131 Commits (0263821010d1394de6bbcefa6e78e7fab385cda0)

Author	SHA1	Message	Date
Christoph Wurst	d058ef2b6c	Make it possible to wipe all tokens/devices of a user ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	1c261675ad	Refactor: move remote wipe token logic to RW service ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	c50fe2a9c9	Send emails when remote wipe starts/finishes ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	aa6622ccef	Decouple remote wipe notifcation channels with events ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	f03eb7ec3c	Remote wipe support ... This allows a user to mark a token for remote wipe. Clients that support this can then wipe the device properly. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	579162d7b9	Allow 2FA to be setup on first login ... Once 2FA is enforced for a user and they have no 2FA setup yet this will now prompt them with a setup screen. Given that providers are enabled that allow setup then. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	170582d4f5	Add a login chain to reduce the complexity of LoginController::tryLogin ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Daniel Kesselberg	34e849d702	Add interface INamedToken ... Remove $token instanceof DefaultToken || $token instanceof PublicKeyToken Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	ac8a6e2244	Clean pending 2FA authentication on password reset ... When a password is reste we should make sure that all users are properly logged in. Pending states should be cleared. For example a session where the 2FA code is not entered yet should be cleared. The token is now removed so the session will be killed the next time this is checked (within 5 minutes). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Daniel Kesselberg	ec8aefc762	Read openssl error and log ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	674930da7f	Move ExpiredTokenException to the correct namespace ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	34f5f4091e	Catch more occurences where ExpiredTokenException can be thrown ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	b3a92a4e39	Expired PK tokens should not fall back to legacy tokens ... Fixes #11919 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Christoph Wurst	83e994c11f	Make it possible to enforce mandatory 2FA for groups ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	19f84f7b54	Add tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	d9febae5b2	Update all the publickey tokens if needed on web login ... * On weblogin check if we have invalid public key tokens * If so update them all with the new token This ensures that your marked as invalid tokens work again if you once login on the web. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	00e99af586	Mark token as invalid if the password doesn't match ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	a95154642d	Emit event on enablign or disabling of 2FA provider ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Christoph Wurst	259c0ce11d	Add mandatory 2FA service/class ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	7586b19e52	Only allow 2FA state changs if providers support the operation ... Ref https://github.com/nextcloud/server/issues/11019. Add `twofactorauth:cleanup` command Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Joas Schilling	f258e65f13	Also adjust the expiration of PublicKeyTokenProvider ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	5e6187926f	Copy the expiration from 480864b3e3 to getTokenById ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Daniel Kesselberg	90a9a1ecc6	Consider openssl settings from config.php ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	8 years ago
Roeland Jago Douma	47b46fa69d	Expire tokens hardening ... Just to be sure that the field is also not 0 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Christoph Wurst	fb98db7da7	Fix handlng of concurrent inserts of the 2FA provider registry DAO ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	1124b87bc0	Fix 2FA being enforced if only backup codes provider is active ... Fixes https://github.com/nextcloud/server/issues/10634. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	8db66d5dfb	Fix double-inserts of the same provider state ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	d8197f2b97	Rename providerset method to get primary providers ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	c6e47e8a51	Fix login redirection if only one 2FA provider is active ... Fixes https://github.com/nextcloud/server/issues/10500. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	d248a0bd1e	Fix 2FA provider registry population on login ... If the 2FA provider registry has not been populated yet, we have to make sure all available providers are loaded and queried on login. Otherwise previously active 2FA providers aren't detected as enabled. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	fc149bab3c	Fix duplicate inserts in the 2fa provider registry DAO ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	7be465febe	Make new classes strict and fix license header ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Christoph Wurst	13d93f5b25	Make 2FA providers stateful ... This adds persistence to the Nextcloud server 2FA logic so that the server knows which 2FA providers are enabled for a specific user at any time, even when the provider is not available. The `IStatefulProvider` interface was added as tagging interface for providers that are compatible with this new API. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Roeland Jago Douma	82959ca93e	Comments ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	970dea9264	Add getProvider helper function ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	df34571d1d	Use constant for token version ... And don't set the version in the constructor. That would possible cause to many updates. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	9e7a95fe58	Add more tests ... * Add a lot of tests * Fixes related to those tests * Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	1999f7ce7b	Generate the new publicKey tokens by default! ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	f168ecfa7a	Actually convert the token ... * When getting the token * When rotating the token * Also store the encrypted password as base64 to avoid weird binary stuff Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	d03d16a936	Add publickey provider to manager ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	4bbc21cb21	SetPassword on PublicKeyTokens ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	4c0d710479	Just pass uid to the Token stuff ... We don't have user objects in the code everywhere Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	1f17010e0b	Add first tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	02e0af1287	Initial PKT implementation ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	3dd5f3d5f6	Abstract the Provider via a manager ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	480864b3e3	Make the token expiration also work for autocasting 0 ... Some bad databases don't respect the default null apprently. Now even if they cast it to 0 it should work just fine. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	6b7cf46727	Certain tokens can expire ... However due to the nature of what we store in the token (encrypted passwords etc). We can't just delete the tokens because that would make the oauth refresh useless. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	aba255997a	Allow the rotation of tokens ... This for example will allow rotating the apptoken for oauth Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	4ea2daf04d	Refix scope ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	466297829e	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago