From 21b3e87c771987768e0ffe38823e680ff738394f Mon Sep 17 00:00:00 2001 From: MichaIng Date: Mon, 12 Jul 2021 19:22:04 +0200 Subject: [PATCH] Allow SSO authentication to provide a user secret Implementing PR #24837 from immerda Signed-off-by: MichaIng --- lib/composer/composer/autoload_classmap.php | 1 + lib/composer/composer/autoload_static.php | 1 + lib/private/legacy/OC_User.php | 8 +++- .../IProvideUserSecretBackend.php | 41 +++++++++++++++++++ 4 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 lib/public/Authentication/IProvideUserSecretBackend.php diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php index e3572aa833c..6215ec92fcc 100644 --- a/lib/composer/composer/autoload_classmap.php +++ b/lib/composer/composer/autoload_classmap.php @@ -90,6 +90,7 @@ return array( 'OCP\\Authentication\\Exceptions\\PasswordUnavailableException' => $baseDir . '/lib/public/Authentication/Exceptions/PasswordUnavailableException.php', 'OCP\\Authentication\\IAlternativeLogin' => $baseDir . '/lib/public/Authentication/IAlternativeLogin.php', 'OCP\\Authentication\\IApacheBackend' => $baseDir . '/lib/public/Authentication/IApacheBackend.php', + 'OCP\\Authentication\\IProvideUserSecretBackend' => $baseDir . '/lib/public/Authentication/IProvideUserSecretBackend.php', 'OCP\\Authentication\\LoginCredentials\\ICredentials' => $baseDir . '/lib/public/Authentication/LoginCredentials/ICredentials.php', 'OCP\\Authentication\\LoginCredentials\\IStore' => $baseDir . '/lib/public/Authentication/LoginCredentials/IStore.php', 'OCP\\Authentication\\TwoFactorAuth\\ALoginSetupController' => $baseDir . '/lib/public/Authentication/TwoFactorAuth/ALoginSetupController.php', diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php index 658f2cdfe2d..84f4c835120 100644 --- a/lib/composer/composer/autoload_static.php +++ b/lib/composer/composer/autoload_static.php @@ -123,6 +123,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2 'OCP\\Authentication\\Exceptions\\PasswordUnavailableException' => __DIR__ . '/../../..' . '/lib/public/Authentication/Exceptions/PasswordUnavailableException.php', 'OCP\\Authentication\\IAlternativeLogin' => __DIR__ . '/../../..' . '/lib/public/Authentication/IAlternativeLogin.php', 'OCP\\Authentication\\IApacheBackend' => __DIR__ . '/../../..' . '/lib/public/Authentication/IApacheBackend.php', + 'OCP\\Authentication\\IProvideUserSecretBackend' => __DIR__ . '/../../..' . '/lib/public/Authentication/IProvideUserSecretBackend.php', 'OCP\\Authentication\\LoginCredentials\\ICredentials' => __DIR__ . '/../../..' . '/lib/public/Authentication/LoginCredentials/ICredentials.php', 'OCP\\Authentication\\LoginCredentials\\IStore' => __DIR__ . '/../../..' . '/lib/public/Authentication/LoginCredentials/IStore.php', 'OCP\\Authentication\\TwoFactorAuth\\ALoginSetupController' => __DIR__ . '/../../..' . '/lib/public/Authentication/TwoFactorAuth/ALoginSetupController.php', diff --git a/lib/private/legacy/OC_User.php b/lib/private/legacy/OC_User.php index b7547be5e82..de066e143b4 100644 --- a/lib/private/legacy/OC_User.php +++ b/lib/private/legacy/OC_User.php @@ -178,7 +178,11 @@ class OC_User { } $userSession->setLoginName($uid); $request = OC::$server->getRequest(); - $userSession->createSessionToken($request, $uid, $uid); + $password = null; + if ($backend instanceof \OCP\Authentication\IProvideUserSecretBackend) { + $password = $backend->getCurrentUserSecret(); + } + $userSession->createSessionToken($request, $uid, $uid, $password); $userSession->createRememberMeToken($userSession->getUser()); // setup the filesystem OC_Util::setupFS($uid); @@ -191,7 +195,7 @@ class OC_User { 'post_login', [ 'uid' => $uid, - 'password' => null, + 'password' => $password, 'isTokenLogin' => false, ] ); diff --git a/lib/public/Authentication/IProvideUserSecretBackend.php b/lib/public/Authentication/IProvideUserSecretBackend.php new file mode 100644 index 00000000000..08f4043d828 --- /dev/null +++ b/lib/public/Authentication/IProvideUserSecretBackend.php @@ -0,0 +1,41 @@ + + * + * @author MichaIng + * + * @license AGPL-3.0 + * + * This code is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License, version 3, + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License, version 3, + * along with this program. If not, see + * + */ +// use OCP namespace for all classes that are considered public. +// This means that they should be used by apps instead of the internal ownCloud classes + +namespace OCP\Authentication; + +/** + * Interface IProvideUserSecretBackend + * + * @since 23.0.0 + */ +interface IProvideUserSecretBackend { + + /** + * Optionally returns a stable per-user secret. This secret is for + * instance used to secure file encryption keys. + * @return string + * @since 23.0.0 + */ + public function getCurrentUserSecret(): string; +} -- 2.39.5