28ce7dd262
do not allow client password logins if token auth is enforced or 2FA is enabled
2016-05-24 17:54:02 +02:00
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
4128b853e5
login explicitly
2016-05-24 09:48:02 +02:00
5a8af2f0be
Merge pull request #24729 from owncloud/try-token-login-first
...
try token login first
2016-05-23 20:50:57 +02:00
4f6670d759
Merge pull request #24658 from owncloud/invalidate-disabled-user-session
...
invalidate user session if the user was disabled
2016-05-23 20:50:25 +02:00
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
c20cdc2213
invalidate user session if the user is disabled
2016-05-23 10:32:16 +02:00
11dc97da43
try token login first
2016-05-20 10:52:39 +02:00
f824f3e5f3
don't allow token login for disabled users
2016-05-18 21:10:37 +02:00
98b465a8b9
a single token provider suffices
2016-05-18 09:20:48 +02:00
0486d750aa
use the UID for creating the session token, not the login name
2016-05-11 13:36:46 +02:00
69dafd727d
delete the token in case an exception is thrown when decrypting the password
2016-05-11 13:36:46 +02:00
46bdf6ea2b
fix PHPDoc and other minor issues
2016-05-11 13:36:46 +02:00
a9b500c03b
catch possible SessionNotAvailableExceptions
2016-05-11 13:36:46 +02:00
f0f8bdd495
PHPDoc and other minor fixes
2016-05-11 13:36:46 +02:00
699289cd26
pass in $request on OCS api
2016-05-11 13:36:46 +02:00
168ccf90a6
try apache auth too
2016-05-11 13:36:46 +02:00
8cc5f6036f
Fix existing tests
2016-05-11 13:36:46 +02:00
7aa16e1559
fix setup
2016-05-11 13:36:46 +02:00
7e7d5a2ef2
Add fallback to allow user:token basic auth
2016-05-11 13:36:46 +02:00
fdc2cd7554
Add token auth for OCS APIs
2016-05-11 13:36:46 +02:00
8d48502187
Add index on 'last_activity'
...
add token type column and delete only temporary tokens in the background job
debounce token updates; fix wrong class import
2016-05-11 13:36:46 +02:00
53636c73d6
Add controller to generate client tokens
2016-05-11 13:36:46 +02:00
3ab922601a
Check if session token is valid and log user out if the check fails
...
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
2016-05-11 13:36:46 +02:00
2fa5e0a24e
invalidate (delete) session token on logout
...
add 'last_activity' column to session tokens and delete old ones via a background job
2016-05-11 13:36:46 +02:00
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
f6ee738ba8
Add \OC\User\Backend
...
Since some apps (ldap et al) still depend on OC_User_Backend this seemed
like the cleanest approach.
2016-05-10 19:53:36 +02:00
9e1d9871a8
Move OC_User_Database to \OC\User\Database
2016-05-10 19:53:36 +02:00
9504500e5f
Move \OC\User to PSR-4
2016-05-10 19:53:36 +02:00
Christoph Wurst
Vincent Petry
Roeland Jago Douma