aleksis/AlekSIS-Core
Watch
10
0
Fork
You've already forked AlekSIS-Core
 0
Code Issues 201 Pull requests 58 Projects Releases 14 Packages 1 Wiki Activity Actions

Password Grant in DOT 4.0 #4013

New issue
Open
opened 2026-10-01 23:04:24 +02:00 by nik · 0 comments
nik commented 2026-10-01 23:04:24 +02:00
Owner
Copy link
2026-10-01 23:03:33,324 WARNING oauth2_provider[31]: The OAuth 2.0 resource owner password credentials grant is discouraged by RFC 9700 (OAuth 2.0 Security Best Current Practice). It is currently allowed because OAUTH2_PROVIDER["COMPLIANT_BCP_RFC9700_PASSWORD_GRANT"] is False; this default is scheduled to change to True in django-oauth-toolkit 4.0. Set OAUTH2_PROVIDER["COMPLIANT_BCP_RFC9700_PASSWORD_GRANT"] to True to adopt the compliant behavior now.
```plain 2026-10-01 23:03:33,324 WARNING oauth2_provider[31]: The OAuth 2.0 resource owner password credentials grant is discouraged by RFC 9700 (OAuth 2.0 Security Best Current Practice). It is currently allowed because OAUTH2_PROVIDER["COMPLIANT_BCP_RFC9700_PASSWORD_GRANT"] is False; this default is scheduled to change to True in django-oauth-toolkit 4.0. Set OAUTH2_PROVIDER["COMPLIANT_BCP_RFC9700_PASSWORD_GRANT"] to True to adopt the compliant behavior now. ```
nik changed title from Password Grant in Django 4.0 to Password Grant in DOT 4.0 2026-10-01 23:28:53 +02:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
4020-add-getobjectsforperson
4000-adapt-calendarfeedfield
3981-get-i18n-namespace-across-apps
weblate-frontend
bug/3973
release/5.4.0
fix/vite-build-2
aleksolotl-checks
remove-vite-legacy-plugin
renovate/selenium-4.x
renovate/node-26.x
renovate/django-health-check-4.x
1643-calendar-dashboardwidgets-throw-500er-error
renovate/django-dbbackup-5.x
1064-backchannel-logout
sis2-with-sl
fix/adapt-some-urls
1533-notifications-reminders-for-events-todos
1294-expose-free-busy-state-in-ui-for-personal-events
1303-correctly-implement-recurring-todos-with-amends-recurrence-id
1345-introduce-annotate-methods-for-more-person-related-rules
1603-search-index-is-deleted-on-cache-flush
1068-oidc-rp-initiated-registration
1065-oidc-device-code-grant-flow
1599-vite-build-fails-with-too-many-apps
fix/sort-models
1066-oidc-dynamic-client-registration
tmp-ticdesk-dev
ticdesk-search-map
cherry-pick-2b8d2e01
643-one-time-login-links
1461-birthday-calendar-oom
tmp-ticdesk-related-names-for-paweljong
1459-manifest-json-not-found
integrate-disable-into-usecrud
update-container-image-base-to-trixie
check/update-pyproject-toml
check/update-builddeps-package-json
check/update-prettier-ignore
1445-todo-list-broken
1364-track-date-of-beginning-and-end-of-group-membership
1259-generalise-places
use-object-form-reactivity
1435-cruddaylist-does-not-detect-changes-in-existing-intervals
tmp-ticdesk
stable/4.0.0
1366-frontend-for-creating-and-modifying-generic-personrelationships
master-without-vue-3
1376-expand-row-feature-of-v-data-table-doesn-t-work-when-items-include-date-time-objects
release/4.1.0.dev2
1372-fix-import-of-crudlist
1353-adapt-chipselectfield
check/update-eslint-rc-js
check/update-tox-ini
improve-selenium-startup
1268-add-specific-availability-planning-frontend
1343-fix-person-related-permissions
newer-and-rebased-migrate-crud-to-vue-3-and-generalize
1314-fix-handling-of-end-datetime-in-calendar-events-query
migrate-to-uv
tmp-ticdesk-4-0
fix-inline-crud-list-is-create
tmp-split-calendar-event-dialog
release/4.1.0
1260-refactor-account-registration-form-and-generalize-parts-of-it
add-datacheck-fix-in-changelog
1232-group-calendars
1251-registryobjects-are-their-own-parent-registries
1209-introduce-django-rest-framework-serializers
1162-strange-behaviour-with-personal-events
revert-7fe8b8b1
check/delete-eslint-rc-js
check/update-gitignore
stable-3.2
stable-3.1
update/eslint
1158-add-sorting-functionality-to-get_single_events
