Skip to main content

Invenio user management and authentication.

Project description

https://img.shields.io/github/license/inveniosoftware/invenio-accounts.svg https://img.shields.io/travis/inveniosoftware/invenio-accounts.svg https://img.shields.io/coveralls/inveniosoftware/invenio-accounts.svg https://img.shields.io/pypi/v/invenio-accounts.svg

Invenio user management and authentication.

Features:

  • User and role management.
  • User registration, password reset/recovery and email verification.
  • Administration interface and CLI for managing users.
  • Session based authentication with session theft protection as well as “remember me” support.
  • Strong cryptographic password hashing with support for migrating password hashes (including Invenio v1.x) to new stronger algorithms.
  • Session activity tracking allowing users to e.g. logout of all devices.
  • Server-side session management.
  • JSON Web Token encoding and decoding support useful for e.g. CSRF-protection in REST APIs.

Invenio-Accounts relies on the following community packages to do all the heavy-lifting:

Further documentation is available on https://invenio-accounts.readthedocs.io/

Changes

Version 1.1.1 (released 2019-03-10)

  • Fixes an issue where the HTTP headers X-Session-ID and X-User-ID are added even if the value is not known. This causes ‘None’ to be logged in Nginx, instead of simply ‘-‘.

Version 1.1.0 (released 2019-02-15)

  • Added support for for adding the user id and session id of the current user into the HTTP headers (X-User-ID and X-Session-ID) for upstream servers to use. For instance, this way current user/session ids can be logged by Nginx into the web server access logs. The feature is off by default and can be enabled via the ACCOUNTS_USERINFO_HEADERS configuration variable. Note: The upstream server should strip the two headers from the response returned to the client. The purpose is purely to allow upstream proxies like Nginx to log the user/session id for a specific request.
  • Changed token expiration from 5 days to 30 minutes for the password reset token and email confirmation token. Using the tokens will as a side-effect login in the user, which means that if the link is leaked (e.g. forwarded by the users themselves), then another person can use the link to access the account. Flask-Security v3.1.0 addresses this issue, but has not yet been released.
  • Fixes issue that could rehash the user password in the adminstration interface.

Version 1.0.2 (released 2018-10-31)

  • Added AnonymousIdentity loader to app initialisation to fix the any_user Need in Invenio-Access.

Version 1.0.1 (released 2018-05-25)

  • Bumped Flask-CeleryExt from v0.3.0 to v0.3.1 to fix issue with Celery version string not being parsable and thus causing problems with installing Celery.

Version 1.0.0 (released 2018-03-23)

  • Initial public release.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for invenio-accounts, version 1.1.1
Filename, size File type Python version Upload date Hashes
Filename, size invenio_accounts-1.1.1-py2.py3-none-any.whl (58.4 kB) File type Wheel Python version py2.py3 Upload date Hashes View hashes
Filename, size invenio-accounts-1.1.1.tar.gz (109.7 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page