Merge pull request #9546 from nextcloud/backport/9517/stable12

[stable12] Improve OAuth
This commit is contained in:
Morris Jobke 2018-05-23 19:03:38 +02:00 committed by GitHub
commit 6b5fea40eb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
18 changed files with 787 additions and 64 deletions

View File

@ -6,7 +6,7 @@
<licence>agpl</licence> <licence>agpl</licence>
<author>Lukas Reschke</author> <author>Lukas Reschke</author>
<namespace>OAuth2</namespace> <namespace>OAuth2</namespace>
<version>1.0.5</version> <version>1.0.6</version>
<default_enable/> <default_enable/>
<types> <types>
<authentication/> <authentication/>
@ -16,6 +16,12 @@
<nextcloud min-version="12" max-version="12" /> <nextcloud min-version="12" max-version="12" />
</dependencies> </dependencies>
<repair-steps>
<post-migration>
<step>OCA\OAuth2\Migration\SetTokenExpiration</step>
</post-migration>
</repair-steps>
<settings> <settings>
<admin>OCA\OAuth2\Settings\Admin</admin> <admin>OCA\OAuth2\Settings\Admin</admin>
</settings> </settings>

View File

@ -61,11 +61,20 @@ class LoginRedirectorController extends Controller {
* *
* @param string $client_id * @param string $client_id
* @param string $state * @param string $state
* @param string $response_type
* @return RedirectResponse * @return RedirectResponse
*/ */
public function authorize($client_id, public function authorize($client_id,
$state) { $state,
$response_type) {
$client = $this->clientMapper->getByIdentifier($client_id); $client = $this->clientMapper->getByIdentifier($client_id);
if ($response_type !== 'code') {
//Fail
$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
return new RedirectResponse($url);
}
$this->session->set('oauth.state', $state); $this->session->set('oauth.state', $state);
$targetUrl = $this->urlGenerator->linkToRouteAbsolute( $targetUrl = $this->urlGenerator->linkToRouteAbsolute(