1055-introduce-sub-school-terms
1082-colorfield-sometimes-returns-8-digit-alpha-color-hex-code
test-build
emit-extracted-items-from-save-event
886-prevent-graphql-query-mutation-name-collisions
release/3.2.1
1038-make-dialogobjectform-send-a-diff-on-edit-instead-of-the-whole-object
release/3.1.6
fix/counter-chip
1021-allow-matching-of-social-accounts-to-local-accounts-by-email
991-set-title-attribute-for-all-unclear-frontend-spots
update-docs-without-release-distribution
850-do-not-restart-vite-serve-on-every-uwsgi-reload
991-use-tooltips-for-all-unclear-frontend-spots
983-add-groups-by-person-query
826-otp-token-emails-don-t-contain-anything-besides-the-token
781-error-if-creating-a-new-school-term-without-a-start-and-end-date
966-allow-setting-of-custom-queryset-when-creating-calendar-feeds
tmp-for-add-simple-course-book-list
release/3.2.0
868-introduce-uuid-field-for-extensiblemodel
958-introduce-parent-model-resource
954-evaluate-strawberry-and-strawberry-django
948-error-handling-with-personal-event-creation-is-not-usable
fix-custom-events-fss
923-introduce-vue-styleguidist
899-move-person-type-fields-into-constant
892-remove-model-extension-api
manage-holidays
831-data-management-for-the-model-room
fix/oauth-toolkit-migration
release-3.0
stable-2.12
819-fix-some-minor-issues-in-graphql-queries
fix-container-image
stable-2.11
stable-2.10
stable-2.13
806-expose-string-representation-of-models-via-graphql-api
800-move-generic-components-from-aleksis-app-plank-to-core
debug-foo
oidc-docs
migrate-to-vue3
789-remove-syncable-fields
remove/ical-feed
194-enable-async-framework-channels
726-dynamically-build-vue-forms
766-selfclosing-components-in-vue_base-html-break-the-page
492-follow-up-view_persons_rule-not-usable-due-to-use-of-queryset_rules_filter
751-include-fields-of-non-extensible-model-in-syncable-fields
kort-core
feature/vuejs
717-docker-improve-image-size-by-fixing-cleanup-layer
build-improvements
697-3-0-meta-issue-for-graphql-back-end-and-vue-js-frontend
185-create-notifications-for-announcement
stable-2.7
update/translation-files-13
update/translation-files-12
599-add-oauth-oidc-tests
i10n-ru-ua
tmp/cbes
do-release-2.9
docs/notifications
180-add-template-management
fix-import
653-remove-cachalot
635-test-e-mail-button
397-dedicated-public-dashboard
396-external-link-widet-auto-discovery
511-allow-custom-redirect-uri-schemes
update/translation-files-8
585-barcode-widget-for-person-fields
dot-1.6.2
281-corporate-design-for-html-mails
592-oauth2-broken-in-2-4
574-rewrite-password-change-templates
reduce-docker-steps
571-age-calculation-broken
559-oauth-add-feature-to-limit-apps-to-groups
feature/push-notifications
feature/i18n-maintenance
fix/oauth-skip-auth-detail
523-integrate-sentry-for-performance-and-error-tracing
prepare-release-2.1.dev0
release/2.0
387-jwt-provider-consumer-support
update/translation-files
496-service-worker-safari-does-not-support-broadcastchannel-api
group-members-permissions
prepare-release-2.0b2
fix/trans-conflicts
bp-2.0-use-importlib-instead-of-pkg-resources
update/translation-files-2.0b0-1
test-migration-test
376-prevent-deep-linking-to-media-files
feature/build-icons-automatically
421-update-to-django-3-2
set-sast-config-1
feature/test-selenium-capabilities
arg-apps
feature/review-app
test-docker-app-version
feature/allow-app-source
fix-ci-config
feature/curlylint
feature/gin-index-on-ext-data
backup-over-ssh
feature/keep_local_password_ldap
340-correctly-implement-the-ckeditor
143-mark-menu-entries-as-active-with-sub-sub-menu-entries
feature/django-notifs
2021-update-copyright
catch-error
update/poetry
selenium
269-photo-cropping-broken-2
269-photo-cropping-broken
fix-docker-build
has-person
update-poetry-lockfile
pages-staging
mix/conn-dne
236-support-saml-and-oauth2-logins-as-consumer
feature/custom-auth-backends-dev
dev
fix-isort
