Skip to content

Latest commit

 

History

History
653 lines (417 loc) · 28.1 KB

CHANGELOG.md

File metadata and controls

653 lines (417 loc) · 28.1 KB
Raw

Change Log

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

3.7.3 (2019-10-01)

Bug Fixes

  • use updated jose package (1f3a251)

3.7.2 (2019-09-13)

Bug Fixes

  • typescript: add missing Strategy interface properties (c0d59c4), closes #189

3.7.1 (2019-09-09)

Bug Fixes

  • typescript: remove the need for @types/got dependency (e5a50d7)

3.7.0 (2019-09-09)

Bug Fixes

  • assert client_secret is present when required, require client_id, etc (82855a5)

Features

  • Add Typescript definitions (#184) (c37130b)
  • allow clientAssertionPayload to overwrite default payload (28c8964)

3.6.2 (2019-09-03)

Bug Fixes

  • device authorization request always pushes the client_id to body (6fbf125)

3.6.1 (2019-08-24)

Bug Fixes

  • ignore runtime unsupported or malformed issuer jwks (f08b8be)

3.6.0 (2019-08-24)

Features

  • add RFC8628 - OAuth 2.0 Device Authorization Grant (Device Flow) support (adb4b76)
  • allow multiple resource parameters in authorization requests (dfdd8cb)

3.5.0 (2019-08-22)

Features

  • added Node.js lts/dubnium support for runtime supported features (54788c2)

3.4.0 (2019-08-13)

Features

  • electron v6.x runtime support (65ec619)

3.3.0 (2019-08-02)

Features

  • option to change http options globally (a1e0a3f)

3.2.3 (2019-07-18)

Bug Fixes

  • strategy: do not modify the params argument, clone it instead (4731d29), closes #177

3.2.2 (2019-07-12)

Bug Fixes

  • give AAD v2 organizations and consumers same treatment as common (4891b5b), closes #175

3.2.1 (2019-07-10)

Bug Fixes

  • plug reported lodash vulnerability (b690dac)

3.2.0 (2019-06-27)

Features

  • feat: added support for direct symmetric key encryption alg (dir) (f1b4282)

3.1.2 (2019-06-21)

Bug Fixes

  • ensure runtime @panva/jose dependency ^1.3.0 (d992deb)

3.1.1 (2019-05-15)

Bug Fixes

  • passport strategy runtime authenticate parameters regression (36e741e), closes #167

3.1.0 (2019-05-13)

Features

  • add helpers for generating secure random values & PKCE challenges (44f1865)

3.0.0 (2019-05-11)

Bug Fixes

  • authorizationParams no longer requires nonce for response_type=token
  • issuer's auth signing algs presence is now asserted if client is missing the relevant metadata property
  • unintended (client|issuer).metadata[property] reassignment is no longer possible
  • refreshed encrypted ID Tokens are now properly decrypted
  • userinfo_endpoint presence on an issuer is now asserted during userinfo function call
  • PBES2 symmetric encryption and decryption now correctly uses the client_secret value rather then its SHA digest
  • Accept header is now correctly set for all requests
  • clients configured to receive signed and/or encrypted userinfo endpoints will now correctly reject a response that isn't proper application/jwt

Features

  • Typed Errors - openid-client now has unique errors for HTTP transport related errors, OP/AS returned errors and RP(client-side) assertions.
  • common configuration issues are now gracefully handled. I feel like many developers may be setting properties like redirect_uri or response_type on a client instance. I sympathize and openid-client will now take these common mistakes and accomodate.
  • QoL #client.authorizationParams() will now attempt to resolve the redirect_uri and response_type from your client's metadata. If there's only one listed, it will be used automatically. If there's more, you must continue providing it explicitly.
  • per-request http request options helper function HTTP request options can now be modified on a per request basis for the different classes or their instances. This now allows each request's options to be altered on-demand with e.g. client mutual-TLS certificates or implementing work arounds for specific AS quirks.
  • mutual-TLS client authentication is now supported through the above mentioned helper for both client-authentication and proof-of-possession purposes.
  • custom request bodies Where the above per-request helper falls short is providing extra token endpoint exchange parameters like resource to authorization code or refresh token exchange, you can now pass those in the actual client methods.
  • custom client assertion payloads You can now pass extra claims to the client authenticated calls e.g. token, introspect, revoke.
  • request objects are now set to be one-time use Generated Request Objects are secure by default they include iat, exp and jti claims so that OPs have a way to make them one-time use depending on their policy.
  • EdDSA support OKP JSON Web Keys and EdDSA signing and verification is now supported.

