<name>OAuth 2.0</name>
<summary>Allows OAuth2 compatible authentication from other web applications.</summary>
<description>The OAuth2 app allows administrators to configure the built-in authentication workflow to also allow OAuth2 compatible authentication from other web applications.</description>
- <version>1.14.0</version>
+ <version>1.14.1</version>
<licence>agpl</licence>
<author>Lukas Reschke</author>
<namespace>OAuth2</namespace>
-
Copyright (c) Nils Adermann, Jordi Boggiano
Permission is hereby granted, free of charge, to any person obtaining a copy
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
-
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => $baseDir . '/../lib/Migration/SetTokenExpiration.php',
'OCA\\OAuth2\\Migration\\Version010401Date20181207190718' => $baseDir . '/../lib/Migration/Version010401Date20181207190718.php',
'OCA\\OAuth2\\Migration\\Version010402Date20190107124745' => $baseDir . '/../lib/Migration/Version010402Date20190107124745.php',
+ 'OCA\\OAuth2\\Migration\\Version011601Date20230522143227' => $baseDir . '/../lib/Migration/Version011601Date20230522143227.php',
'OCA\\OAuth2\\Settings\\Admin' => $baseDir . '/../lib/Settings/Admin.php',
);
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => __DIR__ . '/..' . '/../lib/Migration/SetTokenExpiration.php',
'OCA\\OAuth2\\Migration\\Version010401Date20181207190718' => __DIR__ . '/..' . '/../lib/Migration/Version010401Date20181207190718.php',
'OCA\\OAuth2\\Migration\\Version010402Date20190107124745' => __DIR__ . '/..' . '/../lib/Migration/Version010402Date20190107124745.php',
+ 'OCA\\OAuth2\\Migration\\Version011601Date20230522143227' => __DIR__ . '/..' . '/../lib/Migration/Version011601Date20230522143227.php',
'OCA\\OAuth2\\Settings\\Admin' => __DIR__ . '/..' . '/../lib/Settings/Admin.php',
);
use OCP\IRequest;
use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom;
+use Psr\Log\LoggerInterface;
class OauthApiController extends Controller {
/** @var AccessTokenMapper */
private $time;
/** @var Throttler */
private $throttler;
+ /** @var LoggerInterface */
+ private $logger;
public function __construct(string $appName,
IRequest $request,
TokenProvider $tokenProvider,
ISecureRandom $secureRandom,
ITimeFactory $time,
+ LoggerInterface $logger,
Throttler $throttler) {
parent::__construct($appName, $request);
$this->crypto = $crypto;
$this->secureRandom = $secureRandom;
$this->time = $time;
$this->throttler = $throttler;
+ $this->logger = $logger;
}
/**
$client_secret = $this->request->server['PHP_AUTH_PW'];
}
+ try {
+ $storedClientSecret = $this->crypto->decrypt($client->getSecret());
+ } catch (\Exception $e) {
+ $this->logger->error('OAuth client secret decryption error', ['exception' => $e]);
+ return new JSONResponse([
+ 'error' => 'invalid_client',
+ ], Http::STATUS_BAD_REQUEST);
+ }
// The client id and secret must match. Else we don't provide an access token!
