@ -174,13 +174,11 @@ Quick start
inactive since more than ``SESSION_COOKIE_AGE``. The default value for is ``1209600``
seconds (2 weeks). You probably should reduce it to something like ``86400`` seconds (1 day).
You could for example do as bellow :
You could for example do as bellow::
.. code-block::
0 0 * * * cas-user /path/to/project/manage.py clearsessions
*/5 * * * * cas-user /path/to/project/manage.py cas_clean_tickets
5 0 * * * cas-user /path/to/project/manage.py cas_clean_sessions
0 0 * * * cas-user /path/to/project/manage.py clearsessions
*/5 * * * * cas-user /path/to/project/manage.py cas_clean_tickets
5 0 * * * cas-user /path/to/project/manage.py cas_clean_sessions
5. Run ``python manage.py createsuperuser`` to create an administrator user.
......@@ -208,7 +206,7 @@ Template settings
Default is a key icon. Set it to ``False`` to disable it.
* ``CAS_SHOW_POWERED``: Set it to ``False`` to hide the powered by footer. The default is ``True``.
* ``CAS_COMPONENT_URLS``: URLs to css and javascript external components. It is a dictionnary
and it must have the five following keys: ``"bootstrap3_css"``, ``"bootstrap3_js"``,
having the five following keys: ``"bootstrap3_css"``, ``"bootstrap3_js"``,
``"html5shiv"``, ``"respond"``, ``"jquery"``. The default is::
{
......@@ -219,6 +217,32 @@ Template settings
"jquery": "//code.jquery.com/jquery.min.js",
}
if you omit some keys of the dictionnary, the default value for these keys is used.
* ``CAS_INFO_MESSAGES``: Messages displayed in info-boxes on the html pages of the default templates.
It is a dictionnary mapping message name to a message dict. A message dict has 3 keys:
* ``message``: A unicode message to display, potentially wrapped around ugettex_lazy
* ``discardable``: A boolean, specify if the users can close the message info-box
* ``type``: One of info, success, info, warning, danger. The type of the info-box.
``CAS_INFO_MESSAGES`` contains by default one message, ``cas_explained``, which explain
roughly the purpose of a CAS. The default is::
{
"cas_explained": {
"message":_(
u"The Central Authentication Service grants you access to most of our websites by "
u"authenticating only once, so you don't need to type your credentials again unless "
u"your session expires or you logout."
),
"discardable": True,
"type": "info", # one of info, success, info, warning, danger
},
}
* ``CAS_INFO_MESSAGES_ORDER``: A list of message names. Order in which info-box messages are
displayed. Use an empty list to disable messages display. The default is ``[]``.
* ``CAS_LOGIN_TEMPLATE``: Path to the template showed on ``/login`` then the user
is not autenticated. The default is ``"cas_server/login.html"``.
* ``CAS_WARN_TEMPLATE``: Path to the template showed on ``/login?service=...`` then
......@@ -228,7 +252,7 @@ Template settings
authenticated. The default is ``"cas_server/logged.html"``.
* ``CAS_LOGOUT_TEMPLATE``: Path to the template showed on ``/logout`` then to user
is being disconnected. The default is ``"cas_server/logout.html"``
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to `/login` after they
* ``CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT``: Should we redirect users to ``/login`` after they
logged out instead of displaying ``CAS_LOGOUT_TEMPLATE``. The default is ``False``.
......@@ -271,7 +295,7 @@ New version warnings settings
* ``CAS_NEW_VERSION_HTML_WARNING``: A boolean for diplaying a warning on html pages then a new
version of the application is avaible. Once closed by a user, it is not displayed to this user
until the next new version. The default is ``True``.
* ``CAS_NEW_VERSION_EMAIL_WARNING``: A bolean sot sending a email to ``settings.ADMINS`` when a new
* ``CAS_NEW_VERSION_EMAIL_WARNING``: A boolean for sending a email to ``settings.ADMINS`` when a new
version is available. The default is ``True``.
......@@ -545,10 +569,10 @@ A service pattern has 4 associated models:
an email address to connect to it. To do so, put ``email`` in ``Attribute`` and ``.*`` in ``pattern``.
Then a user ask a ticket for a service, the service URL is compare against each service patterns
sorted by `position`. The first service pattern that matches the service URL is chosen.
Hence, you should give low `position` to very specific patterns like
``^https://www\.example\.com(/.*)?$`` and higher `position` to generic patterns like ``^https://.*``.
So the service URL `https://www.examle.com` will use the service pattern for
sorted by ``position``. The first service pattern that matches the service URL is chosen.
Hence, you should give low ``position`` to very specific patterns like
``^https://www\.example\.com(/.*)?$`` and higher ``position`` to generic patterns like ``^https://.*``.
So the service URL ``https://www.examle.com`` will use the service pattern for
``^https://www\.example\.com(/.*)?$`` and not the one for ``^https://.*``.
......@@ -572,7 +596,7 @@ An identity provider comes with 5 fields:
* ``Suffix``: the suffix that will be append to the username returned by the identity provider.
It must be unique.
* ``Server url``: the URL to the identity provider CAS. For instance, if you are using
``https://cas.example.org/login`` to authenticate on the CAS, the `server url` is
``https://cas.example.org/login`` to authenticate on the CAS, the ``server url`` is
``https://cas.example.org``
* ``CAS protocol version``: the version of the CAS protocol to use to contact the identity provider.