BREAKING CHANGES

  • openid-client now uses @panva/jose for all things JOSE. As a result of this the minimum required node version is v12.0.0 and the client will now only function in node.js environments.
  • Issuer.defaultHttpOptions getter and setter were removed. See documentation customization section for its replacement.
  • client.CLOCK_TOLERANCE client property was removed. See documentation customization section for its replacement.
  • client.authorizationCallback() has been renamed to client.callback()
  • tokenset.claims getter is now a function tokenset.claims()
  • useRequest and useGot methods were removed, with the maintenance mode and inevitable deprecation of the request module i've decided to only support got as an http request library.
  • Instead of passing jose library keystore instances with private keys the API now expects a JWKS formatted object. keystore options argument properties are now called just jwks.
  • response_type=code is no longer defaulted to in #client.authorizationUrl() if your client instance has multiple response_types members.
  • Strict === equality operator is now used for assertions, while unlikely the breaking change is that should some ID Token claims be correct values but incorrect type, these will start failing now.
  • #client.revoke() no longer returns or in any way processes the response body as per spec requirements.
  • All http(s) responses are now strictly checked for the expected http response status code.
  • All http(s) requests now assert that an absolute URL is being requested.
  • Passport Strategy will now fail when userinfo is requested via the verify callback arity but no access token is returned from the OP.

2.5.0 (2019-04-29)

Bug Fixes

  • key lookup cache is now working as intended (90d2f2a), closes #162

Features

  • add support for azure ad v2 multitenant apps (24486dd), closes #148

2.4.5 (2018-11-05)

Bug Fixes

  • upgrade min node-jose version to fix its performance in node (e682dfc)

2.4.4 (2018-10-18)

Bug Fixes

2.4.3 (2018-10-10)

Bug Fixes

  • assign Discovery 1.0 defaults when discovering with .well-known (74b593e)

2.4.2 (2018-09-27)

Bug Fixes

  • non-string error responses are not treated as OpenIdConnectError (782d464), closes #125

2.4.1 (2018-09-16)

Bug Fixes

  • lts/boron unsupported syntax fix (5289188)

2.4.0 (2018-09-16)

Bug Fixes

  • OpenIdConnectError also returns session_state (95fae3d)
  • stop sending state on the authorisation code token grant (c4c9e50)

Features

  • add RP-Initiated Logout URL helper (7c2e030), closes #116

2.3.1 (2018-08-23)

Bug Fixes

  • apply safer, simpler www-authenticate parsing regex (ffce55a)
  • only assign Discovery 1.0 defaults when Issuer is discovered (dca60b8)

2.3.0 (2018-08-11)

Features

  • authorization response parameter checking based on response_type (6e0ac57)
  • passport strategy automatically checks response REQUIRED params (902eeed)

Pre standard-version Change Log

Version 2.2.x

Version 2.2.1

  • 2018-07-10 DIFF
  • improved discovery support of custom .well-known suffixes
  • chores - refactoring, missing tests, cleanup

Version 2.2.0

Version 2.1.x

Version 2.1.1

  • 2018-06-28 DIFF
  • fixed handling of bearer endpoint responses with www-authenticate headers only. fixes #102

Version 2.1.0

  • 2018-05-31 DIFF
  • node-jose dependency bumped to major ^1.0.0 - fixes A\d{3}GCMKW symmetrical encryption support
  • dependency updates

Version 2.0.x

Version 2.0.4

  • 2018-05-25 DIFF
  • fixed circular when serializing OpenIdConnectError
  • base64url dependency update

Version 2.0.3

  • 2018-05-15 DIFF
  • base64url dependency replaced

Version 2.0.2

  • 2018-05-10 DIFF
  • dependency tree updates

Version 2.0.1

  • 2018-04-26 DIFF
  • fixed client_secret_basic requiring the username and password tokens to be x-www-form-urlencoded according to https://tools.ietf.org/html/rfc6749#section-2.3.1
    • NOTE: Although technically a fix, this is a breaking change when used with providers that also don't currently follow the standard. A proper way of submitting client_id and client_secret using client_secret_basic is Authorization: base64(formEncode(client_id):formEncode(client_secret)). If your client_id and client_secret does contain special characters that need encoding this does not affect you. If it does, try using client_secret_post instead.

