259c0ce11d
Add mandatory 2FA service/class
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-09-30 11:47:29 +02:00
ee73f6c416
Merge pull request #11240 from nextcloud/feature/noid/consider-openssl-settings-from-config.php
...
Consider openssl settings from config.php
2018-09-25 18:04:20 +02:00
7586b19e52
Only allow 2FA state changs if providers support the operation
...
Ref https://github.com/nextcloud/server/issues/11019 .
Add `twofactorauth:cleanup` command
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-09-25 09:54:20 +02:00
6bdcec67ab
Add openssl to mock
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2018-09-16 12:38:08 +02:00
5c70aa2a22
Remove unused import
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-10 09:30:17 +02:00
1124b87bc0
Fix 2FA being enforced if only backup codes provider is active
...
Fixes https://github.com/nextcloud/server/issues/10634 .
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-10 09:26:40 +02:00
8db66d5dfb
Fix double-inserts of the same provider state
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-09 13:56:04 +02:00
85bc5edb5e
Add integration/unit test for the double-insert of same values
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-09 13:43:00 +02:00
d8197f2b97
Rename providerset method to get primary providers
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 20:28:21 +02:00
c6e47e8a51
Fix login redirection if only one 2FA provider is active
...
Fixes https://github.com/nextcloud/server/issues/10500 .
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 15:25:59 +02:00
d248a0bd1e
Fix 2FA provider registry population on login
...
If the 2FA provider registry has not been populated yet, we have to make
sure all available providers are loaded and queried on login. Otherwise
previously active 2FA providers aren't detected as enabled.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 06:57:52 +02:00
fc149bab3c
Fix duplicate inserts in the 2fa provider registry DAO
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-07-31 06:43:44 +02:00
7be465febe
Make new classes strict and fix license header
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-06-25 07:38:52 +02:00
13d93f5b25
Make 2FA providers stateful
...
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.
The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-06-20 08:30:26 +02:00
df34571d1d
Use constant for token version
...
And don't set the version in the constructor. That would possible cause
to many updates.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-18 22:11:55 +02:00
9e7a95fe58
Add more tests
...
* Add a lot of tests
* Fixes related to those tests
* Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-18 22:11:55 +02:00
4bbc21cb21
SetPassword on PublicKeyTokens
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-18 22:11:55 +02:00
4c0d710479
Just pass uid to the Token stuff
...
We don't have user objects in the code everywhere
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-18 22:11:54 +02:00
1f17010e0b
Add first tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-18 22:11:54 +02:00
6b7cf46727
Certain tokens can expire
...
However due to the nature of what we store in the token (encrypted
passwords etc). We can't just delete the tokens because that would make
the oauth refresh useless.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-17 16:10:19 +02:00
aba255997a
Allow the rotation of tokens
...
This for example will allow rotating the apptoken for oauth
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-16 19:27:19 +02:00
466297829e
Fix tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-15 10:56:40 +02:00
372e06d742
Add all parameters to returnValueMap
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-01-31 14:15:12 +01:00
b9bbb894f8
Merge pull request #7916 from nextcloud/2fa_log
...
Add 2FA to logfile
2018-01-25 15:57:32 +01:00
c92eff919e
Fix tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-25 13:25:09 +01:00
bf2be08c9f
Fix risky tests without assertions
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-01-25 11:33:25 +01:00
9ac878b6cb
Adjust tests for added lastCheck time
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-11-27 09:25:03 +01:00
38bb6e1477
Fix duplicate session token after remembered login
...
On a remembered login session, we create a new session token
in the database with the values of the old one. As we actually
don't need the old session token anymore, we can delete it right
away.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-09-20 21:39:31 +02:00
9163cf9241
Fix AppPassword 2FA auth
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-09-12 22:28:43 +02:00
b96485b6bd
Fix login with basic auth
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-09-05 12:24:41 +02:00
84b7022118
Improve 2FA
...
* Store the auth state in the session so we don't have to query it every
time.
* Added some tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-29 20:27:36 +02:00
7976927628
Merge pull request #4894 from nextcloud/generic-security-activities
...
Change 2FA activities to more generic security activities
2017-05-19 00:50:44 +02:00
e43649e67e
Fix tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-18 22:10:57 +02:00
59e968977c
Add test for DefaultTokenMapper
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:09 +02:00
77827ebf11
Rename table back to lowercase
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:09 +02:00
1eb7f4956b
delete auth token when client gets deleted
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-05-18 20:49:07 +02:00
d2d9f74707
Fix warning with undefined method
...
Trying to configure method "getRemember" which cannot be configured
because it does not exist, has not been specified, is final, or is
static
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-20 12:37:59 +02:00
5695a4ec92
Don't do a recursive search
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-22 10:44:13 +01:00
e782f90d98
DefaultTokenProviderTest mocked/asserted the wrong method
...
It's 'getRemember' instead of 'getRememberMe', hence some warnings
were generated by phpunit.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-02-28 10:26:19 +01:00
21d3fe5883
do not hard-require the token provider
...
The provider might need DB access and therefore depenedency
resolution fails on the setup page where we cannot inject
the db implementation.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
6f74ecd94a
use login hook credentials as fallback
...
If no session token is available, we can use the credentials provided
by the login hook.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
a6dca9e7a0
add login credential store
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:09 +01:00
88b7d033df
fix 2fa activities tests
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-12-20 15:23:36 +01:00
2183a1f3e6
copy remember-me value when renewing a session token
...
On renew, a session token is duplicated. For some reason we did
not copy over the remember-me attribute value. Hence, the new token
was deleted too early in the background job and remember-me did
not work properly.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-27 14:19:57 +01:00
e633f2f8df
add test
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-11-16 15:24:33 +01:00
e5bc80b31d
Adds TokenProvider and Mapper tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-16 15:24:31 +01:00
91851c37be
add tests
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-11-16 15:24:30 +01:00
4c3d18a9fc
explicit types
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-11-16 15:24:29 +01:00
9d6e01ef40
Add missing tests and fix PHPDoc
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-02 13:39:17 +01:00
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
Christoph Wurst
Morris Jobke
Daniel Kesselberg
Roeland Jago Douma
Julius Härtl
Joas Schilling
Lukas Reschke
Bjoern Schiessle
Robin Appelman