View File

@ -21,10 +21,17 @@
namespace OCA\OAuth2\Controller; namespace OCA\OAuth2\Controller;
use OC\Authentication\Token\DefaultTokenMapper; use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OCA\OAuth2\Db\AccessTokenMapper; use OCA\OAuth2\Db\AccessTokenMapper;
use OCA\OAuth2\Db\ClientMapper;
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
use OCA\OAuth2\Exceptions\ClientNotFoundException;
use OCP\AppFramework\Controller; use OCP\AppFramework\Controller;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\JSONResponse;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IRequest; use OCP\IRequest;
use OCP\Security\ICrypto; use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom; use OCP\Security\ISecureRandom;
@ -32,56 +39,133 @@ use OCP\Security\ISecureRandom;
class OauthApiController extends Controller { class OauthApiController extends Controller {
/** @var AccessTokenMapper */ /** @var AccessTokenMapper */
private $accessTokenMapper; private $accessTokenMapper;
/** @var ClientMapper */
private $clientMapper;
/** @var ICrypto */ /** @var ICrypto */
private $crypto; private $crypto;
/** @var DefaultTokenMapper */ /** @var TokenProvider */
private $defaultTokenMapper; private $tokenProvider;
/** @var ISecureRandom */ /** @var ISecureRandom */
private $secureRandom; private $secureRandom;
/** @var ITimeFactory */
private $time;
/** /**
* @param string $appName * @param string $appName
* @param IRequest $request * @param IRequest $request
* @param ICrypto $crypto * @param ICrypto $crypto
* @param AccessTokenMapper $accessTokenMapper * @param AccessTokenMapper $accessTokenMapper
* @param DefaultTokenMapper $defaultTokenMapper * @param ClientMapper $clientMapper
* @param TokenProvider $tokenProvider
* @param ISecureRandom $secureRandom * @param ISecureRandom $secureRandom
* @param ITimeFactory $time
*/ */
public function __construct($appName, public function __construct($appName,
IRequest $request, IRequest $request,
ICrypto $crypto, ICrypto $crypto,
AccessTokenMapper $accessTokenMapper, AccessTokenMapper $accessTokenMapper,
DefaultTokenMapper $defaultTokenMapper, ClientMapper $clientMapper,
ISecureRandom $secureRandom) { TokenProvider $tokenProvider,
ISecureRandom $secureRandom,
ITimeFactory $time) {
parent::__construct($appName, $request); parent::__construct($appName, $request);
$this->crypto = $crypto; $this->crypto = $crypto;
$this->accessTokenMapper = $accessTokenMapper; $this->accessTokenMapper = $accessTokenMapper;
$this->defaultTokenMapper = $defaultTokenMapper; $this->clientMapper = $clientMapper;
$this->tokenProvider = $tokenProvider;
$this->secureRandom = $secureRandom; $this->secureRandom = $secureRandom;
$this->time = $time;
} }
/** /**
* @PublicPage * @PublicPage
* @NoCSRFRequired * @NoCSRFRequired
* *
* @param string $grant_type
* @param string $code * @param string $code
* @param string $refresh_token
* @param string $client_id
* @param string $client_secret
* @return JSONResponse * @return JSONResponse
*/ */
public function getToken($code) { public function getToken($grant_type, $code, $refresh_token, $client_id, $client_secret) {
// We only handle two types
if ($grant_type !== 'authorization_code' && $grant_type !== 'refresh_token') {
return new JSONResponse([
'error' => 'invalid_grant',
], Http::STATUS_BAD_REQUEST);
}
// We handle the initial and refresh tokens the same way
if ($grant_type === 'refresh_token' ) {
$code = $refresh_token;
}
try {
$accessToken = $this->accessTokenMapper->getByCode($code); $accessToken = $this->accessTokenMapper->getByCode($code);
} catch (AccessTokenNotFoundException $e) {
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
try {
$client = $this->clientMapper->getByUid($accessToken->getClientId());
} catch (ClientNotFoundException $e) {
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
// The client id and secret must match. Else we don't provide an access token!
if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
return new JSONResponse([
'error' => 'invalid_client',
], Http::STATUS_BAD_REQUEST);
}
$decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code); $decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
$newCode = $this->secureRandom->generate(128);
// Obtain the appToken assoicated
try {
$appToken = $this->tokenProvider->getTokenById($accessToken->getTokenId());
} catch (ExpiredTokenException $e) {
$appToken = $e->getToken();
} catch (InvalidTokenException $e) {
//We can't do anything...
$this->accessTokenMapper->delete($accessToken);
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
// Rotate the apptoken (so the old one becomes invalid basically)
$newToken = $this->secureRandom->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$appToken = $this->tokenProvider->rotate(
$appToken,
$decryptedToken,
$newToken
);
// Expiration is in 1 hour again
$appToken->setExpires($this->time->getTime() + 3600);
$this->tokenProvider->updateToken($appToken);
// Generate a new refresh token and encrypt the new apptoken in the DB
$newCode = $this->secureRandom->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$accessToken->setHashedCode(hash('sha512', $newCode)); $accessToken->setHashedCode(hash('sha512', $newCode));
$accessToken->setEncryptedToken($this->crypto->encrypt($decryptedToken, $newCode)); $accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
$this->accessTokenMapper->update($accessToken); $this->accessTokenMapper->update($accessToken);
return new JSONResponse( return new JSONResponse(
[ [
'access_token' => $decryptedToken, 'access_token' => $newToken,
'token_type' => 'Bearer', 'token_type' => 'Bearer',
'expires_in' => 3600, 'expires_in' => 3600,
'refresh_token' => $newCode, 'refresh_token' => $newCode,
'user_id' => $this->defaultTokenMapper->getTokenById($accessToken->getTokenId())->getUID(), 'user_id' => $appToken->getUID(),
] ]
); );
} }