- if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
+ if ($client->getClientIdentifier() !== $client_id || $storedClientSecret !== $client_secret) {
return new JSONResponse([
'error' => 'invalid_client',
], Http::STATUS_BAD_REQUEST);
use OCP\IUser;
use OCP\IUserManager;
use OCP\Security\ISecureRandom;
+use OCP\Security\ICrypto;
class SettingsController extends Controller {
/** @var ClientMapper */
* @var IUserManager
*/
private $userManager;
+ /** @var ICrypto */
+ private $crypto;
+
public const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
public function __construct(string $appName,
AccessTokenMapper $accessTokenMapper,
IL10N $l,
IAuthTokenProvider $tokenProvider,
- IUserManager $userManager
+ IUserManager $userManager,
+ ICrypto $crypto
) {
parent::__construct($appName, $request);
$this->secureRandom = $secureRandom;
$this->l = $l;
$this->tokenProvider = $tokenProvider;
$this->userManager = $userManager;
+ $this->crypto = $crypto;
}
public function addClient(string $name,
$client = new Client();
$client->setName($name);
$client->setRedirectUri($redirectUri);
- $client->setSecret($this->secureRandom->generate(64, self::validChars));
+ $secret = $this->secureRandom->generate(64, self::validChars);
+ $encryptedSecret = $this->crypto->encrypt($secret);
+ $client->setSecret($encryptedSecret);
$client->setClientIdentifier($this->secureRandom->generate(64, self::validChars));
$client = $this->clientMapper->insert($client);
'name' => $client->getName(),
'redirectUri' => $client->getRedirectUri(),
'clientId' => $client->getClientIdentifier(),
- 'clientSecret' => $client->getSecret(),
+ 'clientSecret' => $secret,
];
return new JSONResponse($result);
--- /dev/null
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright 2023, Julien Veyssier <julien-nc@posteo.net>
+ *
+ * @author Julien Veyssier <julien-nc@posteo.net>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\OAuth2\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+use OCP\Security\ICrypto;
+
+class Version011601Date20230522143227 extends SimpleMigrationStep {
+
+ public function __construct(
+ private IDBConnection $connection,
+ private ICrypto $crypto,
+ ) {
+ }
+
+ public function changeSchema(IOutput $output, Closure $schemaClosure, array $options) {
+ /** @var ISchemaWrapper $schema */
+ $schema = $schemaClosure();
+
+ if ($schema->hasTable('oauth2_clients')) {
+ $table = $schema->getTable('oauth2_clients');
+ if ($table->hasColumn('secret')) {
+ $column = $table->getColumn('secret');
+ $column->setLength(512);
+ return $schema;
+ }
+ }
+
+ return null;
+ }
+
+ public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
+ $qbUpdate = $this->connection->getQueryBuilder();
+ $qbUpdate->update('oauth2_clients')
+ ->set('secret', $qbUpdate->createParameter('updateSecret'))
+ ->where(
+ $qbUpdate->expr()->eq('id', $qbUpdate->createParameter('updateId'))
+ );
+
+ $qbSelect = $this->connection->getQueryBuilder();
+ $qbSelect->select('id', 'secret')
+ ->from('oauth2_clients');
+ $req = $qbSelect->executeQuery();
+ while ($row = $req->fetch()) {
+ $id = $row['id'];
+ $secret = $row['secret'];
+ $encryptedSecret = $this->crypto->encrypt($secret);
+ $qbUpdate->setParameter('updateSecret', $encryptedSecret, IQueryBuilder::PARAM_STR);
+ $qbUpdate->setParameter('updateId', $id, IQueryBuilder::PARAM_INT);
+ $qbUpdate->executeStatement();
+ }
+ $req->closeCursor();
+ }
+}
use OCA\OAuth2\Db\ClientMapper;
use OCP\AppFramework\Http\TemplateResponse;
use OCP\AppFramework\Services\IInitialState;
+use OCP\Security\ICrypto;
use OCP\Settings\ISettings;
use OCP\IURLGenerator;
+use Psr\Log\LoggerInterface;
class Admin implements ISettings {
private IInitialState $initialState;
private ClientMapper $clientMapper;
private IURLGenerator $urlGenerator;
+ private ICrypto $crypto;
+ private LoggerInterface $logger;
