~deadlight/canonical-identity-provider/trunk : changes

~deadlight/canonical-identity-provider/trunk » Changes from revision 1682

From Revision 1682 to 1663

Rev	Summary	Authors	Date
1682	Add GDPR report admin action for accounts. Add GDPR report admin action for accounts. The intent is to have a read-only, copy-pasteable view for GDPR requests. Currently the information to be reported is scattered between the Account change form and the auth logs changelist. The Account form contains most of the relevant data but since it's a form, it can't be cleanly copy-pasted. If more GDPR-relevant information is required, this view can easily be expanded to present that as well. Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/gdpr-report/+merge/365134	Daniel Manrique	5 years ago
1681	Do not store/use an OATH TOTP client's calculated "absolute ... Do not store/use an OATH TOTP client's calculated "absolute drift". Per LP bug #1817075, the "stored absolute drift" functionality of python-oath is broken and allows a client to reuse a token that is just expired (due to allowing relative drift of +/-30 seconds), and keep reusing it just past the end of the previously-calculated absolute drift to keep it "alive" indefinitely. A side-effect of this is that we will require OATH TOTP devices to have accurate clocks, which is deemed acceptable since the vast majority of clients are either phones or computers. "Accurate" is quite lenient though, because a device can be +/- 45 seconds off and still generate valid codes. Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/non-drifting-totp/+merge/363558	Daniel Manrique	5 years ago
1680	Add two new substitutions to be used in SAML attribute value... Add two new substitutions to be used in SAML attribute values. "displayname" is normally the users' Full Name in SSO. "email" is the e-mail address. These enable reporting richer SAML attributes to SPs who can then create nicer-looking local identities. Additionally, the existence of the e-mail attribute/substitution might allow for full compliance with the SAML 8.3 "persistent" policy, though this would require additional implementation work. Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/saml-extra-attribute-substitutions/+merge/362265	Daniel Manrique	5 years ago
1679	Actually honor SAML AuthnRequests' NameIDPolicy format. Actually honor SAML AuthnRequests' NameIDPolicy format. This was done to accommodate SPs (Bomgar) which request persistent names, indicating so in their AuthnRequest. SSO usually ignores this and always sends "email"-policy names, which most SPs handle fine but Bomgar fails with. The fully-correct thing to do would be to always honor the AuthnRequest and support most/all of the SAML-specified policies, but that'd be a large effort and risks changing semantics for other SPs, which would prevent people from logging in, which would be bad. Another quirk is that, while we respond saying we're giving a persistent identifier, our identifier (the e-mail address) does NOT actually conform to persistent semantics per SAML spec's section 8.3; we are sending the same value (the e-mail address), just saying it's "persistent" as requested by the SP. We do have a persistent identifier (the OpenID) but we can't send that because then it gets sent as the username, identifier, and email address. Again, support for this can be added to our django-saml2-idp fork but it's more work for something that at the moment is required only by one SP. Due do the above, in order to support Bomgar (and possibly other SPs) in a more selective way, we only honor a non-email NameIDPolicy if: - the SP is configured to honor this (a boolean in the SPConfig) - the requested NameID policy is "persistent". This allows us to switch this on only for very specific SPs for which we have more control and fully understand the consequences of "lying" with our "persistent" support. In all other cases, we continue ignoring/overriding this and always sending our response with "email" policy. (As a rant, the best thing to do would be to trash our hacky SAML library and integrate OneLogin's SAML library which is fully standards-compliant, which is however a huge undertaking we would have to consider and prioritize) Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/support-saml-persistent-nameid-policy-format/+merge/361982	Daniel Manrique	5 years ago
1678	Add honor_authnrequest_nameidpolicy_format boolean field to ... Add honor_authnrequest_nameidpolicy_format boolean field to SAMLConfig. The intended use is to enable honoring the nameid policy format requested by the SP's AuthnRequest, on a config-by-config basis. This is done because a change to fully support honoring this with appropriate semantics is large and likely to break existing remotes, so this allows a smaller change that works for specific remotes. Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/honor-authnrequest-nameid-policy-format-field/+merge/361981	Daniel Manrique	5 years ago
1677	Redirect forgot password valid POST to email-sent view regar... Redirect forgot password valid POST to email-sent view regardless of whether the account exists or not. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/prevent-forgot-password-user-enumeration/+merge/361166	Maximiliano Bertacch...	5 years ago
1676	Pre-fill forgot password form with email value entered in th... Pre-fill forgot password form with email value entered in the login form. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/smarter-forget-password-link/+merge/361579	Maximiliano Bertacch...	5 years ago
1675	Remove the expiry caveat from the discharge macaroon. Remove the expiry caveat from the discharge macaroon. Merged from https://code.launchpad.net/~twom/canonical-identity-provider/unexpiring-discharge-macaroon/+merge/359240	Tom Wardill	5 years ago
1674	Show a nice error message at user registration and reset pas... Show a nice error message at user registration and reset password views when the API returns 429 - too many requests. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/fix-429-crash/+merge/361148	Maximiliano Bertacch...	5 years ago
1673	Update account registration throttling from 3600 req/h/IP to... Update account registration throttling from 3600 req/h/IP to 360 req/h/IP. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/registration-throttling/+merge/361212	Maximiliano Bertacch...	5 years ago
1672	Add lint checks for unsafe yaml and deprecated unittest asse... Add lint checks for unsafe yaml and deprecated unittest assertions. Additionally, update the custom flake8 plugin on changes only. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/improved-lint/+merge/361164	Maximiliano Bertacch...	5 years ago
1671	Add a password confirmation box to deleting an account Add a password confirmation box to deleting an account Merged from https://code.launchpad.net/~twom/canonical-identity-provider/confirm-password-before-deleting/+merge/360874	Tom Wardill	5 years ago
1670	Add a confirm password box to the edit account details scree... Add a confirm password box to the edit account details screen. Merged from https://code.launchpad.net/~twom/canonical-identity-provider/confirm-password-before-changing/+merge/360817	Tom Wardill	5 years ago
1669	Upgrade to latest django 1.11.x series Upgrade to latest django 1.11.x series Merged from https://code.launchpad.net/~twom/canonical-identity-provider/upgrade-django-1-11-16/+merge/359243	Tom Wardill	5 years ago
1668	Drop the last bits of reCaptcha V1 code. Drop the last bits of reCaptcha V1 code. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/drop-recaptcha-v1/+merge/356937	Maximiliano Bertacch...	5 years ago
1667	Drop captcha from account registration API v1.x. Drop captcha from account registration API v1.x. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/drop-account-registration-captcha-api-v1/+merge/356876	Maximiliano Bertacch...	5 years ago
1666	Disable user registration via API v1/v2 (via USER_REGISTRATI... Disable user registration via API v1/v2 (via USER_REGISTRATION_API_ENABLED switch, disabled by default). Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/disable-user-registration-api/+merge/356766	Maximiliano Bertacch...	5 years ago
1665	Update api v1 captchas endpoint to return a dummy response. Update api v1 captchas endpoint to return a dummy response. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/api-v1-captcha-dummy/+merge/356670	Maximiliano Bertacch...	5 years ago
1664	Upgrade recaptcha conn-check to reCaptchaV2. Upgrade recaptcha conn-check to reCaptchaV2. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/conncheck-recaptcha-v2/+merge/356611	Maximiliano Bertacch...	5 years ago
1663	Some cleanup of API throttling tests. Some cleanup of API throttling tests. Merged from https://code.launchpad.net/~maxiberta/canonical-identity-provider/improve-throttle-tests/+merge/354892	Maximiliano Bertacch...	5 years ago

Older »