View File

@ -0,0 +1,77 @@
<?php
/**
* @copyright Copyright 2018, Roeland Jago Douma <roeland@famdouma.nl>
*
* @author Roeland Jago Douma <roeland@famdouma.nl>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\OAuth2\Migration;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OCA\OAuth2\Db\AccessToken;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IDBConnection;
use OCP\Migration\IOutput;
use OCP\Migration\IRepairStep;
class SetTokenExpiration implements IRepairStep {
/** @var IDBConnection */
private $connection;
/** @var ITimeFactory */
private $time;
/** @var TokenProvider */
private $tokenProvider;
public function __construct(IDBConnection $connection,
ITimeFactory $timeFactory,
TokenProvider $tokenProvider) {
$this->connection = $connection;
$this->time = $timeFactory;
$this->tokenProvider = $tokenProvider;
}
public function getName() {
return 'Update OAuth token expiration times';
}
public function run(IOutput $output) {
$qb = $this->connection->getQueryBuilder();
$qb->select('*')
->from('oauth2_access_tokens');
$cursor = $qb->execute();
while($row = $cursor->fetch()) {
$token = AccessToken::fromRow($row);
try {
$appToken = $this->tokenProvider->getTokenById($token->getTokenId());
$appToken->setExpires($this->time->getTime() + 3600);
$this->tokenProvider->updateToken($appToken);
} catch (InvalidTokenException $e) {
//Skip this token
}
}
$cursor->closeCursor();
}
}

View File

@ -86,6 +86,24 @@ class LoginRedirectorControllerTest extends TestCase {
->willReturn('https://example.com/?clientIdentifier=foo'); ->willReturn('https://example.com/?clientIdentifier=foo');
$expected = new RedirectResponse('https://example.com/?clientIdentifier=foo'); $expected = new RedirectResponse('https://example.com/?clientIdentifier=foo');
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState')); $this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'code'));
}
public function testAuthorizeWrongResponseType() {
$client = new Client();
$client->setClientIdentifier('MyClientIdentifier');
$client->setRedirectUri('http://foo.bar');
$this->clientMapper
->expects($this->once())
->method('getByIdentifier')
->with('MyClientId')
->willReturn($client);
$this->session
->expects($this->never())
->method('set');
$expected = new RedirectResponse('http://foo.bar?error=unsupported_response_type&state=MyState');
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'wrongcode'));
} }
} }

