aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Authentication
Commit message (Collapse)AuthorAgeFilesLines
...
| * | Handle one time password betterCarl Schwan2022-07-281-1/+1
| | | | | | | | | | | | Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | | Fix typos in lib/private subdirectoryluz paz2022-07-271-1/+1
| | | | | | | | | | | | | | | | | | Found via `codespell -q 3 -S l10n -L jus ./lib/private` Signed-off-by: luz paz <luzpaz@github.com>
* | | Merge pull request #30510 from nextcloud/user-cleanup-storage-before-cacheVincent Petry2022-07-261-1/+1
|\ \ \ | | | | | | | | delete files before cleaning cache when cleaning user files
| * | | delete files before cleaning cache when cleaning user filesRobin Appelman2022-06-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | otherwise, when using object store, we loose track of which files the user owns before we can delete them Signed-off-by: Robin Appelman <robin@icewind.nl>
* | | | Move CappedMemoryCache to OCPCarl Schwan2022-07-141-1/+1
| |/ / |/| | | | | | | | | | | | | | | | | | | | This is an helpful helper that should be used in more place than just server and this is already the case with groupfodlers, deck, user_oidc and more using it, so let's make it public Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | | Handler large passwordsCarl Schwan2022-07-051-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For passwords bigger than 250 characters, use a bigger key since the performance impact is minor (around one second to encrypt the password). For passwords bigger than 470 characters, give up earlier and throw exeception recommanding admin to either enable the previously enabled configuration or use smaller passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | | Handle one time passwordsCarl Schwan2022-07-051-1/+1
|/ / | | | | | | | | | | | | | | This adds an option to disable storing passwords in the database. This might be desirable when using single use token as passwords or very large passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* | Fix replacing external storage password during debug logChristoph Wurst2022-06-011-1/+1
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Merge pull request #32357 from nextcloud/user-delete-remove-wrappersJulius Härtl2022-05-161-0/+8
|\ \ | | | | | | remove storage wrappers when deleting the user storage
| * | remove storage wrappers when deleting the user storageRobin Appelman2022-05-121-0/+8
| | | | | | | | | | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* | | Fix user agent trimming on installationJoas Schilling2022-05-091-1/+1
|/ / | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Log why the login token can't be used for credentialsChristoph Wurst2022-04-041-3/+3
| | | | | | | | | | | | And always pass the exception object to the logger. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Automatically cut the token name on the first levelJoas Schilling2022-03-232-3/+3
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Limit the length of app password namesJoas Schilling2022-03-232-0/+8
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Also cache non-existing to reuse itJoas Schilling2022-02-161-0/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #30016 from ↵Joas Schilling2021-12-027-831/+14
|\ | | | | | | | | nextcloud/techdebt/noid/remove-default-token-provider Remove default token which is deprecated since Nextcloud 13
| * Remove default token which is deprecated since Nextcloud 13Joas Schilling2021-12-017-831/+14
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Only check the twofactor state once per requestJoas Schilling2021-12-011-1/+9
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Fix ArrayAccess and JsonSerializable return typesCôme Chilliet2021-11-232-2/+2
| | | | | | First round of modifications for PHP 8.1 Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Prevent duplicate auth token activity updatesChristoph Wurst2021-10-222-2/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | The auth token activity logic works as follows * Read auth token * Compare last activity time stamp to current time * Update auth token activity if it's older than x seconds This works fine in isolation but with concurrency that means that occasionally the same token is read simultaneously by two processes and both of these processes will trigger an update of the same row. Affectively the second update doesn't add much value. It might set the time stamp to the exact same time stamp or one a few seconds later. But the last activity is no precise science, we don't need this accuracy. This patch changes the UPDATE query to include the expected value in a comparison with the current data. This results in an affected row when the data in the DB still has an old time stamp, but won't affect a row if the time stamp is (nearly) up to date. This is a micro optimization and will possibly not show any significant performance improvement. Yet in setups with a DB cluster it means that the write node has to send fewer changes to the read nodes due to the lower number of actual changes. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Type the autentication provider passwords as nullable stringsChristoph Wurst2021-10-133-13/+4
| | | | | | | | For historic reasons we couldn't add a nullable type hint before nullable type hints were supported by our target php versions. This is now possible. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Tokens without password should not trigger changed password invalidationJulius Härtl2021-10-071-1/+1
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* prevent the invalidation of pw based authn tokens on a pw less loginTobias Assmann2021-07-162-0/+10
