Christoph Wurst
e90f00791d
add invalidateOldTokens to IProvider interface
2016-08-02 12:08:13 +02:00
Robin Appelman
681ac9f19f
Check if an app provide two-factor-auth providers before we try to use them
2016-07-23 13:26:57 +02:00
Joas Schilling
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
Vincent Petry
3db5de95bd
Merge pull request #25172 from owncloud/token-login-validation
...
Token login validation
2016-06-22 13:58:56 +02:00
Christoph Wurst
b805908dca
update session token password on user password change
2016-06-21 10:24:25 +02:00
Vincent Petry
88b9f5a357
Merge pull request #25162 from owncloud/password-login-forbidden-hint
...
Password login forbidden hint
2016-06-20 17:05:20 +02:00
Christoph Wurst
b0f2878f6e
close cursor after loading a token
2016-06-17 16:13:28 +02:00
Christoph Wurst
0c0a216f42
store last check timestamp in token instead of session
2016-06-17 15:42:28 +02:00
Christoph Wurst
c4149c59c2
use token last_activity instead of session value
2016-06-17 15:42:28 +02:00
Christoph Wurst
82b50d126c
add PasswordLoginForbiddenException
2016-06-17 11:02:07 +02:00
Christoph Wurst
a40d64ff7f
load 2FA provider apps before querying classes
2016-06-16 10:12:16 +02:00
Christoph Wurst
5daa9a5417
fail hard if 2fa provider can not be loaded ( #25061 )
2016-06-13 12:46:45 +02:00
Christoph Wurst
8f7a4aaa4d
do not generate device token if 2FA is enable for user
2016-06-07 09:09:51 +02:00
Christoph Wurst
c58d8159d7
Create session tokens for apache auth users
2016-05-31 17:07:49 +02:00
Lukas Reschke
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
Christoph Wurst
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
Vincent Petry
87fa86a69a
Merge pull request #24559 from owncloud/2fa
...
two factor auth
2016-05-23 20:50:03 +02:00
Christoph Wurst
847bbc51b6
add OCC command to enable/disable 2FA for a user
2016-05-23 11:21:13 +02:00
Christoph Wurst
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
Christoph Wurst
74277c25be
add button to invalidate browser sessions/device tokens
2016-05-23 09:11:12 +02:00
Christoph Wurst
6495534bcd
add button to add new device tokens
2016-05-23 09:11:12 +02:00
Christoph Wurst
12431aa399
list user's auth tokens on the personal settings page
2016-05-23 09:11:12 +02:00
Christoph Wurst
0626578739
add method to query all user auth tokens
2016-05-18 18:25:37 +02:00
Christoph Wurst
98b465a8b9
a single token provider suffices
2016-05-18 09:20:48 +02:00
Christoph Wurst
ed01305e29
don't spam the log file with failed token validation entries
2016-05-13 09:53:50 +02:00
Christoph Wurst
69dafd727d
delete the token in case an exception is thrown when decrypting the password
2016-05-11 13:36:46 +02:00
Christoph Wurst
af707fba41
use the query builder instead of raw sql statements
2016-05-11 13:36:46 +02:00
Christoph Wurst
46bdf6ea2b
fix PHPDoc and other minor issues
2016-05-11 13:36:46 +02:00
Christoph Wurst
f0f8bdd495
PHPDoc and other minor fixes
2016-05-11 13:36:46 +02:00
Christoph Wurst
fdc2cd7554
Add token auth for OCS APIs
2016-05-11 13:36:46 +02:00
Christoph Wurst
8d48502187
Add index on 'last_activity'
...
add token type column and delete only temporary tokens in the background job
debounce token updates; fix wrong class import
2016-05-11 13:36:46 +02:00
Christoph Wurst
3ab922601a
Check if session token is valid and log user out if the check fails
...
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
2016-05-11 13:36:46 +02:00
Christoph Wurst
2fa5e0a24e
invalidate (delete) session token on logout
...
add 'last_activity' column to session tokens and delete old ones via a background job
2016-05-11 13:36:46 +02:00
Christoph Wurst
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