public function __construct(
IInitialState $initialState,
ClientMapper $clientMapper,
- IURLGenerator $urlGenerator
+ IURLGenerator $urlGenerator,
+ ICrypto $crypto,
+ LoggerInterface $logger
) {
$this->initialState = $initialState;
$this->clientMapper = $clientMapper;
$this->urlGenerator = $urlGenerator;
+ $this->crypto = $crypto;
+ $this->logger = $logger;
}
public function getForm(): TemplateResponse {
$result = [];
foreach ($clients as $client) {
- $result[] = [
- 'id' => $client->getId(),
- 'name' => $client->getName(),
- 'redirectUri' => $client->getRedirectUri(),
- 'clientId' => $client->getClientIdentifier(),
- 'clientSecret' => $client->getSecret(),
- ];
+ try {
+ $secret = $this->crypto->decrypt($client->getSecret());
+ $result[] = [
+ 'id' => $client->getId(),
+ 'name' => $client->getName(),
+ 'redirectUri' => $client->getRedirectUri(),
+ 'clientId' => $client->getClientIdentifier(),
+ 'clientSecret' => $secret,
+ ];
+ } catch (\Exception $e) {
+ $this->logger->error('[Settings] OAuth client secret decryption error', ['exception' => $e]);
+ }
}
$this->initialState->provideInitialState('clients', $result);
$this->initialState->provideInitialState('oauth2-doc-link', $this->urlGenerator->linkToDocs('admin-oauth2'));
use OCP\IRequest;
use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom;
+use Psr\Log\LoggerInterface;
use Test\TestCase;
/* We have to use this to add a property to the mocked request and avoid warnings about dynamic properties on PHP>=8.2 */
private $time;
/** @var Throttler|\PHPUnit\Framework\MockObject\MockObject */
private $throttler;
+ /** @var LoggerInterface|\PHPUnit\Framework\MockObject\MockObject */
+ private $logger;
/** @var OauthApiController */
private $oauthApiController;
$this->secureRandom = $this->createMock(ISecureRandom::class);
$this->time = $this->createMock(ITimeFactory::class);
$this->throttler = $this->createMock(Throttler::class);
+ $this->logger = $this->createMock(LoggerInterface::class);
$this->oauthApiController = new OauthApiController(
'oauth2',
$this->tokenProvider,
$this->secureRandom,
$this->time,
+ $this->logger,
$this->throttler
);
}
$client = new Client();
$client->setClientIdentifier('clientId');
- $client->setSecret('clientSecret');
+ $client->setSecret('encryptedClientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
- $this->crypto->method('decrypt')
- ->with(
- 'encryptedToken',
- 'validrefresh'
- )->willReturn('decryptedToken');
+ $this->crypto
+ ->method('decrypt')
+ ->with($this->callback(function (string $text) {
+ return $text === 'encryptedClientSecret' || $text === 'encryptedToken';
+ }))
+ ->willReturnCallback(function (string $text) {
+ return $text === 'encryptedClientSecret'
+ ? 'clientSecret'
+ : ($text === 'encryptedToken' ? 'decryptedToken' : '');
+ });
$this->tokenProvider->method('getTokenById')
->with(1337)
$client = new Client();
$client->setClientIdentifier('clientId');
- $client->setSecret('clientSecret');
+ $client->setSecret('encryptedClientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
- $this->crypto->method('decrypt')
- ->with(
- 'encryptedToken',
- 'validrefresh'
- )->willReturn('decryptedToken');
+ $this->crypto
+ ->method('decrypt')
+ ->with($this->callback(function (string $text) {
+ return $text === 'encryptedClientSecret' || $text === 'encryptedToken';
+ }))
+ ->willReturnCallback(function (string $text) {
+ return $text === 'encryptedClientSecret'
+ ? 'clientSecret'
+ : ($text === 'encryptedToken' ? 'decryptedToken' : '');
+ });
$appToken = new PublicKeyToken();
$appToken->setUid('userId');
$client = new Client();
$client->setClientIdentifier('clientId');
- $client->setSecret('clientSecret');
+ $client->setSecret('encryptedClientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
- $this->crypto->method('decrypt')