| | | | Signed-off-by: Tobias Assmann <tobias.assmann@ecsec.de>
* Properly cleanup entries of WebAuthn on user deletionMorris Jobke2021-06-182-0/+63
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-0469-162/+115
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* better cleanup of user files on user deletionRobin Appelman2021-04-271-0/+73
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Move 2fa backupscode to new registrationRoeland Jago Douma2021-04-201-1/+1
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Move 2FA registration to IBootstrapRoeland Jago Douma2021-04-201-1/+17
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Use correct getSystemValue typeJ0WI2021-04-121-1/+1
| | | | Signed-off-by: J0WI <J0WI@users.noreply.github.com>
* Add real events for enabled 2fa providers for usersRoeland Jago Douma2021-03-221-4/+16
| | | | | | | * Shiny new events * Listener to still emit the old event Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #25544 from nextcloud/refactor/app-password-created-eventChristoph Wurst2021-03-021-0/+43
|\ | | | | Move app_password_created to a typed event
| * Move app_password_created to a typed eventChristoph Wurst2021-02-091-0/+43
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Always renew apppasswords on loginRoeland Jago Douma2021-02-101-5/+0
|/ | | | | | | | Else you can end up that you renewed your password (LDAP for example). But they still don't work because you did not use them before you logged in. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Convert 2FA token type to stringChristoph Wurst2021-01-221-3/+3
| | | | | | | | The IConfig service is documented to handle its data as strings, hence this changes the code a bit to ensure we store keys as string and convert them back when reading. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update all license headers for Nextcloud 21Christoph Wurst2020-12-1611-1/+11
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Type the authentication listenersChristoph Wurst2020-10-157-0/+21
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use PSR logger in authenticationJoas Schilling2020-10-1211-60/+54
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Type some of the core mappersChristoph Wurst2020-10-124-1/+10
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format code to a single space around binary operatorsChristoph Wurst2020-10-052-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Allow configuring the activity update interval of tokenRoeland Jago Douma2020-10-041-1/+5
| | | | | | | | On some systems with a lot of users this creates a lot of extra DB writes. Being able to increase this interval helps there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #22641 from ↵Roeland Jago Douma2020-09-081-2/+7
|\ | | | | | | | | nextcloud/fix/credentials-store-upgrade-property-undefined Fix undefined class property access after upgrade from 19 to 20
| * Fix undefined class property access after upgrade from 19 to 20Christoph Wurst2020-09-071-2/+7
| | | | | | | | | | | | | | | | | | The serialized data in 19 has one property less and this was not considered in the code. Hence adding a fallback. Moreover I'm changing the deserialization into an array instead of object, as that is the safer option. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Update license headers for Nextcloud 20 (again)Christoph Wurst2020-09-072-1/+3
|/ | | | | | | There are still lots of outdated headers, so time for another round of updates. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix app password updating out of boundsRoeland Jago Douma2020-09-032-0/+55
| | | | | | | | | | | | | | When your password changes out of bounds your Nextcloud tokens will become invalid. There is no real way around that. However we should make sure that if you successfully log in again your passwords are all updates * Added event listener to the PostLoggedInEvent so that we can act on it - Only if it is not a token login * Make sure that we actually reset the invalid state when we update a token. Else it keeps being marked invalid and thus not used. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #21288 from lmamane/masterRoeland Jago Douma2020-08-281-1/+1
|\ | | | | Return correct loginname in credentials
| * Return correct loginname in credentials,Lionel Elie Mamane2020-08-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | even when token is invalid or has no password. Returning the uid as loginname is wrong, and leads to problems when these differ. E.g. the getapppassword API was creating app token with the uid as loginname. In a scenario with external authentication (such as LDAP), these tokens were then invalidated next time their underlying password was checked, and systematically ceased to function. Co-authored-by: kesselb <mail@danielkesselberg.de> for: switch to consistent camelCase Signed-off-by: Lionel Elie Mamane <lionel@mamane.lu>
* | Update the license headers for Nextcloud 20Christoph Wurst2020-08-242-2/+4
|/ | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use matching parameter names form interfaces and implementationsMorris Jobke2020-08-192-7/+7
| | | | | | Found by Psalm 3.14.1 Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Merge pull request #21344 from nextcloud/fix/twofactor-cleanup-eventMorris Jobke2020-08-132-10/+34
|\ | | | | Emit an event for every disabled 2FA provider during cleanup
| * Emit an event for every disabled 2FA provider during cleanupChristoph Wurst2020-06-162-10/+34
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-13 11:21:37 +0000