wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
45110 commits 157 branches 562 tags 714 MiB
Commit graph

101 commits

Author SHA1 Message Date
Christoph Wurst
d248a0bd1e
Fix 2FA provider registry population on login 
If the 2FA provider registry has not been populated yet, we have to make
sure all available providers are loaded and queried on login. Otherwise
previously active 2FA providers aren't detected as enabled.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-08-08 06:57:52 +02:00
Christoph Wurst
fc149bab3c
Fix duplicate inserts in the 2fa provider registry DAO 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-07-31 06:43:44 +02:00
Christoph Wurst
7be465febe
Make new classes strict and fix license header 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-06-25 07:38:52 +02:00
Christoph Wurst
13d93f5b25
Make 2FA providers stateful 
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-06-20 08:30:26 +02:00
Roeland Jago Douma
82959ca93e
Comments 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-19 07:46:43 +02:00
Roeland Jago Douma
970dea9264
Add getProvider helper function 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
df34571d1d
Use constant for token version 
And don't set the version in the constructor. That would possible cause
to many updates.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
9e7a95fe58
Add more tests 
* Add a lot of tests
* Fixes related to those tests
* Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
1999f7ce7b
Generate the new publicKey tokens by default! 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
f168ecfa7a
Actually convert the token 
* When getting the token
* When rotating the token

* Also store the encrypted password as base64 to avoid weird binary
stuff

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
d03d16a936
Add publickey provider to manager 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
4bbc21cb21
SetPassword on PublicKeyTokens 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:55 +02:00
Roeland Jago Douma
4c0d710479
Just pass uid to the Token stuff 
We don't have user objects in the code everywhere

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:54 +02:00
Roeland Jago Douma
1f17010e0b
Add first tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:54 +02:00
Roeland Jago Douma
02e0af1287
Initial PKT implementation 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:54 +02:00
Roeland Jago Douma
3dd5f3d5f6
Abstract the Provider via a manager 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-18 22:11:53 +02:00
Roeland Jago Douma
480864b3e3
Make the token expiration also work for autocasting 0 
Some bad databases don't respect the default null apprently.
Now even if they cast it to 0 it should work just fine.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-08 16:20:43 +02:00
Roeland Jago Douma
6b7cf46727
Certain tokens can expire 
However due to the nature of what we store in the token (encrypted
passwords etc). We can't just delete the tokens because that would make
the oauth refresh useless.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-17 16:10:19 +02:00
Roeland Jago Douma
aba255997a
Allow the rotation of tokens 
This for example will allow rotating the apptoken for oauth

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-16 19:27:19 +02:00
Roeland Jago Douma
4ea2daf04d
Refix scope 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-15 11:41:27 +02:00
Roeland Jago Douma
466297829e
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-15 10:56:40 +02:00
Roeland Jago Douma
47388e1cfe
Make the Token Auth code strict 
In preparation for #9441

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-15 10:32:30 +02:00
Roeland Jago Douma
610c66520b
Move over TokenMapper 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-10 19:47:43 +02:00
Morris Jobke
eb51f06a3b
Use ::class statement instead of string 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-01-29 12:03:47 +01:00
Roeland Jago Douma
eddd135f14
Dispatch event on twofactor failure and success 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-25 13:25:09 +01:00
Flávio Gomes da Silva Lisboa
5ca9a7d6bc
Loss of performance on Login after upgrade from NC10 + LDAP to NC 12 + LDAP #6732 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-11-27 09:22:44 +01:00
Morris Jobke
0eebff152a
Update license headers 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-11-06 16:56:19 +01:00
Christoph Wurst
38bb6e1477
Fix duplicate session token after remembered login 
On a remembered login session, we create a new session token
in the database with the values of the old one. As we actually
don't need the old session token anymore, we can delete it right
away.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-09-20 21:39:31 +02:00
Roeland Jago Douma
9163cf9241
Fix AppPassword 2FA auth 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-09-12 22:28:43 +02:00
Roeland Jago Douma
b96485b6bd
Fix login with basic auth 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-09-05 12:24:41 +02:00
Roeland Jago Douma
84b7022118
Improve 2FA 
* Store the auth state in the session so we don't have to query it every
time.
* Added some tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-29 20:27:36 +02:00
Joas Schilling
fc22a2cb07
Fix auth provider 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-02 09:48:16 +02:00
Joas Schilling
a76d4ef04e
Fix clob comparison 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-02 09:48:15 +02:00
Roeland Jago Douma
5f227bd93b
More phpstorm inspection fixes 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-07-24 11:39:29 +02:00
Marcel Waldvogel
4e42f059ed Minor typos 
Signed-off-by: Marcel Waldvogel <marcel.waldvogel@uni-konstanz.de>
 2017-07-21 09:50:44 +02:00
Lukas Reschke
7976927628 Merge pull request #4894 from nextcloud/generic-security-activities 
Change 2FA activities to more generic security activities
 2017-05-19 00:50:44 +02:00
Christoph Wurst
0928b5f621
Change 2FA activities to more generic security activities 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-05-18 22:10:57 +02:00
Lukas Reschke
77827ebf11
Rename table back to lowercase 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:09 +02:00
Bjoern Schiessle
1eb7f4956b
delete auth token when client gets deleted 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-05-18 20:49:07 +02:00
Martin
53b8330e6d
Defining App "cron" for "Invalidating tokens older than" message #27167 (#27201) 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-03-19 22:51:47 -06:00
Christoph Wurst
21d3fe5883
do not hard-require the token provider 
The provider might need DB access and therefore depenedency
resolution fails on the setup page where we cannot inject
the db implementation.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
6f74ecd94a
use login hook credentials as fallback 
If no session token is available, we can use the credentials provided
by the login hook.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
3316a9d294
fix @since annotations (9.1->12) 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
46adb3eced
replace session implementation if it changes at runtime 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
a6dca9e7a0
add login credential store 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:09 +01:00
Christoph Wurst
ed4017dfb4
fix minor issues 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-12-19 11:59:48 +01:00
Christoph Wurst
7ae9442f3d
Publish, parse and filter 2FA activities 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-12-19 11:59:47 +01:00
Lukas Reschke
0cc771ce19 Merge pull request #2353 from nextcloud/renew-session-token-remember 
copy remember-me value when renewing a session token
 2016-11-28 14:04:13 +01:00
Christoph Wurst
2f36920ddf fix undefined index error when the backup codes provider is not active 
In users have not created backup codes yet the app is not enabled for that user
and therefore we got an undefined index error because the code assumed it was
always there. It now properly returns null.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-28 08:48:57 +01:00
Christoph Wurst
2183a1f3e6 copy remember-me value when renewing a session token 
On renew, a session token is duplicated. For some reason we did
not copy over the remember-me attribute value. Hence, the new token
was deleted too early in the background job and remember-me did
not work properly.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-27 14:19:57 +01:00