CHANGELOG.md

Changelog

2.0

2.0.2 - 2024-11-06

(full changelog)

Bugs fixed

• Fix parsing of search response #294 (@consideRatio, @manics)

Maintenance and upkeep improvements

• Document configuring TLS ciphers and log a link to it on raised handshake error #297 (@consideRatio, @manics, )

Continuous integration improvements

• Test bind_dn_template more thoroughly #290 (@manics, @consideRatio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@consideRatio (activity) | @franciscaestecker (activity) | @franciscaestecker-bb (activity) | @manics (activity)

2.0.1 - 2024-10-29

(full changelog)

Bugs fixed

• fix: Ensure a list bind_dn_template is properly validated #289 (@mahendrapaipuri)

Contributors to this release

(GitHub contributors page for this release)

@mahendrapaipuri

2.0.0 - 2024-10-18

(full changelog)

Breaking Changes

• python>=3.9, jupyterhub>=4.1.6, and ldap3>=2.9.1 is now required. (#245, #256)

• Configuring auth_state_attributes now leads to user information being put in auth_state["user_attributes"] and not directly in auth_state. (#269)

• use_lookup_dn_username now defaults to False and is opt-in instead of opt-out. To retain previous behavior if you had lookup_dn set True without use_lookup_dn_username explicitly set, configure use_lookup_dn_username to True. (#280)

• lookup_dn now rejects an authenticating user if multiple DNs are returned during lookup. (#276)

• In the edge case if both...

  1. the following config is used:
     • lookup_dn = True,
     • lookup_dn_user_dn_attribute = "cn"
     • use_lookup_dn_username = True (previous default value)
  2. and one or more users previously signed in at least once had a comma in their cn attribute's value

  then such users will get a new JupyterHub username going forward looking like "lastname, firstname" instead of looking like "lastname\\, firstname". (#267)

Deprecations

• use_ssl has been deprecated, instead configure tls_strategy going forward. Configuring use_ssl=True should be updated with tls_strategy="on_connect", and configuring use_ssl=False could be updated to either be tls_strategy="before_bind" (default) or tls_strategy="insecure". (#258)
• escape_userdn has been deprecated, usernames used to construct DNs are now always escaped according to LDAP protocol specification of how DNs should be represented in string format. (#267)

New features added

• Add LDAPAuthenticator.version_info #282 (@consideRatio)
• Add tls_kwargs config to configure underlying ldap3 package tls #273 (@consideRatio, @minrk)
• Add tls_strategy and deprecate use_ssl #258 (@consideRatio, @manics, @loic-vial, @1kastner)
• Allow users to configure group search filter and attributes (group_search_filter and group_attributes config) #168 (@kinow, @consideRatio, @manics, @ordlucas, @mananpreetsingh)

Enhancements made

• Docs updates, and a few tweaks to the allow config #286 (@manics, @minrk)
• Register authenticator class with jupyterhub as ldap #249 (@consideRatio, @minrk)

Bugs fixed

• Require a unique DN to be found when using lookup_dn #276 (@consideRatio, @minrk)
• Fix duplicated bind operation, only one is needed #270 (@consideRatio, @minrk)
• Escape username within DN correctly and remove escape_userdn #267 (@consideRatio, @minrk)
• Escape user- or ldap-provided strings in ldap search filters #238 (@m-erhardt, @consideRatio)

Maintenance and upkeep improvements

• Remove empty scripts file #287 (@manics, @minrk)
• Comment consistently about escape_rdn and escape_filter_chars #284 (@consideRatio)
• Validate config on startup when possible (allowed_groups, lookup_dn, bind_dn_template) #283 (@consideRatio)
• tests: pass config to constructor instead of configuring after #281 (@consideRatio)
• Change use_lookup_dn_username default value to False #280 (@consideRatio)
• Fix a log message about lookup_dn_user_dn_attribute #278 (@consideRatio)
• refactor: distinguish login_username from resolved_username #277 (@consideRatio)
• Add missing docs for search_filter and attributes and improve logging for search_filter #275 (@consideRatio, @minrk)
• Improve logging, docstring, and variable naming in resolve_username function #274 (@consideRatio, @minrk)
• align allowed_groups with other allowed_ config, consistent in JupyterHub 5 #269 (@minrk, @consideRatio, @manics)
• refactor: specify param names for Connection.search consistently #268 (@consideRatio)
• refactor: reduce use of temporary variables #264 (@consideRatio)
• Relocate example snippet from code to readme #257 (@consideRatio)
• Require ldap3 2.9.1+ released 2021 (currently latest) as a lower bound #256 (@consideRatio)
• Transition to async functions and remove tornado dependency #255 (@consideRatio)
• tests: avoid reuse of authenticator fixture between tests and add docstring #254 (@consideRatio)
• Fix incorrect log message (debug level) #252 (@consideRatio)
• refactor: reduce use of temporary variables like msg for logging #251 (@consideRatio)
• refactor: put validation logic in traitlets validation functions #250 (@consideRatio, @minrk)
• Update ldap testing server to the latest available version #247 (@consideRatio)
• Require jupyterhub 4.1.6+ and Python 3.9+ #245 (@consideRatio, @minrk)
• Fix traitlets warnings when running tests #169 (@kinow, @minrk, @manics)

Documentation improvements

• Docs updates, and a few tweaks to the allow config #286 (@manics, @minrk)
• docs: update a few config descriptions #279 (@consideRatio)
• docs: fix readme example based on investigation by MakarovDi #262 (@consideRatio)
• docs: add two docstrings and fix an example in another #248 (@consideRatio)
• Update README.md with details on jupyterhub_config.py #242 (@jdkruzr, @consideRatio)
• Update README.md #228 (@ehooi, @yuvipanda)
• Add study participation notice to readme #197 (@sgibson91, @yuvipanda, @manics)

