dyuproject-1.1.6 2009-10-08 + oauth: slight api change in TokenManager (the first arg of the method "invalidate" is changed from Token to String). This avoids creating a new Token for invalidation. The Consumer api accepts String or Token for invalidation. + oauth: fixed a validation bug when the callback url contains a port + openid: fixed a security issue/bug that can get exploited by phishing attacks. + openid: fixed YadisDiscovery bug where the service type is http://specs.openid.net/auth/2.0/signon + openid: fixed Identifier bug when a url contains a port (E.g http://example.com:8080/foo/) + openid: fixed a bug that prevents the user from authenticating when the automatic_redirect flag is false + openid: fixed duplicate extensions being registered especially on default RelyingParty instance + openid: fixed duplicate set(OpenIdUser) on request attribute in OpenIdServletFilter + openid: improved the AxschemaExtension by caching the axschema keys + openid: removed the deprecated extensions replaced by AxschemaExtension and SRegExtension + web: make non-public service methods accessible from AnnotatedResourceMethod + web: allow override of the default "/WEB-INF/application.json" location via context init-param "appcontext.resource_location" + util: methods from ArrayUtil and ReflectUtil now return generic types (was plain java.lang.Object) + util: cleaned up unused classes + all: improved overall performance of the immutable objects by marking them final. If extending the components, favor Composition over Inheritance. + all: generated serial version UIDs for all Serializable objects - was @SuppressWarnings("serial") tsk tsk. dyuproject-1.1.5 2009-08-21 + oauth: make oauth useable with hybrid protocol (OAuth + OpenID) + openid: add configurable openid.automatic_redirect when a user navigates away from his provider and back to the rp's site + openid: introduce caching for users on discovery to speed up the openid process. + openid: allow bypass of discovery for an expected provider via OpenidUser.populate method and storing the user on the request attribute + openid: set default error msg on OpenIdServletFilter if discovery using the openid_identifier returns null. + openid: use POST (was GET) on association request. + openid: make openid servlet filter more reusable via the static method "handle" + web: allow system properties to specify the configured name of default dispatcher and jsp dispatcher. + misc: update jetty-util to 6.1.19 dyuproject-1.1.4 2009-06-17 + oauth: implementation for the latest oauth spec 1.0a - http://oauth.googlecode.com/svn/spec/core/1.0a/drafts/3/oauth-core-1_0a.html The 1.0 spec was found to have a security issue - http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/ + openid: customizable axschema extension (specifying only the parameters needed) + openid: fixed openid association bug when the openid.server contains query parameters + openid: fixed simple http connector bug on POST/PUT and GET with url having existing query params + openid: new discovery alternatives: RegexHtmlBasedDiscovery and ChainedDiscovery + openid: improved html-based discovery + openid: moved AuthRedirection to RelyingParty + openid: moved common http components to dyuproject-util + openid: trim down value/length of the JSON-serialized OpenIdUser + util: allow multiple values for HttpConnector request parameters + util: CDATA support for XMLParser + util: remove unused classes + web: quote the algorithm param of the WWW-Authenticate header response from DigestAuthentication + web: simplify cookie session and use encryption instead of md5 hash signature + web: rename session config of secret_key to: session.cookie.security.secret_key dyuproject-1.1.3 2009-03-18 + Fixed YadisDiscovery bug (signon and server handling) - the actual fix for the GoogleAccount issue (removed the previous GoogleAccount workaround) + Optimized HtmlBasedDiscovery parsing set as default (faster) ... turned off via using HtmlBasedDiscovery.setOptmized(false); + refactored/improved handling when user cancels authentication + identifier field added on OpenIdUser to track the original identifier provided by user + added FormRedirection option for use when data to be sent is larger than usual. + CookieBasedUserManager's cookiePath defaults to "/" if not set dyuproject-1.1.2 2009-03-11 + GoogleAccount attribute exchange enabled by default on RelyingParty.getInstance() + update to support Google's recent service changes on authentication request (thanks Shawn Pearce) + faster HtmlBasedDiscovery parsing + fixed parsing of html documents with uncommented