Skip to content

Commit

Permalink
Bump version to 1.1.0
Browse files Browse the repository at this point in the history
  • Loading branch information
jobec committed Dec 7, 2018
1 parent bd2d6e9 commit 6350a3d
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 1 deletion.
19 changes: 19 additions & 0 deletions CHANGELOG.rst
Original file line number Diff line number Diff line change
@@ -1,6 +1,25 @@
Changelog
=========

`1.1.0`_ - 2018-12-07
---------------------

**Added**

* Add a setting to force a login screen and disable SSO on ADFS.
* Documentation about how to enable SSO for other browsers than IE & Edge.

**Fixed**

* Prevent username field from being overwritten by a claim mapping.
* Prevent traceback upon logout when ADFS config is not yet loaded.
* Fix fields in log messages being swapped.

**Security**

* Don't allow the audience claim to be ignored. Preventing access token reuse.
* Set an unusable password on newly created user instead of leaving it empty.

`1.0.0`_ - 2018-12-05
---------------------

Expand Down
2 changes: 1 addition & 1 deletion django_auth_adfs/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@
Adding imports here will break setup.py
"""

__version__ = '1.0.0'
__version__ = '1.1.0'

3 comments on commit 6350a3d

@JonasKs
Copy link
Member

@JonasKs JonasKs commented on 6350a3d Dec 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would Don't allow the audience claim to be ignored. Preventing access token reuse make so that API requests need an entirely new access token for each request?
Otherwise I like the login-screen change, good stuff!

@jobec
Copy link
Collaborator Author

@jobec jobec commented on 6350a3d Dec 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, by reuse I meant using an access token meant for a different "resource server". Now that there's DRF support and the backend doesn't fetch the access token itself, there's potential in abusing this setting.

@JonasKs
Copy link
Member

@JonasKs JonasKs commented on 6350a3d Dec 7, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, thanks for clarification.

Please sign in to comment.