aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Authentication/Token
Commit message (Collapse)AuthorAgeFilesLines
...
* | Do not update passwords if nothing changedJulius Härtl2022-08-091-3/+6
| | | | | | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* | Merge pull request #33225 from nextcloud/fix/handle-one-time-passwordsCarl Schwan2022-07-291-1/+1
|\ \ | | | | | | Handle one time password better
| * | Handle one time password betterCarl Schwan2022-07-281-1/+1
| | | | | | | | | | | | Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | | Fix typos in lib/private subdirectoryluz paz2022-07-271-1/+1
| | | | | | | | | | | | | | | | | | Found via `codespell -q 3 -S l10n -L jus ./lib/private` Signed-off-by: luz paz <luzpaz@github.com>
* | | Move CappedMemoryCache to OCPCarl Schwan2022-07-141-1/+1
|/ / | | | | | | | | | | | | | | This is an helpful helper that should be used in more place than just server and this is already the case with groupfodlers, deck, user_oidc and more using it, so let's make it public Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | Handler large passwordsCarl Schwan2022-07-051-1/+4
| | | | | | | | | | | | | | | | | | | | | | For passwords bigger than 250 characters, use a bigger key since the performance impact is minor (around one second to encrypt the password). For passwords bigger than 470 characters, give up earlier and throw exeception recommanding admin to either enable the previously enabled configuration or use smaller passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | Handle one time passwordsCarl Schwan2022-07-051-1/+1
| | | | | | | | | | | | | | | | This adds an option to disable storing passwords in the database. This might be desirable when using single use token as passwords or very large passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | Fix user agent trimming on installationJoas Schilling2022-05-091-1/+1
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Automatically cut the token name on the first levelJoas Schilling2022-03-232-3/+3
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Limit the length of app password namesJoas Schilling2022-03-232-0/+8
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Also cache non-existing to reuse itJoas Schilling2022-02-161-0/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Remove default token which is deprecated since Nextcloud 13Joas Schilling2021-12-017-831/+14
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Fix ArrayAccess and JsonSerializable return typesCôme Chilliet2021-11-232-2/+2
| | | | | | First round of modifications for PHP 8.1 Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Prevent duplicate auth token activity updatesChristoph Wurst2021-10-222-2/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | The auth token activity logic works as follows * Read auth token * Compare last activity time stamp to current time * Update auth token activity if it's older than x seconds This works fine in isolation but with concurrency that means that occasionally the same token is read simultaneously by two processes and both of these processes will trigger an update of the same row. Affectively the second update doesn't add much value. It might set the time stamp to the exact same time stamp or one a few seconds later. But the last activity is no precise science, we don't need this accuracy. This patch changes the UPDATE query to include the expected value in a comparison with the current data. This results in an affected row when the data in the DB still has an old time stamp, but won't affect a row if the time stamp is (nearly) up to date. This is a micro optimization and will possibly not show any significant performance improvement. Yet in setups with a DB cluster it means that the write node has to send fewer changes to the read nodes due to the lower number of actual changes. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Type the autentication provider passwords as nullable stringsChristoph Wurst2021-10-133-13/+4
| | | | | | | | For historic reasons we couldn't add a nullable type hint before nullable type hints were supported by our target php versions. This is now possible. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Tokens without password should not trigger changed password invalidationJulius Härtl2021-10-071-1/+1
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* prevent the invalidation of pw based authn tokens on a pw less loginTobias Assmann2021-07-161-0/+5
| | | | Signed-off-by: Tobias Assmann <tobias.assmann@ecsec.de>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-0413-21/+8
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Always renew apppasswords on loginRoeland Jago Douma2021-02-101-5/+0
| | | | | | | | Else you can end up that you renewed your password (LDAP for example). But they still don't work because you did not use them before you logged in. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update all license headers for Nextcloud 21Christoph Wurst2020-12-161-0/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use PSR logger in authenticationJoas Schilling2020-10-123-10/+10
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Type some of the core mappersChristoph Wurst2020-10-123-1/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format code to a single space around binary operatorsChristoph Wurst2020-10-052-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Allow configuring the activity update interval of tokenRoeland Jago Douma2020-10-041-1/+5