Version 2.0.0

  • 2018-04-12 DIFF
  • dropped support for Node.js v4.x due to its End-of-Life on 2018-04-30
  • removed deprecated client#grantAuth
  • removed deprecated way of passing keystore directly to Client#register
  • removed support for passing client to OpenIDConnectStrategy as single argument, use new Strategy({ client }) instead of new Strategy(client).
  • fixed a bug requiring nonce to be passed for response_type=none

Version 1.20.0

  • 2018-03-13 DIFF
  • added documentation for OpenIdConnectError
  • added error_uri from IdP responses to OpenIdConnectError instances
  • fixed OpenIdConnectError messages to include error_description

Version 1.19.x

Version 1.19.5

  • 2018-03-10 DIFF
  • Issuer.discover now parses the provided URI instead of just inspecting the string. #80

Version 1.19.4

  • 2018-01-30 DIFF
  • fixed edge cases of (and simplified) private id token decryption method

Version 1.19.3

  • 2018-01-22 DIFF
  • fix return values of #authorizationCallback() for response_type=none to resolve a TokenSet

Version 1.19.2

  • 2018-01-16 DIFF
  • fixed authorizationUrl to respect existing issuer authorization_endpoint query parameters

Version 1.19.1

  • 2018-01-15 DIFF
  • adjusted the passport state mismatch related error message to hint developers at a local setup issue

Version 1.19.0

  • 2017-12-12 DIFF
  • added maintained request wrapper and a simple api to use request instead of got

Version 1.18.x

Version 1.18.2

  • 2017-12-05 DIFF
  • bumped node-jose dependency

Version 1.18.1

  • 2017-11-25 DIFF
  • fixed the order of several assert.equal calls to swap actual/expected descriptions
  • added assertion error messages for passport strategy

Version 1.18.0

  • 2017-11-19 DIFF
  • added option for the passport strategy to use PKCE
  • updated http request library got dependency

Version 1.17.0

  • 2017-10-31 DIFF
  • now uses client_secret_post as default for Issuer instances that do not support client_secret_basic but do signal support for client_secret_post in their discovery document

Version 1.16.0

  • 2017-10-13 DIFF
  • added s_hash value validation support for ID Tokens returned by authorization endpoint
  • fixed edge cases where valid _hash but from invalid sha-length was accepted

Version 1.15.0

  • 2017-09-11 DIFF
  • added support for Request Objects encrypted with symmetrical keys
  • fixed PBES2 encryption to use client_secret derived symmetrical key instead of its full octet value

Version 1.14.0

  • 2017-09-09 DIFF
  • added Passport Strategy passReqToCallback option, defaults to false

Version 1.13.0

  • 2017-08-24 DIFF
  • added an optional keystore argument to Client#fromUri(uri, token, [keystore]) to pass a keystore with private asymmetrical keys
  • fixed keystore check during constructor Client#new calls to check that only private asymmetrical keys are added

Version 1.12.0

Version 1.12.1

  • 2017-08-11 DIFF
  • explicitly specified accepted response type via accept: application/json header
  • added state to token_endpoint calls for servers supporting mixup mitigation

Version 1.12.0

  • 2017-07-17 DIFF
  • Allow session key to be specified in passport strategy options

Version 1.11.0

Version 1.11.1

  • 2017-07-14 DIFF
  • relaxed #callbackParams to allow IncomingMessage lookalikes
  • update internal dependencies

Version 1.11.0

  • 2017-05-19 DIFF
  • fixed default application_type from ['web'] to 'web'
  • added barebones Issuer.httpClient setter to help advanced developers in complex environments to change the used http request client

Version 1.10.0

  • 2017-05-04 DIFF
  • added pure OAuth 2.0 stripped down callback function #oauthCallback
  • added an extra option for #userinfo requests to have extra params in either query or body

Version 1.9.0

  • 2017-04-30 DIFF
  • added introspection/revocation specific client and issuer properties. To remain backwards compatible they default to their token endpoint counterparts
    • issuer.revocation_endpoint_auth_methods_supported
    • issuer.introspection_endpoint_auth_methods_supported
    • issuer.revocation_endpoint_auth_signing_alg_values_supported
    • issuer.introspection_endpoint_auth_signing_alg_values_supported
    • client.revocation_endpoint_auth_method
    • client.introspection_endpoint_auth_method
    • client.revocation_endpoint_auth_signing_alg
    • client.introspection_endpoint_auth_signing_alg

