115 Commits (5cd1880daa048a685da689c7f41a2e50486494de)

Author	SHA1	Message	Date
Roeland Jago Douma	cd457cc68b	Always renew apppasswords on login ... Else you can end up that you renewed your password (LDAP for example). But they still don't work because you did not use them before you logged in. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Christoph Wurst	d89a75be0b	Update all license headers for Nextcloud 21 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Joas Schilling	49ff48fcd3	Use PSR logger in authentication ... Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago
Christoph Wurst	2664c7f75f	Type some of the core mappers ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Christoph Wurst	d9015a8c94	Format code to a single space around binary operators ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Roeland Jago Douma	76a7600e2e	Allow configuring the activity update interval of token ... On some systems with a lot of users this creates a lot of extra DB writes. Being able to increase this interval helps there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Roeland Jago Douma	0452877a67	Fix app password updating out of bounds ... When your password changes out of bounds your Nextcloud tokens will become invalid. There is no real way around that. However we should make sure that if you successfully log in again your passwords are all updates * Added event listener to the PostLoggedInEvent so that we can act on it - Only if it is not a token login * Make sure that we actually reset the invalid state when we update a token. Else it keeps being marked invalid and thus not used. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Christoph Wurst	2a054e6c04	Update the license headers for Nextcloud 20 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Morris Jobke	fedf9c69d9	Use matching parameter names form interfaces and implementations ... Found by Psalm 3.14.1 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5 years ago
Christoph Wurst	2006a6dd0e	Improve traces of invalid token exceptions ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	cb057829f7	Update license headers for 19 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	28f8eb5dba	Add visibility to all constants ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function ... To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	41b5e5923a	Use exactly one empty line after the namespace declaration ... For PSR2 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	1a9330cd69	Update the license headers for Nextcloud 19 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	74936c49ea	Remove unused imports ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Joas Schilling	dc7913efcd	Fix recursive calls in logging via server methods ... Signed-off-by: Joas Schilling <coding@schilljs.com>	6 years ago
Joas Schilling	9935c71ec3	Check the user on remote wipe ... Signed-off-by: Joas Schilling <coding@schilljs.com>	6 years ago
Christoph Wurst	5bf3d1bb38	Update license headers ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	b371e735cf	Throw an invalid token exception is token is marked outdated ... This avoids hitting the backend with multiple requests for the same token. And will help avoid quick LDAP lockouts. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Christoph Wurst	0299ea0a96	Handle token insert conflicts ... Env-based SAML uses the "Apache auth" mechanism to log users in. In this code path, we first delete all existin auth tokens from the database, before a new one is inserted. This is problematic for concurrent requests as they might reach the same code at the same time, hence both trying to insert a new row wit the same token (the session ID). This also bubbles up and disables user_saml. As the token might still be OK (both request will insert the same data), we can actually just check if the UIDs of the conflict row is the same as the one we want to insert right now. In that case let's just use the existing entry and carry on. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	68748d4f85	Some php-cs fixes ... * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	5122629bb0	Make renewSessionToken return the new token ... Avoids directly getting the token again. We just inserted it so it and have all the info. So that query is just a waste. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	3fccc7dc47	Cache the public key tokens ... Sometimes (esp with token auth) we query the same token multiple times. While this is properly indexed and fast it is still a bit of a waste. Right now it is doing very stupid caching. Which gets invalidate on any update. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Daniel Kesselberg	ee76b0fbd2	Add uid to delete temp token query ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	6 years ago
Daniel Kesselberg	608f4d3ee9	Pass $configargs to openssl_pkey_export ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Morris Jobke	4ae17427c5	Error with exception on SSL error ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7 years ago
Christoph Wurst	d058ef2b6c	Make it possible to wipe all tokens/devices of a user ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	1c261675ad	Refactor: move remote wipe token logic to RW service ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	aa6622ccef	Decouple remote wipe notifcation channels with events ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	f03eb7ec3c	Remote wipe support ... This allows a user to mark a token for remote wipe. Clients that support this can then wipe the device properly. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Daniel Kesselberg	34e849d702	Add interface INamedToken ... Remove $token instanceof DefaultToken || $token instanceof PublicKeyToken Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Daniel Kesselberg	ec8aefc762	Read openssl error and log ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	674930da7f	Move ExpiredTokenException to the correct namespace ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	34f5f4091e	Catch more occurences where ExpiredTokenException can be thrown ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	b3a92a4e39	Expired PK tokens should not fall back to legacy tokens ... Fixes #11919 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	19f84f7b54	Add tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	d9febae5b2	Update all the publickey tokens if needed on web login ... * On weblogin check if we have invalid public key tokens * If so update them all with the new token This ensures that your marked as invalid tokens work again if you once login on the web. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	00e99af586	Mark token as invalid if the password doesn't match ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Joas Schilling	f258e65f13	Also adjust the expiration of PublicKeyTokenProvider ... Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Joas Schilling	5e6187926f	Copy the expiration from 480864b3e3 to getTokenById ... Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Daniel Kesselberg	90a9a1ecc6	Consider openssl settings from config.php ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	47b46fa69d	Expire tokens hardening ... Just to be sure that the field is also not 0 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	82959ca93e	Comments ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	970dea9264	Add getProvider helper function ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	df34571d1d	Use constant for token version ... And don't set the version in the constructor. That would possible cause to many updates. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	9e7a95fe58	Add more tests ... * Add a lot of tests * Fixes related to those tests * Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	1999f7ce7b	Generate the new publicKey tokens by default! ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	f168ecfa7a	Actually convert the token ... * When getting the token * When rotating the token * Also store the encrypted password as base64 to avoid weird binary stuff Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	d03d16a936	Add publickey provider to manager ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago