88 Commits (addParameterTypingVersionsMapper)

Author	SHA1	Message	Date
Julien Veyssier	3d36834284	feat(auth): include the token entity in TokenInvalidatedEvent ... Signed-off-by: Julien Veyssier <julien-nc@posteo.net>	4 months ago
Julien Veyssier	4a35837741	feat(auth): adjust PublicKeyTokenProviderTest ... Signed-off-by: Julien Veyssier <julien-nc@posteo.net>	4 months ago
Julien Veyssier	3da919c783	feat(auth): dispatch new TokenInvalidatedEvent when PublicKeyTokenProvider::invalidateToken is called ... Signed-off-by: Julien Veyssier <julien-nc@posteo.net>	4 months ago
Julien Veyssier	8ffd30bbf9	feat(auth): dispatch new TokenInvalidatedEvent when PublicKeyTokenProvider::invalidateTokenById is called ... Signed-off-by: Julien Veyssier <julien-nc@posteo.net>	4 months ago
Ferdinand Thiessen	a8f46af20f	chore: Add proper deprecation dates where missing ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Daniel Kesselberg	af6de04e9e	style: update codestyle for coding-standard 1.2.3 ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	1 year ago
Christoph Wurst	5100e3152d	feat(auth): Clean-up unused auth tokens and wipe tokens ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	1 year ago
Arthur Schiwon	99182aac37	fix(Token): take over scope in token refresh with login by cookie ... Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	1 year ago
Arthur Schiwon	6a783d9b08	fix(Session): avoid race conditions on clustered setups ... - re-stablishes old behaviour with cache to return null instead of throwing an InvalidTokenException when the token is cached as non-existing - token invalidation and re-generation are bundled in a DB transaction now Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	1 year ago
Arthur Schiwon	340939e688	fix(Session): avoid password confirmation on SSO ... SSO backends like SAML and OIDC tried a trick to suppress password confirmations as they are not possible by design. At least for SAML it was not reliable when existing user backends where used as user repositories. Now we are setting a special scope with the token, and also make sure that the scope is taken over when tokens are regenerated. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	2 years ago
Andy Scherzinger	dae7c159f7	chore: Add SPDX header ... Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Christoph Wurst	bcc02a3c71	fix(auth): Update authtoken activity selectively ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Julius Härtl	04780ae30a	fix: Always set last activity if we update the row of an authtoken anyways ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	2 years ago
Joas Schilling	bc4a102f52	fix(session): Avoid race condition for cache::get() vs. cache::hasKey() ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Côme Chilliet	ec5133b739	fix: Apply new coding standard to all files ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Benjamin Gaussorgues	d1189f923c	feat(perf): add cache for authtoken lookup ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Côme Chilliet	a526a382bf	Import OCP IToken as OCPIToken to avoid a name clash in lib/private ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	8fc39aeb1c	Use IToken from OCP instead of OC ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Joas Schilling	aa5f037af7	chore: apply changes from Nextcloud coding standards 1.1.1 ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Lucas Azevedo	fe9b9c1955	Add last-used-before option ... Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>	2 years ago
Christoph Wurst	5eb768ac5e	fix(auth): Run token statements in atomic transaction ... All or nothing Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Côme Chilliet	426c0341ff	Use typed version of IConfig::getSystemValue as much as possible ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Ember 'n0emis' Keske	6881d2f2f1	Don't try to hash a nonexisting password ... Allows to log-in via a passwordless authentication provider, eg SSO Signed-off-by: Ember 'n0emis' Keske <git@n0emis.eu>	3 years ago
Joas Schilling	6417ea0265	fix(authentication): Handle null or empty string password hash ... This can happen when the auth.storeCryptedPassword config is used, which previously errored with: Hasher::verify(): Argument #2 ($hash) must be of type string, null given Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Julius Härtl	580feecdbf	fix(authtoken): Store only one hash for authtokens with the current password per user ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Joas Schilling	7a85a1596e	fix(authentication): Check minimum length when creating app tokens ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	03a585ab4f	fix(performance): Only search for auth tokens when the provided login is long enough ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	2fb4dac7ad	fix(authentication): Update the token when the hash is null or can not be verified ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	28b18d561c	fix(authentication): Only hash the new password when needed ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	c5bb19641c	fix(authentication): Invert the logic to the original intention ... We need to store the new authentication details when the hash did **not** verify the old password. Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	55d8aec759	fix(authentication): Only verify each hash once ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	b4a29644cc	Add a const for the max user password length ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Marcel Klehr	adfe367106	PublickKeyTokenProvider: Fix password update routine with password hash ... Signed-off-by: Marcel Klehr <mklehr@gmx.net>	3 years ago