Continuous integration improvements

• ci: test jupyterhub 5 and python 3.12, refresh github workflows #244 (@consideRatio)
• ci: fix testing ldap server port mapping for broken gate #192 (@bloodeagle40234, @manics)
• ci: Replace Travis with GitHub workflow #188 (@manics, @consideRatio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@1kastner (activity) | @Aethylred (activity) | @bloodeagle40234 (activity) | @brindapabari (activity) | @consideRatio (activity) | @Cronan (activity) | @dhirschfeld (activity) | @dmpe (activity) | @edergillian (activity) | @ehooi (activity) | @GlennHD (activity) | @healinyoon (activity) | @jdkruzr (activity) | @kinow (activity) | @loic-vial (activity) | @m-erhardt (activity) | @mananpreetsingh (activity) | @manics (activity) | @mannevijayakrishna (activity) | @marcusianlevine (activity) | @marty90 (activity) | @minrk (activity) | @mk-raven (activity) | @Nikolai-Hlubek (activity) | @nylocx (activity) | @ordlucas (activity) | @Ownercz (activity) | @ragul-inv (activity) | @reinierpost (activity) | @sebastian-luna-valero (activity) | @sgibson91 (activity) | @wiltonsr (activity) | @wsuzume (activity) | @ygean (activity) | @yuvipanda (activity)

1.3

1.3.2 - 2020-08-28

Fixes

• Exchanging ldap3 constants in if/else (#175) (@1kastner)

1.3.1 - 2020-08-13

Fixes

• Pin ldap3 version to lower than 2.8 (#172) (@1kastner)

1.3.0 - 2020-02-09

Fixes

• Avoid binding the connection twice #142 (@m2hofi94)
• Gracefully handle username lookups with list return values #117 (@metrofun)
• Misc cleanup + fixes #95 (@dhirschfeld) - Empty DN templates are now ignored, search_filter and allowed_groups are no longer mutually exclusive.

Improvements

• Allow authentication with empty bind_dn_template when using lookup_dn #106 (@behrmann)
• Ignore username returned by resolve_username #105 (@behrmann) - use_lookup_dn_username configuration option added.
• Lookup additional LDAP user info #103 (@manics) - user_info_attributes is now saved in auth_state for a valid user.

Maintenance

• Fix CI linting failures and add testing of Py38 #157 (@consideRatio)
• Add long description for pypi #155 (@manics)
• Add badges according to team-compass #154 (@consideRatio)
• Travis deploy tags to PyPI #153 (@manics)
• Add bind_dn_template to Active Directory instructions #147 (@irasnyd)
• Expand contributor's guide #135 (@marcusianlevine)
• Add Travis CI setup and simple tests #134 (@marcusianlevine)
• Update project url in setup.py #92 (@dhirschfeld)
• Update README.md #85 (@dhirschfeld)
• Bump version to 1.2.2 #84 (@dhirschfeld)

Contributors to this release

(GitHub contributors page for this release)

@behrmann | @betatim | @consideRatio | @dhirschfeld | @irasnyd | @m2hofi94 | @manics | @marcusianlevine | @meeseeksmachine | @metrofun | @ramkrishnan8994 | @titansmc | @yuvipanda

1.2

1.2.2 - 2018-06-14

Minor patch release for incorrectly escaping commas in resolved_username

Fixes

• Fix comma escape in resolved_username #83 (@dhirschfeld)

Improvements

• Add manifest to package license #74 (@mariusvniekerk) - Adds license file to the sdist

Contributors to this release

(GitHub contributors page for this release)

@dhirschfeld | @mariusvniekerk

1.2.1 - 2018-06-08

Minor patch release for bug in resolved_username regex.

Fixes

• Fix resolved_username regex #75 (@dhirschfeld)

Improvements

• Improve packaging #77 (@dhirschfeld) - Decoupled runtime dependencies from the build process

Maintenance

• Minor cleanup of setup.py #73 (@dhirschfeld)

Contributors to this release

@dhirschfeld

1.2.0 - 2018-06-07

Merged PRs

• Escape comma in resolved_username #68 (@dhirschfeld)
• Fixed really bad error #64 (@jcrubioa)
• Don't force TLS bind if not using SSL. #61 (@GrahamDumpleton)
• Catch exception thrown in getConnection #56 (@dhirschfeld)
• Update LICENSE #48 (@fm75)
• Switching to StartTLS instead of ssl #46 (@toxadx)
• Add yuvipanda's description of local user creation #43 (@willingc)
• Update ldapauthenticator.py #40 (@sauloal)
• import union traitlet #34 (@dirkcgrunwald)
• User CN name lookup with specific query #32 (@mateuszboryn)
• Add better documentation for traitlets #26 (@yuvipanda)
• Extending ldapauthenticator to allow arbitrary LDAP search-filters #24 (@nklever)
• Support for multiple bind templates #23 (@kishorchintal)

Contributors to this release

@beenje | @deebuls | @dhirschfeld | @dirkcgrunwald | @fm75 | @GrahamDumpleton | @jcrubioa | @kishorchintal | @mateuszboryn | @minrk | @nklever | @pratik705 | @sauloal | @toxadx | @willingc | @yuvipanda

1.1

1.1.0 - 2016-11-21

Merged PRs

• More options for ldap group membership #22 (@m0zes)
• Add info on invalidating existing logins #18 (@yuvipanda)
• Add more verbose logging for login failures #17 (@yuvipanda)
• Clarify usage of 'c.' #16 (@yuvipanda)
• Add support for looking up the account DN post-bind #12 (@skemper)

Contributors to this release

@m0zes | @minrk | @skemper | @yuvipanda

1.0

1.0.0 - 2016-03-28

Initial release.