d1189f923c
feat(perf): add cache for authtoken lookup
...
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2024-02-28 15:04:04 +07:00
a526a382bf
Import OCP IToken as OCPIToken to avoid a name clash in lib/private
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-01-11 15:45:14 +07:00
8fc39aeb1c
Use IToken from OCP instead of OC
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-01-11 14:02:15 +07:00
95ea6188dc
Suppress or fix psalm errors related to InvalidTokenException
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-01-11 14:02:15 +07:00
eee9f1eec4
Always catch OCP versions of authentication exceptions
...
And always throw OC versions for BC
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-01-11 14:02:15 +07:00
aa5f037af7
chore: apply changes from Nextcloud coding standards 1.1.1
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2023-11-23 10:36:13 +07:00
d8b42c6131
Allow passing null to PublicKeyToken::setScope, fixes tests
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-10-23 15:52:07 +07:00
33a24134a7
Improve docblock annotations for tokens and their exceptions
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-10-23 15:20:04 +07:00
58a57a714e
Use more precise typing for setScope method parameter
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-10-23 15:19:38 +07:00
356f0291a2
Align PublicKeyToken with interface changes
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-10-23 09:41:32 +07:00
f94fb33062
Move IToken and IProvider::getToken to OCP
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-10-20 17:51:33 +07:00
2a36acfc2b
Fix typo
...
Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>
2023-08-25 11:20:34 +07:00
c93b1634d3
Fixes from static analysis
...
Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com>
Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>
2023-08-25 10:41:46 +07:00
fe9b9c1955
Add last-used-before option
...
Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>
2023-08-25 02:07:57 +07:00
b294edad80
Merge branch 'master' into enh/type-iconfig-getter-calls
...
Signed-off-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
2023-04-20 16:52:38 +07:00
5eb768ac5e
fix(auth): Run token statements in atomic transaction
...
All or nothing
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2023-04-12 15:55:42 +07:00
426c0341ff
Use typed version of IConfig::getSystemValue as much as possible
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-04-05 12:50:08 +07:00
8568c11d24
Merge pull request #36033 from nextcloud/invalidateTokensWhenDeletingOAuthClientMaster
...
[master] invalidate existing tokens when deleting an oauth client
2023-03-15 11:09:51 +07:00
f634badf12
public interface to invalidate tokens of user
...
Signed-off-by: Artur Neumann <artur@jankaritech.com>
2023-03-14 17:13:29 +07:00
6881d2f2f1
Don't try to hash a nonexisting password
...
Allows to log-in via a passwordless authentication provider, eg SSO
Signed-off-by: Ember 'n0emis' Keske <git@n0emis.eu>
2023-03-13 10:32:53 +07:00
6417ea0265
fix(authentication): Handle null or empty string password hash
...
This can happen when the auth.storeCryptedPassword config is used,
which previously errored with:
Hasher::verify(): Argument #2 ($hash) must be of type string, null given
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-02-10 09:18:50 +07:00
e47d56ac36
Merge pull request #36621 from nextcloud/perf/noid/only-check-for-token-when-it-can-actually-be
...
fix(performance): Only search for auth tokens when the provided login…
2023-02-10 01:29:30 +07:00
580feecdbf
fix(authtoken): Store only one hash for authtokens with the current password per user
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2023-02-09 13:44:00 +07:00
7a85a1596e
fix(authentication): Check minimum length when creating app tokens
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-02-09 09:58:35 +07:00
03a585ab4f
fix(performance): Only search for auth tokens when the provided login is long enough
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-02-08 22:45:23 +07:00
f5c361cf44
composer run cs:fix
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-01-20 11:45:08 +07:00
2fb4dac7ad
fix(authentication): Update the token when the hash is null or can not be verified
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-01-09 16:32:36 +07:00
28b18d561c
fix(authentication): Only hash the new password when needed
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-01-09 15:58:26 +07:00
c5bb19641c
fix(authentication): Invert the logic to the original intention
...
We need to store the new authentication details when the hash did **not** verify
the old password.
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-01-09 15:13:08 +07:00
55d8aec759
fix(authentication): Only verify each hash once
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-01-09 14:53:12 +07:00
18164ae516
Merge pull request #33898 from nextcloud/fix/authtoken-password-update
...
PublickKeyTokenProvider: Fix password update routine with password hash
2023-01-05 08:01:47 +07:00
b4a29644cc
Add a const for the max user password length
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-01-04 11:23:43 +07:00
adfe367106
PublickKeyTokenProvider: Fix password update routine with password hash
...
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2023-01-04 08:30:53 +07:00
c5922e67d3
Run session token renewals in a database transaction
...
The session token renewal does
1) Read the old token
2) Write a new token
3) Delete the old token
If two processes succeed to read the old token there can be two new tokens because
the queries were not run in a transaction. This is particularly problematic on
clustered DBs where 1) would go to a read node and 2) and 3) go to a write node.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2022-10-18 08:28:22 +07:00
9919116716
Merge pull request #31499 from nextcloud/bugfix/empty-secret
...
Add fallback routines for empty secret cases
2022-10-17 16:02:58 +07:00
ef31396727
Mark method as deprecated
...
Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com>
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-09-13 13:06:54 +07:00
3ce1996d5e
Add back TokenCleanupJob to invalidate old temporary tokens
...
Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2022-08-25 11:31:21 +07:00
9d1ec582ba
Do not update passwords if nothing changed
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2022-08-09 09:35:44 +07:00
952acd4d27
Merge pull request #33225 from nextcloud/fix/handle-one-time-passwords
...
Handle one time password better
2022-07-29 12:26:52 +07:00
702445ba3b
Handle one time password better
...
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-07-28 14:26:25 +07:00
368f83095d
Fix typos in lib/private subdirectory
...
Found via `codespell -q 3 -S l10n -L jus ./lib/private`
Signed-off-by: luz paz <luzpaz@github.com>
2022-07-27 08:52:17 +07:00
d5c23dbb9f
Move CappedMemoryCache to OCP
...
This is an helpful helper that should be used in more place than just
server and this is already the case with groupfodlers, deck, user_oidc
and more using it, so let's make it public
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-07-14 15:54:31 +07:00
1c23c029af
Handler large passwords
...
For passwords bigger than 250 characters, use a bigger key since the
performance impact is minor (around one second to encrypt the password).
For passwords bigger than 470 characters, give up earlier and throw
exeception recommanding admin to either enable the previously enabled
configuration or use smaller passwords.
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-07-05 11:37:14 +07:00
cdf3b60555
Handle one time passwords
...
This adds an option to disable storing passwords in the database. This
might be desirable when using single use token as passwords or very
large passwords.
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-07-05 11:25:44 +07:00
7b3e2217de
Fix user agent trimming on installation
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-05-09 08:36:34 +07:00
d683e0d3d1
Automatically cut the token name on the first level
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-03-23 21:38:53 +07:00
a0c7798c7d
Limit the length of app password names
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-03-23 10:47:56 +07:00
553cb499b2
Rotate token after fallback
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2022-03-10 14:01:21 +07:00
81f8719cc0
Add fallback routines for empty secret cases
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2022-03-10 14:01:21 +07:00
397b9098e8
Also cache non-existing to reuse it
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-02-16 16:51:22 +07:00
Benjamin Gaussorgues
Côme Chilliet
Joas Schilling
Lucas Azevedo
Côme Chilliet
Christoph Wurst
Artur Neumann
Ember 'n0emis' Keske
Joas Schilling
Julius Härtl
Marcel Klehr
Carl Schwan
Thomas Citharel
luz paz