View File

@ -21,12 +21,22 @@
namespace OCA\OAuth2\Tests\Controller; namespace OCA\OAuth2\Tests\Controller;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\DefaultToken; use OC\Authentication\Token\DefaultToken;
use OC\Authentication\Token\DefaultTokenMapper; use OC\Authentication\Token\DefaultTokenMapper;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OC\Authentication\Token\IToken;
use OCA\OAuth2\Controller\OauthApiController; use OCA\OAuth2\Controller\OauthApiController;
use OCA\OAuth2\Db\AccessToken; use OCA\OAuth2\Db\AccessToken;
use OCA\OAuth2\Db\AccessTokenMapper; use OCA\OAuth2\Db\AccessTokenMapper;
use OCA\OAuth2\Db\Client;
use OCA\OAuth2\Db\ClientMapper;
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
use OCA\OAuth2\Exceptions\ClientNotFoundException;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\JSONResponse;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IRequest; use OCP\IRequest;
use OCP\Security\ICrypto; use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom; use OCP\Security\ISecureRandom;
@ -39,10 +49,14 @@ class OauthApiControllerTest extends TestCase {
private $crypto; private $crypto;
/** @var AccessTokenMapper|\PHPUnit_Framework_MockObject_MockObject */ /** @var AccessTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
private $accessTokenMapper; private $accessTokenMapper;
/** @var DefaultTokenMapper|\PHPUnit_Framework_MockObject_MockObject */ /** @var ClientMapper|\PHPUnit_Framework_MockObject_MockObject */
private $defaultTokenMapper; private $clientMapper;
/** @var TokenProvider|\PHPUnit_Framework_MockObject_MockObject */
private $tokenProvider;
/** @var ISecureRandom|\PHPUnit_Framework_MockObject_MockObject */ /** @var ISecureRandom|\PHPUnit_Framework_MockObject_MockObject */
private $secureRandom; private $secureRandom;
/** @var ITimeFactory|\PHPUnit_Framework_MockObject_MockObject */
private $time;
/** @var OauthApiController */ /** @var OauthApiController */
private $oauthApiController; private $oauthApiController;
@ -52,55 +66,307 @@ class OauthApiControllerTest extends TestCase {
$this->request = $this->createMock(IRequest::class); $this->request = $this->createMock(IRequest::class);
$this->crypto = $this->createMock(ICrypto::class); $this->crypto = $this->createMock(ICrypto::class);
$this->accessTokenMapper = $this->createMock(AccessTokenMapper::class); $this->accessTokenMapper = $this->createMock(AccessTokenMapper::class);
$this->defaultTokenMapper = $this->createMock(DefaultTokenMapper::class); $this->clientMapper = $this->createMock(ClientMapper::class);
$this->tokenProvider = $this->createMock(TokenProvider::class);
$this->secureRandom = $this->createMock(ISecureRandom::class); $this->secureRandom = $this->createMock(ISecureRandom::class);
$this->time = $this->createMock(ITimeFactory::class);
$this->oauthApiController = new OauthApiController( $this->oauthApiController = new OauthApiController(
'oauth2', 'oauth2',
$this->request, $this->request,
$this->crypto, $this->crypto,
$this->accessTokenMapper, $this->accessTokenMapper,
$this->defaultTokenMapper, $this->clientMapper,
$this->secureRandom $this->tokenProvider,
$this->secureRandom,
$this->time
); );
} }
public function testGetToken() { public function testGetTokenInvalidGrantType() {
$accessToken = new AccessToken(); $expected = new JSONResponse([
$accessToken->setEncryptedToken('MyEncryptedToken'); 'error' => 'invalid_grant',
$accessToken->setTokenId(123); ], Http::STATUS_BAD_REQUEST);
$this->accessTokenMapper
->expects($this->once())
->method('getByCode')
->willReturn($accessToken);
$this->crypto
->expects($this->once())
->method('decrypt')
->with('MyEncryptedToken', 'MySecretCode')
->willReturn('MyDecryptedToken');
$this->secureRandom
->expects($this->once())
->method('generate')
->with(128)
->willReturn('NewToken');
$token = new DefaultToken();
$token->setUid('JohnDoe');
$this->defaultTokenMapper
->expects($this->once())
->method('getTokenById')
->with(123)
->willReturn($token);
$expected = new JSONResponse( $this->assertEquals($expected, $this->oauthApiController->getToken('foo', null, null, null, null));
[ }
'access_token' => 'MyDecryptedToken',
public function testGetTokenInvalidCode() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$this->accessTokenMapper->method('getByCode')
->with('invalidcode')
->willThrowException(new AccessTokenNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('authorization_code', 'invalidcode', null, null, null));
}
public function testGetTokenInvalidRefreshToken() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$this->accessTokenMapper->method('getByCode')
->with('invalidrefresh')
->willThrowException(new AccessTokenNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'invalidrefresh', null, null));
}
public function testGetTokenClientDoesNotExist() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$this->clientMapper->method('getByUid')
->with(42)
->willThrowException(new ClientNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', null, null));
}
public function invalidClientProvider() {
return [
['invalidClientId', 'invalidClientSecret'],
['clientId', 'invalidClientSecret'],
['invalidClientId', 'clientSecret'],
];
}
/**
* @dataProvider invalidClientProvider
*
* @param string $clientId
* @param string $clientSecret
*/
public function testGetTokenInvalidClient($clientId, $clientSecret) {
$expected = new JSONResponse([
'error' => 'invalid_client',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', $clientId, $clientSecret));
}
public function testGetTokenInvalidAppToken() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willThrowException(new InvalidTokenException());
$this->accessTokenMapper->expects($this->once())
->method('delete')
->with($accessToken);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
}
public function testGetTokenValidAppToken() {
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$appToken = new DefaultToken();
$appToken->setUid('userId');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willThrowException(new ExpiredTokenException($appToken));
$this->accessTokenMapper->expects($this->never())
->method('delete')
->with($accessToken);
$this->secureRandom->method('generate')
->will($this->returnCallback(function ($len) {
return 'random'.$len;
}));
$this->tokenProvider->expects($this->once())
->method('rotate')
->with(
$appToken,
'decryptedToken',
'random72'
)->willReturn($appToken);
$this->time->method('getTime')
->willReturn(1000);
$this->tokenProvider->expects($this->once())
->method('updateToken')
->with(
$this->callback(function (DefaultToken $token) {
return $token->getExpires() === 4600;
})
);
$this->crypto->method('encrypt')
->with('random72', 'random128')
->willReturn('newEncryptedToken');
$this->accessTokenMapper->expects($this->once())
->method('update')
->with(
$this->callback(function (AccessToken $token) {
return $token->getHashedCode() === hash('sha512', 'random128') &&
$token->getEncryptedToken() === 'newEncryptedToken';
})
);
$expected = new JSONResponse([
'access_token' => 'random72',
'token_type' => 'Bearer', 'token_type' => 'Bearer',
'expires_in' => 3600, 'expires_in' => 3600,
'refresh_token' => 'NewToken', 'refresh_token' => 'random128',
'user_id' => 'JohnDoe', 'user_id' => 'userId',
] ]);
);
$this->assertEquals($expected, $this->oauthApiController->getToken('MySecretCode')); $this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
} }
public function testGetTokenExpiredAppToken() {
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$appToken = new DefaultToken();
$appToken->setUid('userId');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willReturn($appToken);
$this->accessTokenMapper->expects($this->never())
->method('delete')
->with($accessToken);
$this->secureRandom->method('generate')
->will($this->returnCallback(function ($len) {
return 'random'.$len;
}));
$this->tokenProvider->expects($this->once())
->method('rotate')
->with(
$appToken,
'decryptedToken',
'random72'
)->willReturn($appToken);
$this->time->method('getTime')
->willReturn(1000);
$this->tokenProvider->expects($this->once())
->method('updateToken')
->with(
$this->callback(function (DefaultToken $token) {
return $token->getExpires() === 4600;
})
);
$this->crypto->method('encrypt')
->with('random72', 'random128')
->willReturn('newEncryptedToken');
$this->accessTokenMapper->expects($this->once())
->method('update')
->with(
$this->callback(function (AccessToken $token) {
return $token->getHashedCode() === hash('sha512', 'random128') &&
$token->getEncryptedToken() === 'newEncryptedToken';
})
);
$expected = new JSONResponse([
'access_token' => 'random72',
'token_type' => 'Bearer',
'expires_in' => 3600,
'refresh_token' => 'random128',
'user_id' => 'userId',
]);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
}
} }

