Tags give the ability to mark specific points in history as being important
-
0.3.6
a068f489 · ·[0.3.6] - 2026-08-04 -------------------- Added ^^^^^ - Client secret expiration dates are displayed and editable in the client administration page. Clients cannot authenticate with an expired secret anymore. - Client secrets can be renewed from the client administration page. - ``canaille jwt registration`` has a ``--client-id`` option to choose the identifier of the client to register, so it is known before the client registers itself. - ``canaille jwt registration`` and ``canaille jwt management`` have a ``--json`` option that displays the client identifier and the endpoint to use along with the token. Fixed ^^^^^ - :rfc:`RFC7592 <7592>` registration access tokens were not bound to the client they were issued for. - ``canaille jwt management`` issued tokens for unregistered clients, and ``canaille jwt registration`` for already registered ones, although the endpoints reject both. - Client registration and management tokens signed with the ``none`` algorithm were accepted, so anyone could forge one. - Client registration and management tokens signed with an inactive key are now accepted, so a key rotation does not invalidate the tokens issued before it. - ``DYNAMIC_CLIENT_REGISTRATION_OPEN`` also disabled the authentication of the :rfc:`RFC7592 <7592>` client management endpoint, which could then be used without any token. It now only covers the registration of new clients. - Dynamically registered clients had their ``client_secret_expires_at`` set to 1970-01-01 instead of being left empty.
-
0.3.4
17d30b55 · ·[0.3.4] - 2026-07-22 -------------------- Added ^^^^^ - ``canaille jwk export`` command to export the public part of the server signing keys, as JSON metadata or as PEM, for external JWT validators that verify tokens locally. Fixed ^^^^^ - move tomlkit dependency from the front to the oidc extra
-
0.2.5
75f07d92 · ·[0.2.5] - 2026-04-13 -------------------- Added ^^^^^ - SQL database configuration parameters. - Pooled LDAP connection support. - ``Backend.count()`` method for efficient entry counting. Fixed ^^^^^ - SCIM ``totalResults`` now returns the total number of matching entries instead of the page size. - Logo embedded in emails is now read from disk for application-local URLs instead of being fetched through an HTTP loopback. Fixes a hang when sending mail with the default ``EagerBroker`` on a single-threaded server :issue:`340`
-
0.2.4
d1d2eb85 · ·[0.2.4] - 2026-04-08 -------------------- Added ^^^^^ - SCIM ``attributes`` and ``excludedAttributes`` query parameter support. - SCIM ``POST /.search`` endpoint. - SCIM ETags support. :pr:`335` - Allow access to SCIM endpoints with admin access tokens. :pr:`336` - SCIM ``/Me`` endpoint. :pr:`336`
-
0.2.0
e0d51b7a · ·[0.2.0] - 2025-02-25 -------------------- Added ^^^^^ - CORS support for OIDC and SCIM endpoints. :issue:`332` - OIDC ``amr`` claim support. :issue:`302` - Server-side sessions. - Captcha protection. :issue:`211` :pr:`310` - Support for Python 3.14. :pr:`313` - Integration test suite. :issue:`320` - Requests are redirected to ``SERVER_NAME`` when the HTTP Host header does not match. - WebAuthn authentication factor implementation. :issue:`296` Fixed ^^^^^ - CSP violation caused by Fomantic-UI inline styles. - LDAP: OTP feature is now disabled when the OTP module is not loaded in OpenLDAP. - LDAP: ``PostReadControl`` only requests attributes that exist in the LDAP schema. - Password reset no longer bypasses MFA. - Usernames don't appear in the photos URLs. - Include missing Babel data in the pyinstaller binary. :issue:`318` - ID token signing now selects a key compatible with the client's ``id_token_signed_response_alg``. - OIDC discovery signing algorithm claims are now dynamically computed from server keys. :issue:`323` - Explicitly make RSA keys mandatory. - When the scope parameter is omitted from authorization requests, the client's configured scope is now used as the default value. - Password field autofocus. :issue:`325` - Broken photo upload. :issue:`327` - Disable HTMX boosting for redirections after redirections. :issue:`334` - Fix HTMX resetting inputs :issue:`335`
-
0.0.87
d9f1b011 · ·[0.0.87] - 2025-11-02 --------------------- .. warning:: - ``DYNAMIC_CLIENT_REGISTRATION_TOKENS`` removed in favor of JWT tokens. - ``MANAGE_GROUPS`` permission is renamed ``MANAGE_ALL_GROUPS``. - ``CONFIG`` environment variable renamed to ``CANAILLE_CONFIG``. - ``ENV_FILE`` environment variable renamed to ``CANAILLE_ENV``. Added ^^^^^ - Per-user group management. :issue:`95` :pr:`299` - ``OTP_LIFETIME`` configuration parameter. - ``TOTP_LIFETIME`` configuration parameter. - Task worker for long-running operations. :issue:`251` :pr:`300` Fixed ^^^^^ - Password autofill. - Conditionally load CLI to avoid crash when optional dependencies are missing. Changed ^^^^^^^ - Remove ``DYNAMIC_CLIENT_REGISTRATION_TOKENS`` in favor of JWT tokens. :issue:`272` - Rename ``CONFIG`` to ``CANAILLE_CONFIG`` and ``ENV_FILE`` to ``CANAILLE_ENV`` for consistency. Removed ^^^^^^^ - Remove the web interface to see authorization codes.