| | | | | | | | On some systems with a lot of users this creates a lot of extra DB writes. Being able to increase this interval helps there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix app password updating out of boundsRoeland Jago Douma2020-09-031-0/+1
| | | | | | | | | | | | | | When your password changes out of bounds your Nextcloud tokens will become invalid. There is no real way around that. However we should make sure that if you successfully log in again your passwords are all updates * Added event listener to the PostLoggedInEvent so that we can act on it - Only if it is not a token login * Make sure that we actually reset the invalid state when we update a token. Else it keeps being marked invalid and thus not used. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update the license headers for Nextcloud 20Christoph Wurst2020-08-241-0/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use matching parameter names form interfaces and implementationsMorris Jobke2020-08-192-7/+7
| | | | | | Found by Psalm 3.14.1 Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Improve traces of invalid token exceptionsChristoph Wurst2020-05-272-17/+17
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update license headers for 19Christoph Wurst2020-04-291-0/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Add visibility to all constantsChristoph Wurst2020-04-103-7/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format control structures, classes, methods and functionChristoph Wurst2020-04-1010-14/+1
| | | | | | | | | | | | | | | To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use exactly one empty line after the namespace declarationChristoph Wurst2020-04-091-1/+0
| | | | | | For PSR2 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update the license headers for Nextcloud 19Christoph Wurst2020-03-311-0/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Remove unused importsChristoph Wurst2020-03-251-1/+0
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge pull request #20127 from nextcloud/bugfix/noid/check-user-on-remote-wipeRoeland Jago Douma2020-03-241-7/+3
|\ | | | | Check the user on remote wipe
| * Check the user on remote wipeJoas Schilling2020-03-161-7/+3
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Fix recursive calls in logging via server methodsJoas Schilling2020-03-181-9/+2
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Update license headersChristoph Wurst2019-12-0513-36/+79
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Throw an invalid token exception is token is marked outdatedRoeland Jago Douma2019-12-021-0/+11
| | | | | | | This avoids hitting the backend with multiple requests for the same token. And will help avoid quick LDAP lockouts. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Handle token insert conflictsChristoph Wurst2019-11-261-9/+24
| | | | | | | | | | | | | | | | Env-based SAML uses the "Apache auth" mechanism to log users in. In this code path, we first delete all existin auth tokens from the database, before a new one is inserted. This is problematic for concurrent requests as they might reach the same code at the same time, hence both trying to insert a new row wit the same token (the session ID). This also bubbles up and disables user_saml. As the token might still be OK (both request will insert the same data), we can actually just check if the UIDs of the conflict row is the same as the one we want to insert right now. In that case let's just use the existing entry and carry on. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Some php-cs fixesRoeland Jago Douma2019-11-221-1/+1
| | | | | | | | | | | * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Make renewSessionToken return the new tokenRoeland Jago Douma2019-10-094-7/+14
| | | | | | | Avoids directly getting the token again. We just inserted it so it and have all the info. So that query is just a waste. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Cache the public key tokensRoeland Jago Douma2019-10-081-5/+42
| | | | | | | | | | Sometimes (esp with token auth) we query the same token multiple times. While this is properly indexed and fast it is still a bit of a waste. Right now it is doing very stupid caching. Which gets invalidate on any update. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add uid to delete temp token queryDaniel Kesselberg2019-09-181-1/+2
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Pass $configargs to openssl_pkey_exportDaniel Kesselberg2019-07-211-1/+4
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Error with exception on SSL errorMorris Jobke2019-07-183-0/+13
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Make it possible to wipe all tokens/devices of a userChristoph Wurst2019-07-091-6/+36
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Refactor: move remote wipe token logic to RW serviceChristoph Wurst2019-07-092-1/+20
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Decouple remote wipe notifcation channels with eventsChristoph Wurst2019-06-271-47/+12
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Remote wipe supportRoeland Jago Douma2019-05-207-1/+201
| | | | | | | | This allows a user to mark a token for remote wipe. Clients that support this can then wipe the device properly. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-03 03:25:13 +0000