View File

@ -286,7 +286,7 @@ class ClientFlowLoginController extends Controller {
); );
if($client) { if($client) {
$code = $this->random->generate(128); $code = $this->random->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$accessToken = new AccessToken(); $accessToken = new AccessToken();
$accessToken->setClientId($client->getId()); $accessToken->setClientId($client->getId());
$accessToken->setEncryptedToken($this->crypto->encrypt($token, $code)); $accessToken->setEncryptedToken($this->crypto->encrypt($token, $code));

View File

@ -1181,6 +1181,15 @@
<notnull>false</notnull> <notnull>false</notnull>
</field> </field>
<field>
<name>expires</name>
<type>integer</type>
<default></default>
<notnull>false</notnull>
<unsigned>true</unsigned>
<length>4</length>
</field>
<index> <index>
<name>authtoken_token_index</name> <name>authtoken_token_index</name>
<unique>true</unique> <unique>true</unique>

View File

@ -363,6 +363,7 @@ return array(
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php', 'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php', 'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php', 'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
'OC\\Authentication\\Token\\ExpiredTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php', 'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php',
'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php', 'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php',
'OC\\Authentication\\TwoFactorAuth\\Manager' => $baseDir . '/lib/private/Authentication/TwoFactorAuth/Manager.php', 'OC\\Authentication\\TwoFactorAuth\\Manager' => $baseDir . '/lib/private/Authentication/TwoFactorAuth/Manager.php',

View File

@ -393,6 +393,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php', 'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php', 'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php', 'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
'OC\\Authentication\\Token\\ExpiredTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php', 'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php',
'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php', 'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php',
'OC\\Authentication\\TwoFactorAuth\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/TwoFactorAuth/Manager.php', 'OC\\Authentication\\TwoFactorAuth\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/TwoFactorAuth/Manager.php',

View File

@ -0,0 +1,40 @@
<?php
/**
* @copyright Copyright (c) 2018 Roeland Jago Douma <roeland@famdouma.nl>
*
* @author Roeland Jago Douma <roeland@famdouma.nl>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OC\Authentication\Token;
use OC\Authentication\Exceptions\InvalidTokenException;
class ExpiredTokenException extends InvalidTokenException {
/** @var IToken */
private $token;
public function __construct(IToken $token) {
parent::__construct();
$this->token = $token;
}
public function getToken() {
return $this->token;
}
}

View File

@ -28,10 +28,8 @@ use OCP\AppFramework\Db\Entity;
* @method void setId(int $id) * @method void setId(int $id)
* @method void setUid(string $uid); * @method void setUid(string $uid);
* @method void setLoginName(string $loginName) * @method void setLoginName(string $loginName)
* @method void setPassword(string $password)
* @method void setName(string $name) * @method void setName(string $name)
* @method string getName() * @method string getName()
* @method void setToken(string $token)
* @method string getToken() * @method string getToken()
* @method void setType(string $type) * @method void setType(string $type)
* @method int getType() * @method int getType()
@ -92,10 +90,18 @@ class DefaultToken extends Entity implements IToken {
*/ */
protected $scope; protected $scope;
/** @var int */
protected $expires;
public function __construct() { public function __construct() {
$this->addType('type', 'int'); $this->addType('type', 'int');
$this->addType('lastActivity', 'int'); $this->addType('lastActivity', 'int');
$this->addType('lastCheck', 'int'); $this->addType('lastCheck', 'int');
$this->addType('scope', 'string');
$this->addType('expires', 'int');
$this->setExpires(null);
$this->markFieldUpdated('expires');
} }
public function getId() { public function getId() {
@ -173,4 +179,23 @@ class DefaultToken extends Entity implements IToken {
parent::setScope((string)$scope); parent::setScope((string)$scope);
} }
} }
public function setToken($token) {
parent::setToken($token);
}
public function setPassword($password = null) {
parent::setPassword($password);
}
public function setExpires($expires) {
parent::setExpires($expires);
}
/**
* @return int|null
*/
public function getExpires() {
return parent::getExpires();
}
} }

