v3.6.0

Fixes

• Fix #94: Use correct attribute for error redirect_uri. (#96) Thanks to @lucasdurand for reporting it. 🙇

Changes

• Allow RedirectUriConfig be specified in OIDCAuthentication constructor. (#97) Thanks to @em-es-ce for reporting and testing. 🙇

v3.5.1

Fixes

• Fix #89: Return error in case unsolicited authentication response. (#90) Thanks to @enkelli for reporting it. 🙇

v3.5.0

News

• Add refresh token support
  • Store access token expiry in session (#84)
  • Use refresh token to get new access token when it has expired via OIDCAuthentication.valid_access_token (#86)

v3.4.0

Changes

• The full redirect URI should be configured using OIDC_REDIRECT_URI configuration parameter. This replaces the use of OIDC_REDIRECT_DOMAIN/SERVER_NAME and/or OIDC_REDIRECT_ENDPOINT which have been deprecated.

v3.3.0

News

• Fix #78: Allow domain name to be configured without Flask SERVER_NAME. (#79) Thanks to @ralgozino for reporting it. 🙇

v3.2.0

Fixes

• Fix #66: Replace pkg_resources with importlib_resources. (#68) Thanks to @consideRatio for reporting it. 🙇
• Handle logout gracefully when no active user session. (#69) Thanks to @enkelli for reporting it. 🙇
• Fix #67: Fix silent session refresh (#70) Thanks to @fredldotme for reporting and testing! 🙇

v3.1.0

News

• Update oic dependency (#65). Thanks to @josteinl 👏

v3.0.0

News

• Allow logout endpoint to be configured (e.g. when using Flask Blueprints).
• Drop support for Python 2.
• Export flask_pyoidc for simpler imports: from flask_pyoidc.flask_pyoidc import OIDCAuthentication -> from flask_pyoidc import OIDCAuthentication
• Published documentation on ReadTheDocs.
• Published as wheel on PyPI.

v2.2.0

News

• Allow the redirect_uri endpoint to be configured. (#57) Thanks to @rgmz.

v2.1.0

News

• Allow the user session lifetime to be configured via Flask. (#35)
• Add support for implicit/hybrid flow. (#47)

Fixes

• Store the signed ID Token JWT in the user session to allow it to be forwarded in logout requests. (#32)
• Log error on unexpected 'state' returned to 'post_logout_redirect_uri'. (#33)
• Store ID Token claim 'auth_time' in user session if it's set. (#34)
• Add documentation for specifying auth request parameters. (#39)
• Don't throw exception on missing attributes in user session. (#53)
• Handle no token response after authentication response. (#54)