- ->with(
- 'encryptedToken',
- 'validrefresh'
- )->willReturn('decryptedToken');
+ $this->crypto
+ ->method('decrypt')
+ ->with($this->callback(function (string $text) {
+ return $text === 'encryptedClientSecret' || $text === 'encryptedToken';
+ }))
+ ->willReturnCallback(function (string $text) {
+ return $text === 'encryptedClientSecret'
+ ? 'clientSecret'
+ : ($text === 'encryptedToken' ? 'decryptedToken' : '');
+ });
$appToken = new PublicKeyToken();
$appToken->setUid('userId');
$client = new Client();
$client->setClientIdentifier('clientId');
- $client->setSecret('clientSecret');
+ $client->setSecret('encryptedClientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
- $this->crypto->method('decrypt')
- ->with(
- 'encryptedToken',
- 'validrefresh'
- )->willReturn('decryptedToken');
+ $this->crypto
+ ->method('decrypt')
+ ->with($this->callback(function (string $text) {
+ return $text === 'encryptedClientSecret' || $text === 'encryptedToken';
+ }))
+ ->willReturnCallback(function (string $text) {
+ return $text === 'encryptedClientSecret'
+ ? 'clientSecret'
+ : ($text === 'encryptedToken' ? 'decryptedToken' : '');
+ });
$appToken = new PublicKeyToken();
$appToken->setUid('userId');
use OCP\IRequest;
use OCP\IUser;
use OCP\IUserManager;
+use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom;
use Test\TestCase;
private $settingsController;
/** @var IL10N|\PHPUnit\Framework\MockObject\MockObject */
private $l;
+ /** @var ICrypto|\PHPUnit\Framework\MockObject\MockObject */
+ private $crypto;
protected function setUp(): void {
parent::setUp();
$this->l = $this->createMock(IL10N::class);
$this->l->method('t')
->willReturnArgument(0);
+ $this->crypto = $this->createMock(ICrypto::class);
+
$this->settingsController = new SettingsController(
'oauth2',
$this->request,
$this->accessTokenMapper,
$this->l,
$this->authTokenProvider,
- $this->userManager
+ $this->userManager,
+ $this->crypto
);
}
'MySecret',
'MyClientIdentifier');
+ $this->crypto
+ ->expects($this->once())
+ ->method('encrypt')
+ ->willReturn('MyEncryptedSecret');
+
$client = new Client();
$client->setName('My Client Name');
$client->setRedirectUri('https://example.com/');
->with($this->callback(function (Client $c) {
return $c->getName() === 'My Client Name' &&
$c->getRedirectUri() === 'https://example.com/' &&
- $c->getSecret() === 'MySecret' &&
+ $c->getSecret() === 'MyEncryptedSecret' &&
$c->getClientIdentifier() === 'MyClientIdentifier';
}))->willReturnCallback(function (Client $c) {
$c->setId(42);
$this->accessTokenMapper,
$this->l,
$tokenProviderMock,
- $userManager
+ $userManager,
+ $this->crypto
);
$result = $settingsController->deleteClient(123);
use OCP\AppFramework\Http\TemplateResponse;
use OCP\AppFramework\Services\IInitialState;
use OCP\IURLGenerator;
+use OCP\Security\ICrypto;
use PHPUnit\Framework\MockObject\MockObject;
+use Psr\Log\LoggerInterface;
use Test\TestCase;
class AdminTest extends TestCase {
/** @var Admin|MockObject */
private $admin;
- /** @var IInitialStateService|MockObject */
+ /** @var IInitialState|MockObject */
private $initialState;
/** @var ClientMapper|MockObject */
$this->initialState = $this->createMock(IInitialState::class);
$this->clientMapper = $this->createMock(ClientMapper::class);
- $this->admin = new Admin($this->initialState, $this->clientMapper, $this->createMock(IURLGenerator::class));
+ $this->admin = new Admin(
+ $this->initialState,
+ $this->clientMapper,
+ $this->createMock(IURLGenerator::class),
+ $this->createMock(ICrypto::class),
+ $this->createMock(LoggerInterface::class)
+ );
}
public function testGetForm() {
-
Copyright (c) Nils Adermann, Jordi Boggiano
Permission is hereby granted, free of charge, to any person obtaining a copy
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
-
projects / nextcloud-server.git / commitdiff