View File

@ -72,7 +72,7 @@ class DefaultTokenMapper extends Mapper {
public function getToken($token) { public function getToken($token) {
/* @var $qb IQueryBuilder */ /* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder(); $qb = $this->db->getQueryBuilder();
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope') $result = $qb->select('*')
->from('authtoken') ->from('authtoken')
->where($qb->expr()->eq('token', $qb->createNamedParameter($token))) ->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
->execute(); ->execute();
@ -96,7 +96,7 @@ class DefaultTokenMapper extends Mapper {
public function getTokenById($id) { public function getTokenById($id) {
/* @var $qb IQueryBuilder */ /* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder(); $qb = $this->db->getQueryBuilder();
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'token', 'last_activity', 'last_check', 'scope') $result = $qb->select('*')
->from('authtoken') ->from('authtoken')
->where($qb->expr()->eq('id', $qb->createNamedParameter($id))) ->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
->execute(); ->execute();
@ -121,7 +121,7 @@ class DefaultTokenMapper extends Mapper {
public function getTokenByUser(IUser $user) { public function getTokenByUser(IUser $user) {
/* @var $qb IQueryBuilder */ /* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder(); $qb = $this->db->getQueryBuilder();
$qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope') $qb->select('*')
->from('authtoken') ->from('authtoken')
->where($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID()))) ->where($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID())))
->setMaxResults(1000); ->setMaxResults(1000);

View File

@ -150,13 +150,20 @@ class DefaultTokenProvider implements IProvider {
* @param string $tokenId * @param string $tokenId
* @throws InvalidTokenException * @throws InvalidTokenException
* @return DefaultToken * @return DefaultToken
* @throws ExpiredTokenException
*/ */
public function getToken($tokenId) { public function getToken($tokenId) {
try { try {
return $this->mapper->getToken($this->hashToken($tokenId)); $token = $this->mapper->getToken($this->hashToken($tokenId));
} catch (DoesNotExistException $ex) { } catch (DoesNotExistException $ex) {
throw new InvalidTokenException(); throw new InvalidTokenException();
} }
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
throw new ExpiredTokenException($token);
}
return $token;
} }
/** /**
@ -165,13 +172,21 @@ class DefaultTokenProvider implements IProvider {
* @param string $tokenId * @param string $tokenId
* @throws InvalidTokenException * @throws InvalidTokenException
* @return DefaultToken * @return DefaultToken
* @throws ExpiredTokenException
* @return IToken
*/ */
public function getTokenById($tokenId) { public function getTokenById($tokenId) {
try { try {
return $this->mapper->getTokenById($tokenId); $token = $this->mapper->getTokenById($tokenId);
} catch (DoesNotExistException $ex) { } catch (DoesNotExistException $ex) {
throw new InvalidTokenException(); throw new InvalidTokenException();
} }
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
throw new ExpiredTokenException($token);
}
return $token;
} }
/** /**
@ -261,6 +276,28 @@ class DefaultTokenProvider implements IProvider {
$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER); $this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
} }
/**
* Rotate the token. Usefull for for example oauth tokens
*
* @param IToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
*/
public function rotate(IToken $token, $oldTokenId, $newTokenId) {
try {
$password = $this->getPassword($token, $oldTokenId);
$token->setPassword($this->encryptPassword($password, $newTokenId));
} catch (PasswordlessTokenException $e) {
}
$token->setToken($this->hashToken($newTokenId));
$this->updateToken($token);
return $token;
}
/** /**
* @param string $token * @param string $token
* @return string * @return string

View File

@ -48,6 +48,7 @@ interface IProvider {
* *
* @param string $tokenId * @param string $tokenId
* @throws InvalidTokenException * @throws InvalidTokenException
* @throws ExpiredTokenException
* @return IToken * @return IToken
*/ */
public function getToken($tokenId); public function getToken($tokenId);
@ -58,6 +59,7 @@ interface IProvider {
* @param string $tokenId * @param string $tokenId
* @throws InvalidTokenException * @throws InvalidTokenException
* @return DefaultToken * @return DefaultToken
* @throws ExpiredTokenException
*/ */
public function getTokenById($tokenId); public function getTokenById($tokenId);
@ -135,4 +137,14 @@ interface IProvider {
* @throws InvalidTokenException * @throws InvalidTokenException
*/ */
public function setPassword(IToken $token, $tokenId, $password); public function setPassword(IToken $token, $tokenId, $password);
/**
* Rotate the token. Usefull for for example oauth tokens
*
* @param IToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
*/
public function rotate(IToken $token, $oldTokenId, $newTokenId);
} }

