v1.13.0

Requirements

• Python 3.10–3.13 (python_requires is >=3.10).
• Django 5.2 from 5.2.17, Django 6.0 from 6.0.8, and Django 6.1 from 6.1.1.
• pysaml2 >=7.5.5, cryptography >=50.0.0, pyopenssl >=26.4.0, defusedxml >=0.4.1.

Security

• The dependency floor fixes all the known CVEs.
• The built wheel keeps djangosaml2/tests, keys, and generated HTML out of the package.

Content Security Policy

• Django 6 ContentSecurityPolicyMiddleware is used when django-csp is not installed (#431).
• The login and logout POST forms stringify csp_nonce before the template tests it, so a lazy nonce still renders.
• The logout autosubmit script receives that nonce.

Authentication request

• The HTTP-POST path passes sign_alg to create_authn_request (#432).
• The setup guide documents requested_attributes and a custom Extensions object on sso_kwargs.

Logout

• A logout with no SAML subject ends the Django session and redirects. global_logout is not called with None.
• The redirect that finishes a logout POST is 303 See Other.
• Logout failures are covered: ignored errors, a failed status, LogoutError, an unsupported binding, an empty result, an unknown binding, and a logout service call that carries neither SAMLRequest nor SAMLResponse.

Users

• SAML_USER_MODEL selects the user model. set_unusable_password runs only when that model defines it.
• get_or_create_user uses get_user_query. A dict is a field lookup. A Q object is passed to objects.get.
• pre_user_save, post_user_save, authenticate, and post_authenticated are sent with send_robust. A receiver exception is logged and login continues. A subclass that replaces post_login_hook calls super() to keep post_authenticated.

Documentation

• saml2/logout/ starts logout. saml2/ls/ is the single logout the identity provider calls. saml2/ls/post/ is the HTTP-POST binding. saml2/metadata/ returns the service provider metadata.
• The page after login reads attributes from the SAML session through EchoAttributesView.
• post_login_hook(request, user, session_info) is where request.site is available. session_info['ava'] holds the assertion attributes.
• SAML_CONFIG_LOADER receives the request and returns the SPConfig for that tenant.
• The idp query parameter selects the recipient when the metadata lists more than one identity provider. available_idps reads that list from the metadata. The service.sp.idp dictionary is not that list.
• scoping places one IDPEntry in the authentication request.
• required_attributes is published in metadata as RequestedAttribute isRequired="true". NAMEID_FORMAT_EMAILADDRESS requests an email subject.

Full Changelog: v1.12.0-1...v1.13.0

Contributor's PRs

• Fix sigalg→sign_alg param naming for create_authn_request in POST binding @JPDSousa (#432)
• Add support for Django 6.0 built-in Content Security Policy @alimony (#431)