The default is version 3.
......@@ -593,11 +617,9 @@ Then using federate mode, you should add one command to a daily crontab: ``cas_c
This command clean the local cache of federated user from old unused users.
You could for example do as bellow :
.. code-block::
You could for example do as bellow::
10 0 * * * cas-user /path/to/project/manage.py cas_clean_federate
10 0 * * * cas-user /path/to/project/manage.py cas_clean_federate
......
......@@ -11,7 +11,7 @@
"""A django CAS server application"""
#: version of the application
VERSION = '0.6.4'
VERSION = '0.7.0'
#: path the the application configuration class
default_app_config = 'cas_server.apps.CasAppConfig'
......@@ -12,6 +12,7 @@
"""Default values for the app's settings"""
from django.conf import settings
from django.contrib.staticfiles.templatetags.staticfiles import static
from django.utils.translation import ugettext_lazy as _
from importlib import import_module
......@@ -180,13 +181,45 @@ CAS_NEW_VERSION_EMAIL_WARNING = True
#: You should not change it.
CAS_NEW_VERSION_JSON_URL = "https://pypi.python.org/pypi/django-cas-server/json"
#: Messages displayed in a info-box on the html pages of the default templates.
#: ``CAS_INFO_MESSAGES`` is a :class:`dict` mapping message name to a message :class:`dict`.
#: A message :class:`dict` has 3 keys:
#: * ``message``: A :class:`unicode`, the message to display, potentially wrapped around
#: ugettex_lazy
#: * ``discardable``: A :class:`bool`, specify if the users can close the message info-box
#: * ``type``: One of info, success, info, warning, danger. The type of the info-box.
#: ``CAS_INFO_MESSAGES`` contains by default one message, ``cas_explained``, which explain
#: roughly the purpose of a CAS.
CAS_INFO_MESSAGES = {
"cas_explained": {
"message": _(
u"The Central Authentication Service grants you access to most of our websites by "
u"authenticating only once, so you don't need to type your credentials again unless "
u"your session expires or you logout."
),
"discardable": True,
"type": "info", # one of info, success, info, warning, danger
},
}
#: :class:`list` of message names. Order in which info-box messages are displayed.
#: Let the list empty to disable messages display.
CAS_INFO_MESSAGES_ORDER = []
GLOBALS = globals().copy()
for name, default_value in GLOBALS.items():
# get the current setting value, falling back to default_value
value = getattr(settings, name, default_value)
# set the setting value to its value if defined, ellse to the default_value.
setattr(settings, name, value)
# only care about parameter begining by CAS_
if name.startswith("CAS_"):
# get the current setting value, falling back to default_value
value = getattr(settings, name, default_value)
# set the setting value to its value if defined, ellse to the default_value.
setattr(settings, name, value)
# Allow the user defined CAS_COMPONENT_URLS to omit not changed values
MERGED_CAS_COMPONENT_URLS = CAS_COMPONENT_URLS.copy()
MERGED_CAS_COMPONENT_URLS.update(settings.CAS_COMPONENT_URLS)
settings.CAS_COMPONENT_URLS = MERGED_CAS_COMPONENT_URLS
# if the federated mode is enabled, we must use the :class`cas_server.auth.CASFederateAuth` auth
# backend.
......
......@@ -7,8 +7,8 @@ msgid ""
msgstr ""
"Project-Id-Version: cas_server\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2016-08-01 12:01+0200\n"
"PO-Revision-Date: 2016-08-01 12:01+0200\n"
"POT-Creation-Date: 2016-08-24 17:18+0200\n"
"PO-Revision-Date: 2016-08-24 17:18+0200\n"
"Last-Translator: Valentin Samir <valentin.samir@crans.org>\n"
"Language-Team: django <LL@li.org>\n"
"Language: fr\n"
......@@ -18,70 +18,81 @@ msgstr ""
"Plural-Forms: nplurals=2; plural=(n > 1);\n"
"X-Generator: Poedit 1.8.8\n"
#: apps.py:25 templates/cas_server/base.html:9
#: templates/cas_server/base.html:27
#: apps.py:25 templates/cas_server/base.html:7
#: templates/cas_server/base.html:26
msgid "Central Authentication Service"
msgstr "Service Central d'Authentification"
#: forms.py:88
#: default_settings.py:197
msgid ""
"The Central Authentication Service grants you access to most of our websites "
"by authenticating only once, so you don't need to type your credentials "
"again unless your session expires or you logout."
msgstr ""
"Le Service Central d'Authentification permet, en vous authentifiant une "
"seule fois, d'accéder à la plupart de nos sites sans avoir à retaper votre "
"identifiant et votre mot de passe chaque fois que vous changez de site, "
"jusqu'à ce que votre session expire ou que vous vous déconnectiez."
#: forms.py:84
msgid "Identity provider"
msgstr "fournisseur d'identité"
#: forms.py:92 forms.py:111
#: forms.py:88 forms.py:107
msgid "Warn me before logging me into other sites."
msgstr "Prévenez-moi avant d'accéder à d'autres services."
#: forms.py:96
#: forms.py:92
msgid "Remember the identity provider"
msgstr "Se souvenir du fournisseur d'identité"
#: forms.py:106 models.py:600
#: forms.py:102 models.py:594
msgid "username"