Christoph Wurst	c5922e67d3	Run session token renewals in a database transaction ... The session token renewal does 1) Read the old token 2) Write a new token 3) Delete the old token If two processes succeed to read the old token there can be two new tokens because the queries were not run in a transaction. This is particularly problematic on clustered DBs where 1) would go to a read node and 2) and 3) go to a write node. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Carl Schwan	ef31396727	Mark method as deprecated ... Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Julius Härtl	9d1ec582ba	Do not update passwords if nothing changed ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Carl Schwan	702445ba3b	Handle one time password better ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Carl Schwan	d5c23dbb9f	Move CappedMemoryCache to OCP ... This is an helpful helper that should be used in more place than just server and this is already the case with groupfodlers, deck, user_oidc and more using it, so let's make it public Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Carl Schwan	1c23c029af	Handler large passwords ... For passwords bigger than 250 characters, use a bigger key since the performance impact is minor (around one second to encrypt the password). For passwords bigger than 470 characters, give up earlier and throw exeception recommanding admin to either enable the previously enabled configuration or use smaller passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Carl Schwan	cdf3b60555	Handle one time passwords ... This adds an option to disable storing passwords in the database. This might be desirable when using single use token as passwords or very large passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Joas Schilling	7b3e2217de	Fix user agent trimming on installation ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Joas Schilling	a0c7798c7d	Limit the length of app password names ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Julius Härtl	553cb499b2	Rotate token after fallback ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Julius Härtl	81f8719cc0	Add fallback routines for empty secret cases ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Joas Schilling	397b9098e8	Also cache non-existing to reuse it ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Joas Schilling	c0ba89ecc9	Remove default token which is deprecated since Nextcloud 13 ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Christoph Wurst	7dd7256cfe	Prevent duplicate auth token activity updates ... The auth token activity logic works as follows * Read auth token * Compare last activity time stamp to current time * Update auth token activity if it's older than x seconds This works fine in isolation but with concurrency that means that occasionally the same token is read simultaneously by two processes and both of these processes will trigger an update of the same row. Affectively the second update doesn't add much value. It might set the time stamp to the exact same time stamp or one a few seconds later. But the last activity is no precise science, we don't need this accuracy. This patch changes the UPDATE query to include the expected value in a comparison with the current data. This results in an affected row when the data in the DB still has an old time stamp, but won't affect a row if the time stamp is (nearly) up to date. This is a micro optimization and will possibly not show any significant performance improvement. Yet in setups with a DB cluster it means that the write node has to send fewer changes to the read nodes due to the lower number of actual changes. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	4 years ago
Christoph Wurst	01b8291c76	Type the autentication provider passwords as nullable strings ... For historic reasons we couldn't add a nullable type hint before nullable type hints were supported by our target php versions. This is now possible. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	4 years ago
Tobias Assmann	ee049a159b	prevent the invalidation of pw based authn tokens on a pw less login ... Signed-off-by: Tobias Assmann <tobias.assmann@ecsec.de>	5 years ago
Tobias Assmann	669bd4d718	add spaces around operators ... Signed-off-by: Tobias Assmann <tobias.assmann@ecsec.de>	5 years ago