View File

@ -93,4 +93,25 @@ interface IToken extends JsonSerializable {
* @param array $scope * @param array $scope
*/ */
public function setScope($scope); public function setScope($scope);
/**
* Set the token
*
* @param string $token
*/
public function setToken($token);
/**
* Set the password
*
* @param string $password
*/
public function setPassword($password);
/**
* Set the expiration time of the token
*
* @param int|null $expires
*/
public function setExpires($expires);
} }

View File

@ -25,6 +25,7 @@ namespace Test\Authentication\Token;
use OC\Authentication\Exceptions\InvalidTokenException; use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\DefaultToken; use OC\Authentication\Token\DefaultToken;
use OC\Authentication\Token\DefaultTokenProvider; use OC\Authentication\Token\DefaultTokenProvider;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IToken; use OC\Authentication\Token\IToken;
use OCP\AppFramework\Db\DoesNotExistException; use OCP\AppFramework\Db\DoesNotExistException;
use OCP\AppFramework\Db\Mapper; use OCP\AppFramework\Db\Mapper;
@ -396,6 +397,63 @@ class DefaultTokenProviderTest extends TestCase {
$this->tokenProvider->renewSessionToken('oldId', 'newId'); $this->tokenProvider->renewSessionToken('oldId', 'newId');
} }
public function testGetToken() {
$token = new DefaultToken();
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willReturn($token);
$this->assertSame($token, $this->tokenProvider->getToken('unhashedToken'));
}
public function testGetInvalidToken() {
$this->expectException(InvalidTokenException::class);
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willThrowException(new InvalidTokenException());
$this->tokenProvider->getToken('unhashedToken');
}
public function testGetExpiredToken() {
$token = new DefaultToken();
$token->setExpires(42);
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willReturn($token);
try {
$this->tokenProvider->getToken('unhashedToken');
} catch (ExpiredTokenException $e) {
$this->assertSame($token, $e->getToken());
}
}
public function testGetTokenById() { public function testGetTokenById() {
$token = $this->createMock(DefaultToken::class); $token = $this->createMock(DefaultToken::class);
@ -417,4 +475,63 @@ class DefaultTokenProviderTest extends TestCase {
$this->tokenProvider->getTokenById(42); $this->tokenProvider->getTokenById(42);
} }
public function testGetExpiredTokenById() {
$token = new DefaultToken();
$token->setExpires(42);
$this->mapper->expects($this->once())
->method('getTokenById')
->with($this->equalTo(42))
->willReturn($token);
try {
$this->tokenProvider->getTokenById(42);
$this->fail();
} catch (ExpiredTokenException $e) {
$this->assertSame($token, $e->getToken());
}
}
public function testRotate() {
$token = new DefaultToken();
$token->setPassword('oldencryptedpassword');
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->crypto->method('decrypt')
->with('oldencryptedpassword', 'oldtokenmysecret')
->willReturn('mypassword');
$this->crypto->method('encrypt')
->with('mypassword', 'newtokenmysecret')
->willReturn('newencryptedpassword');
$this->mapper->expects($this->once())
->method('update')
->with($this->callback(function (DefaultToken $token) {
return $token->getPassword() === 'newencryptedpassword' &&
$token->getToken() === hash('sha512', 'newtokenmysecret');
}));
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
}
public function testRotateNoPassword() {
$token = new DefaultToken();
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->expects($this->once())
->method('update')
->with($this->callback(function (DefaultToken $token) {
return $token->getPassword() === null &&
$token->getToken() === hash('sha512', 'newtokenmysecret');
}));
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
}
} }

View File

@ -26,7 +26,7 @@
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel // between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
// when updating major/minor version number. // when updating major/minor version number.
$OC_Version = array(12, 0, 7, 1); $OC_Version = array(12, 0, 7, 2);
// The human readable string // The human readable string
$OC_VersionString = '12.0.7'; $OC_VersionString = '12.0.7';