Package: zope.password
zope.passwordThis package provides a password manager mechanism. Password manager
is an utility object that can encode and check encoded
passwords.Documentation is hosted athttps://zopepassword.readthedocs.io/Changes4.4 (2022-09-01)Add support for Python 3.7, 3.8, 3.9, 3.10.Drop support for Python 3.4.4.3.1 (2017-09-01)Fix runningconfigure.zcmlwhenzope.securityis installed.
Seeissue 15.4.3.0 (2017-08-31)Added abcrypt-based password manager (available only if thebcryptlibrary is
importable). This manager can also check passwords that were encoded
withz3c.bcrypt. If
that package isnotinstalled, thenconfigure.zcmlwill
install this manager as a utility with both theBCRYPT(preferred) andbcryptnames for compatibility with it. (Seehttps://github.com/zopefoundation/zope.password/issues/10)Add abcrypt_kdfpassword manager. This allows tunable numbers
of rounds. Seehttps://github.com/zopefoundation/zope.password/issues/9Fix thezpasswdconsole script on Python 3.Update thezpasswdscript to useargparseinstead ofoptparse.Usehmac.compare_digestwhen checking passwords to
prevent timing analysis. This requires Python 2.7.7 or above.Add support for Python 3.6.Drop support for Python 3.3 and Python 2.7.6 and below.Drop support forpython setup.py test.4.2.0 (2016-07-07)Drop support for Python 2.6.Converted documentation to Sphinx, including testing doctest snippets
undertox.Add support for Python 3.5.4.1.0 (2014-12-27)Add support for PyPy.  (PyPy3 is pending release of a fix for:https://bitbucket.org/pypy/pypy/issue/1946)Add supprt for Python 3.4.Add support for testing on Travis.4.0.2 (2013-03-11)Fix some final resource warnings.4.0.1 (2013-03-10)Fix test failures under Python 3.3 when warnings are enabled.4.0.0 (2013-02-21)Makezpasswda proper console script entry point.Addtox.iniandMANIFEST.in.Add support for Python 3.3Replace deprecatedzope.interface.implementsusage with equivalentzope.interface.implementerdecorator.Drop support for Python 2.4 and 2.5.Add a newIMatchingPasswordManagerinterface with a ‘match’ method,
which returns True if a given password hash was encdoded with the scheme
implemented by the specific manager. All managers in this package implement
this interface.Use “{SHA}” as the prefix for SHA1-encoded passwords to be compatible with
RFC 2307, but support matching against “{SHA1}” for backwards compatibility.Add a crypt password manager to fully support all methods named in RFC 2307.
It is contained in thelegacymodule however, to flag crypt’s status.Add a SMD5 (salted MD5) password manager to fully support all encoding
schemes implemented by OpenLDAP.Add a MySQLPASSWORD()(versions before 4.1) password manager, as also
found in Zope2’sAccessControl.AuthEncodingmodule.Remove the useless, cosmetic salt from the MD5 and SHA1 password managers,
and use base64 encoding instead of hexdigests. This makes the output of
these managers compatible with other MD5 and SHA1 hash implementations such
as RFC 2307 but doesn’t lower it’s security in any way. Checking passwords
against old, still ‘salted’ password hashes with hexdigests is still
supported.Use thestandard_base64encodemethod instead ofurl_base64encodeto maintain compatibility with LDAP.3.6.1 (2010-05-27)The SSHAPasswordManager.checkPassword() would not handle unicode input
(even if the string would only contain ascii characters). Now, theencoded_passwordinput will be encoded to ascii, which is deemed safe
as it should not contain non-ascii characters anyway.3.6.0 (2010-05-07)Removezope.testingdependency for tests.Update some copyright headers to comply to repository policy.Addzpasswdscript formerly hold in zope.app.server. Contrary to
former zpasswd script, which used “Plain Text” as default password
manager, now SSHA is used as default.3.5.1 (2009-03-14)Make security protection directives inconfigure.zcmlexecute only
ifzope.securityis installed. This will allow reuse of theconfigure.zcmlfile in environments withoutzope.security,
for example withrepoze.zcml.Add “Password Manager Names” vocabulary for use withzope.schemaandzope.component, like it was inzope.app.authentication.
It’s an optional feature so it doesn’t add hard dependency. We use
“vocabulary” extra to list dependencies needed for vocabulary functionality.3.5.0 (2009-03-06)First release. This package was splitted off fromzope.app.authenticationto separate password manager functionality that is greatly re-usable without
any bit ofzope.app.authenticationand to reduce its dependencies.