Features

Added user account expiration with automatic deactivation and reminder emails.
Allowed customizing the password reset form.
Added password self-service REST API endpoints.
Added API key management to the user admin. Authorized administrators can create and delete API keys for users, while users can always delete their own API keys. API keys belonging to other users are masked.
Added extensible field serialization to the export_users command, including custom serializers, related object extraction and relation traversal.
This changes the structure of the generated CSV output and may require updates to scripts which parse it.
Added OPENWISP\_USERS\_SOCIALACCOUNT\_ADMIN\_NEEDED to support custom allauth OAuth/SAML providers when automatic detection is not sufficient.

Changes

Improved password expiration handling with SSO and REST API authentication. Users authenticated through passwordless methods such as SAML, OAuth and sesame magic links are no longer prompted to update an expired local password. REST API clients now receive a JSON 403 response instead of an HTML redirect.
Renamed the "Is admin" label to "Organization manager".
Improved admin theme consistency by using shared theme colors provided by OpenWISP Utils.

Fixed custom REST API view overrides so get\_api\_urls() correctly uses callbacks from custom view modules while falling back to the default views when an override is not provided.
Fixed infinite recursion when custom API views subclass ChangePasswordView.
Fixed template loader ordering and template extensibility.