214-add-notification-dashboard-widget-anything-to-notify-of-upcoming-birthdays
157-include-django-letsagree
215-add-geolocation-of-persons
267-lint-add-spell-check
291-rename-template-references
270-ci-replace-kaniko-with-buildah
217-add-support-for-defining-group-types
feature/docker-extras
153-use-complex-name-field-with-i18n-support
debug-docker-build
feature/material-admin
pages-jonglieren
179-group-contact
169-support-nextcloud-talk-for-notifications
develop-dashboard-feeds
134-merge-dashboard-ajax
6.1.0
6.0.1
6.0.0
5.4.1
5.4.0
5.3.0
5.2.0
5.1.0
5.0.3
5.0.2
5.0.1
5.0.0
5.0.0b3
5.0.0b2
5.0.0b1
5.0.0b0
4.1.0.dev2
4.0.4
4.1.0.dev1
4.1.0.dev0
4.0.3
4.0.2
4.0.1
4.0.0
4.0.0.dev16
3.2.2
3.1.7
4.0.0.dev15
4.0.0.dev14
4.0.0.dev13
4.0.0.dev12
4.0.0.dev11
3.1.6
3.2.1
4.0.0.dev10
4.0.0.dev9
4.0.0.dev8
4.0.0.dev7
4.0.0.dev6
4.0.0.dev5
4.0.0.dev4
4.0.0.dev3
4.0.0.dev2
4.0.0.dev1
3.2.0
3.1.5
3.1.4
3.1.3
3.1.2
3.1.1
3.1
3.0
2.12.4
3.0b3
3.0b2
2.10.3
2.11.2
2.12.3
3.0b1
3.0b0
3.0.dev3
2.12.2
3.0.dev2
2.12.1
2.12
2.11.1
2.11
2.10.2
3.0.dev1
2.10.2.dev0
3.0.dev0
2.10.1
2.10
2.7.6
2.7.5
2.9
2.8.2.dev2
2.8.2.dev1
2.8.2.dev0
2.8.1
2.8.1.dev0
2.8
2.7.4
2.7.3
2.7.2
2.7.1
2.7
2.6
2.5
2.4
2.3.2
2.3.1
2.3
2.2.1
2.2
2.1.1
2.1
2.1.dev0
2.0
2.0rc7
2.0rc6
2.0rc5
2.0rc4
2.0rc3
2.0rc2
2.0rc1
2.0b2
2.0b1
2.0b0
2.0a4
2.0a3
2.0a2
2.0a1
1.0a3.1
1.0a3
1.0a2
1.0a1
1.0a0
0.1
Labels
Clear labels   
Security

   
TeX
Needs LaTeX template

  
auto-update
  
board
done

  
board
ready

  
board
todo

  
check
delete-eslint-rc-js

  
check
update-builddeps-package-json

  
check
update-eslint-rc-js

  
check
update-gitignore

  
check
update-merge-request-template

  
check
update-prettier-ignore

  
check
update-pyproject-toml

  
check
update-renovate-json

  
check
update-tox-ini

  
part
backend
 Backend (view code, models, logic, etc.)

  
part
ci

  
part
docs
 Issue or addition to the documentation

  
part
frontend
 Frontend (templates, etc.)

  
part
i18n
 Translation or internationalisation issue

  
part
non-technical
 Non-technical (policy, maintenance, etc.) issue or discussion

  
part
packaging
 Issue concerning the packaging of AlekSIS and components

  
prio
1
 Priority High

  
prio
2
 Priority Medium

  
prio
3
 Priority Low

  
release-mr-5.x
  
size
large

  
size
medium

  
size
small

  
source
customer
 Requested by a customer or affiliated user

  
source
customer::fsmw

  
source
customer::fss

  
source
customer::teckids

  
source
downstream
 Issue or merge request from other projects using AlekSIS or parts of it

  
type
breaking

  
type
bug
 Bug

  
type
feature
 New feature

  
type
refactoring

  
workflow
blocked
 Issue is blocked by another issue

  
workflow
confirmed
 The bug is reproducible and will be fixed

  
workflow
current-todo

  
workflow
discussing
 Needs to be discussed before implementation

  
workflow
new-app
 Requires new AlekSIS app, which has to be created

  
workflow
wontfix
 The bug is not reproducible or the feature was decided against

  
source::aleksolotl
No labels
Security
TeX
auto-update
board
done
board
ready
board
todo
check
delete-eslint-rc-js
check
update-builddeps-package-json
check
update-eslint-rc-js
check
update-gitignore
check
update-merge-request-template
check
update-prettier-ignore
check
update-pyproject-toml
check
update-renovate-json
check
update-tox-ini
part
backend
part
ci
part
docs
part
frontend
part
i18n
part
non-technical
part
packaging
prio
1
prio
2
prio
3
release-mr-5.x
size
large
size
medium
size
small
source
customer
source
customer::fsmw
source
customer::fss
source
customer::teckids
source
downstream
type
breaking
type
bug
type
feature
type
refactoring
workflow
blocked
workflow
confirmed
workflow
current-todo
workflow
discussing
workflow
new-app
workflow
wontfix
source::aleksolotl
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
aleksis/AlekSIS-Core#4013
No description provided.