Mercurial > hg > orthanc-authorization
view NEWS @ 154:ae1bd3d15f81
add GET argument tokens as HTTP headers in the query to the auth-service
author | Alain Mazy <am@osimis.io> |
---|---|
date | Mon, 18 Mar 2024 14:52:33 +0100 |
parents | 3683f3d083bd |
children | 9434bb40e27c |
line wrap: on
line source
Pending changes in the mainline =============================== * Added missing parsing of /dicom-web/studies/.../instances * Clarification: the "authorized_labels" field of the user profile is actually a list of studies authorized labels ! * The tools/find has been updated to take this into account and will possibly refuse to perform tools/find at instance or series level if there is no StudyInstanceUID in the query. This fixes forbidden access to e.g. /dicom-web/studies/../series/../instances/.. on studies that have at least one authorized_labels. * The GET argument tokens are now also added as HTTP headers in the query to the auth-service (this was already done only for Header tokens). 2024-02-16 - v 0.7.0 ==================== * Added new default permissions "SINGLE_RESOURCE_PATTERNS" and reorganized the permissions accordingly. This notably facilitate accessing a single resource with a user token. The plugins first check that the user has the right permissions to access the route and then, the plugins check if the study has one of the authorized_labels of the user. This notably improves user token handling outside of OE2 e.g when using api-key. 2023-12-19 - v 0.6.2 ==================== * Now handling new GET /tools/create-archive and sibling routes. 2023-11-13 - v 0.6.1 ==================== * Updated default "Permissions" configuration to take the "/merge" routes into account. * Now overriding /tools/find and /tools/labels only if the auth-service is providing user profiles ("WebServiceUserProfileUrl" has been configured). 2023-09-18 - v 0.6.0 ==================== * Now handling permissions based on labels from a user profile: - filter the results from tools/find to grant access only to the authorized_labels from the user profile - grants access to resources (studies) based on their labels and the authorized_labels from the user profile. - check the https://github.com/orthanc-team/orthanc-auth-service sample project for more details * Added integration tests in the https://orthanc.uclouvain.be/hg/orthanc-tests/ repository. 2023-06-21 - v 0.5.3 ==================== * New standard configuration "ohif" * new default permissions for labels * Fix parsing of dicom-web/studies/../series/../instances/../bulk/.. routes 2023-05-15 - v 0.5.2 ==================== * Fix standard configuration "orthanc-explorer-2": consider the "token" Get arguments 2023-04-15 - v 0.5.1 ==================== * Added a default permission for /toolk/bulk-delete * Added a default permission for /changes * Added a default permission for /auth/tokens/ohif-viewer-publication * QIDO-RS now supports named tags in get arguments 2023-03-17 - v 0.5.0 ==================== * BREAKING-CHANGE: the API between the authorization plugin and the WebService has slightly changed. Check the samples in the README (TODO). - "identifier" has been renamed into "server-id" * new user-permission based authorization model. This is enabled if you define the new "WebServiceUserProfileUrl" configuration. * new "orthanc-explorer-2" StandardConfigurations * new GET "auth/user/profile" Rest API route to retrieve user permissions * new PUT "auth/tokens/{token-type}" Rest API route to create tokens * new POST "auth/tokens/decode" Rest API route to decode tokens * these 3 new routes required an updated auth-web-service. * SECURITY FIX: in prior versions, it was possible to browse remote dicom-web servers without being authenticated. (The API routes /dicom-web/servers/.../studies were unprotected). The local dicom-web server was correctly protected. 2022-11-16 - v 0.4.1 ==================== * fix: get argument values were transformed to lower case * the "osimis-web-viewer" StandardConfigurations now take into account the token get argument used when downloading a study from the UI 2022-11-10 - v 0.4.0 ==================== * new configuration option "CheckedLevel" that is clearer than "UncheckedLevels". "UncheckedLevels" remains for backward compatibility. Allowed values: "patients", "studies", "series", "instances" * new configuration option "StandardConfigurations" to replace multiple configurations. Allowed values: "osimis-web-viewer", "stone-webviewer" * added support for QIDO-RS query arguments (e.g: /dicom-web/studies?0020000D=1.2.3&...) * possible BREAKING_CHANGE: if "TokenHttpHeaders" is set to "Authorization" and if "WebServiceUsername" is defined, the "Authorization" header of the HTTP request sent to the auth-service will contain the basic auth info from WebServiceUsername and WebServicePassword. You should get the "Authorization" value from the token-value field of the payload sent to the auth-service. 2022-09-26 - v 0.3.0 ==================== * Added 3 new configurations: WebServiceUsername, WebServicePassword, WebServiceIdentifier. * The WebServiceIdentifier is now included in the payload sent to the WebService as the "identifier" field. 2022-05-13 - v 0.2.5 ==================== * Fix osimis-viewer route 2020-12-10 - v 0.2.4 ==================== * Added support for Osimis Web Viewer new route (osimis-viewer/custom-command/) * Support of dynamic linking against the system-wide Orthanc framework library 2018-08-13 - v 0.2.3 ==================== * Compatibility with Linux Standard Base * Now using the Orthanc framework 2018-07-19 - v 0.2.2 ==================== * Added automated build 2018-03-09 - v 0.2.1 ==================== * Upgraded sdk to 1.3.1 2018-03-08 - v 0.2.0 ==================== * Added support for Osimis Web Viewer 2017-03-22 ========== * Initial release