~nataliabidart/canonical-identity-provider/admin-access-via-sso : changes

~nataliabidart/canonical-identity-provider/admin-access-via-sso » Changes from revision 1354

From Revision 1354 to 1335

Rev	Summary	Authors	Date
1354	COuntless attempts to properly auth in admin area. COuntless attempts to properly auth in admin area.	Natalia B. Bidart	8 years ago
1353	[r=nataliabidart,james-w] New parameters for more secure Aut... [r=nataliabidart,james-w] New parameters for more secure AuthToken strings. 20-character tokens taken from a set of hopefully non-ambiguous letters and numbers will yield tokens with about 110 bits of entropy, as opposed to the 36 bits we had with 6-character a-zA-Z0-9 tokens.	Daniel Manrique	8 years ago
1352	[r=ricardokirkner,matt-goodall] Admin-side tweaks to display... [r=ricardokirkner,matt-goodall] Admin-side tweaks to display a shortened version of hashed tokens and avoid the unwieldy 64-character sha256 hashes.	Daniel Manrique	8 years ago
1351	[r=ricardokirkner,james-w] Store only AuthToken hashes in th... [r=ricardokirkner,james-w] Store only AuthToken hashes in the database. Since AuthTokens are security-sensitive, once a raw token is generated and sent to the user via either e-mail or URL redirection, the raw value is discarded and only a hash is kept in the database. So raw tokens can't be recovered directly from the database. The data is stored in the same existing "token" column (though renamed at model-level to "hashed_token"). The code accounts for "old-style", raw tokens to be stored in the same table; all existing tokens continue to be valid and can be used. However, only "new-style", hashed tokens will be stored in the future.	Daniel Manrique	8 years ago
1350	[r=nataliabidart] update sphinx to 1.3 to work with readthed... [r=nataliabidart] update sphinx to 1.3 to work with readthedocs	Ricardo Kirkner	8 years ago
1349	[r=wesmason] - Reduce logging for OAuth handler now that we... [r=wesmason] - Reduce logging for OAuth handler now that we have deployed the feature.	Natalia B. Bidart	8 years ago
1348	[r=nataliabidart,roadmr] split docs requirements to it's own... [r=nataliabidart,roadmr] split docs requirements to it's own file so that readthedocs.org can build the docs properly	Ricardo Kirkner	8 years ago
1347	[r=roadmr] removed obsoleted standalone raven code [r=roadmr] removed obsoleted standalone raven code	Ricardo Kirkner	8 years ago
1346	[r=roadmr] replace custom raven for canonical-raven [r=roadmr] replace custom raven for canonical-raven	Ricardo Kirkner	8 years ago
1345	[r=ricardokirkner] - Minor fixes and extensions to API v2.0 [r=ricardokirkner] - Minor fixes and extensions to API v2.0 documentation.	Natalia	8 years ago
1344	[r=james-w,fgallina] Switch to using SystemRandom to generat... [r=james-w,fgallina] Switch to using SystemRandom to generate random strings. The random number generator is configured as a setting, which now defaults to a random.SystemRandom() instance. This provides more secure randomization for strings, including OpenID identifiers and AuthToken tokens as used in action e-mails and URLs. Tests that require a "predictable" RNG (by using a constant seed, which is not honored by SystemRandom) can override the setting to use the random module which provides a system-wide instance and deterministig RNG implementation.	Daniel Manrique	8 years ago
1343	[r=matt-goodall] Stricter checks for AuthToken consumption s... [r=matt-goodall] Stricter checks for AuthToken consumption status and e-mail address ownership. Low-hanging refactoring fruit, added new behavior as expressed by XXX items and added tests for said behaviors. Tokens which are already consumed will be considered invalid and an e-mail validation token which is somehow requesting validation of an address not associated with the user's account will also be rejected.	Daniel Manrique	8 years ago
1342	[r=james-w] Refactor tests to remove assumption that the "ra... [r=james-w] Refactor tests to remove assumption that the "raw" token (for AuthTokens) can be retrieved from the database. The "raw" token is what's sent to the user (e.g. via email) so he can perform the requested action. This is in preparation for storing only token hashes in the database, instead of "raw" tokens, as requested in bug 1401686. The work for that feature is getting really big, to make review easier I split it into logical chunks, this is the first one laying the groundwork to make the upcoming one (with actual, interesting new features) shorter. The raw/hashed feature will be implemented by adding, at AuthToken creation time, a non-db raw_token attribute, which can be used while the object remains in scope, to build URLs or emails. Once the object goes out of scope, raw_token is gone and only the hashed version remains in the database. High-level explanation of what this code does (just refactoring, no real behavior/implementation changes): * Methods in emailutils return the created AuthTokens so they can be passed around, mainly for testing. Callers changed to receive two tokens (instead of just one), and emailutils tests updated to use these tokens instead of trying to retrieve them from the database. * The helpers and code which retrieve tokens sent to users were updated to look at mail.outbox instead of getting the "raw" token from the database. Old helpers deleted :) * One instance of access to an Account's authtoken_set changed to go through AuthToken first (since it saves writing one extra helper for child set access).	Daniel Manrique	8 years ago
1341	[r=ricardokirkner] - Restore ModelBackend until proper fix f... [r=ricardokirkner] - Restore ModelBackend until proper fix for the admin logging via openid.	Natalia	8 years ago
1340	[r=ricardokirkner] - Fix for oops "AttributeError: 'User' ob... [r=ricardokirkner] - Fix for oops "AttributeError: 'User' object has no attribute 'user'" when logging into admin.	Natalia	8 years ago
1339	[r=james-w] - Ensure proper metrics are tracked for validate... [r=james-w] - Ensure proper metrics are tracked for validate request endpoint.	Natalia	8 years ago
1338	[r=ricardokirkner] - Disable django.contrib.auth.backends.Mo... [r=ricardokirkner] - Disable django.contrib.auth.backends.ModelBackend as one of the AUTHENTICATION_BACKENDS. - Removed extra logging to debug LP: #1476225.	Natalia	8 years ago
1337	[r=james-w] - Workaround for supporting oauth validation for... [r=james-w] - Workaround for supporting oauth validation for requests with poorly urlencoded query strings.	Natalia	8 years ago
1336	[r=nataliabidart] Add django password checking timing inform... [r=nataliabidart] Add django password checking timing information to the request's timeline. The goal is to measure how long those calls take, to know whether they are causing SoftTimeouts and to generally know the cost of making them (to later decide the effort to expend trying to avoid those calls).	Daniel Manrique	8 years ago
1335	[r=roadmr] update to timeline-django==0.0.4 to avoid breakin... [r=roadmr] update to timeline-django==0.0.4 to avoid breaking when timeline events are not tuples	Ricardo Kirkner	8 years ago

Older »