Version 1.8.0

Version 1.8.2

  • 2017-04-29 DIFF
  • bumped node-jose dependency to avoid github tar.gz dependencies
  • adjusted token_endpoint_auth_method=none to how it should be

Version 1.8.0

  • 2017-04-07 DIFF
  • Issuer and Client now recognize custom properties, this is so that new Registry Contents do not require a new release of openid-client to be picked up. Custom properties are exposed as getters so long as they do not interfere with the object's Prototype and they are always available in #metadata getter.

Version 1.7.0

Version 1.7.2

  • 2017-03-28 DIFF
  • added missing check for webfinger issuer location protocol

Version 1.7.1

  • 2017-03-28 DIFF
  • added authorizationCallback support for submitting code_verifier
  • example now includes session management OP and RP frames

1.7.0 failed to publish properly, use 1.7.1 instead

Version 1.6.0

Version 1.6.4

  • 2017-03-14 DIFF
  • fixed receiving (correct) empty responses from revocation endpoints (#21)

Version 1.6.3

Version 1.6.2

  • 2017-03-09 DIFF
  • fixed verify callback skipping userinfo when userinfo_endpoint is not configured (#19)
  • removed mandatory checks from passport strategy, allowing i.e. implicit only OPs (#19)

Version 1.6.1

  • 2017-03-07 DIFF
  • fixed verify callback skipping userinfo call when arity says it should but no access token is present (#18)

Version 1.6.0

  • 2017-02-15 DIFF
  • added at_hash presence assertion for applicable (implicit) ID Token validation
  • added c_hash presence assertion for applicable (hybrid) ID Token validation from the authorization_endpoint

Version 1.5.0

Version 1.5.3

  • 2017-02-15 DIFF
  • fixed an ID Token validation for ID Token returned by Token Endpoint that includes c_hash

Version 1.5.2

  • 2017-02-01 DIFF
  • fixed passport strategy, have it use prototype instead of ES6 class syntax

Version 1.5.1

  • 2017-01-29 DIFF
  • fixed client_assertion aud claim for _jwt auth methods when used in introspection and revocation

Version 1.5.0

  • 2017-01-26 DIFF
  • added a passport.js strategy
  • added missing max_age, default_max_age related functionality
    • authorizationCallback now supports max_age check
    • clients with default_max_age use this default value automatically
    • when max_age is checked auth_time claim is mandatory and must be a number
  • added missing require_auth_time related functionality
    • clients with require_auth_time = true have the presence and format of auth_time claim validated
  • authorizationUrl and authorizationPost now removes null and undefined values and ensures parameters are stringified before passed to url.format
  • added client.CLOCK_TOLERANCE property, to allow for clock skew (in seconds)

Version 1.4.0

  • 2017-01-10 DIFF
  • deprecated passing keystore directly to Client#register, pass an object with keystore property instead
  • added the option to provide InitialAccessToken value to Client#register

Version 1.3.0

Version 1.3.1

  • 2016-12-18 DIFF
  • added error messages when expected response is missing

Version 1.3.0

  • 2016-12-13 DIFF
  • added #requestObject method to Client to return signed and/or encrypted Request Object

Version 1.2.0

  • 2016-12-09 DIFF
  • added #claims getter to TokenSets returned from authorizationCallback and refresh;

Version 1.1.0

  • 2016-11-23 DIFF
  • fixed unpacking aggregated claims with alg=none and no iss claim
  • fetching distributed claims now expects a JWT response, previously expected invalid OP responses

Version 1.0.0

Version 1.0.2

  • 2016-11-22 DIFF
  • fixed signed userinfo response validation in case iss, aud and similar ID Token claims are missing

Version 1.0.1

  • 2016-11-18 DIFF
  • Updated uuid dependency

Version 1.0.0

RP test tools are passing, no changes required from the library, API is declared stable, hence 1.0.0 release.

Migrating from 0.x to 1.0

  1. update your package.json file to "^1.0.0"
  2. sit back and relax, no breaking changes

pre 1.x changelog

4. Major version zero (0.y.z) is for initial development. Anything may change at any time.
   The public API should not be considered stable.

5. Version 1.0.0 defines the public API.