Commit Graph

11 Commits

Author SHA1 Message Date
Robin McCorkell cc88c5f4b8 Implement more fine-grained external storage permissions model
VisibilityTrait -> PermissionsTrait

PermissionsTrait stores two sets of data, $permissions and
$allowedPermissions (analogous to $visibility and $allowedVisibility of
VisibilityTrait). Each set is a map of user type ('admin' or 'personal')
to permissions (mounting permission, create permission).

The result is that a backend can now be restricted for creation, while
still allowing it to be mounted. This is useful for deprecating backends
or auth mechanisms, preventing new storages being created, while still
allowing existing storages to be mounted.
2015-08-28 17:21:58 +01:00
Robin McCorkell 080fafe63a AjaxController uses RSA auth mechanism 2015-08-28 12:58:47 +01:00
Robin McCorkell 1084e3adc7 Migrate SFTP_Key external storage to new API
The SFTP backend now supports public key authentication alongside
password authentication.
2015-08-28 12:58:47 +01:00
Robin McCorkell 19bc5a452a Migrate Swift external storage to new API
The Rackspace/OpenStack differences have been split into separate auth
mechanisms, with correct legacy migration
2015-08-28 12:58:47 +01:00
Robin McCorkell 88a78237b0 Migrate Google external storage to new API 2015-08-25 00:22:10 +01:00
Robin McCorkell a50ef61876 Migrate Dropbox external storage to new API 2015-08-25 00:22:10 +01:00
Robin McCorkell ced04f9ad2 Migrate AmazonS3 external storage to new API 2015-08-25 00:22:10 +01:00
Robin McCorkell 3bb793b6a7 Implement password authentication mechanisms
Introduces the basic password authentication mechanism, along with a
mechanism based on ownCloud credentials stored in the user session.

Change to lib/private is an extension of PermissionsMask, as
isSharable() override was missing.

Session credentials auth mechanism now disables sharing on applied
storages, as credentials will not be available.
2015-08-19 14:20:09 +01:00
Robin McCorkell 97dbc79c16 Compatibility shims for OC_Mount_Config
The following functions have been removed:
 - addMountPoint()
 - removeMountPoint()
 - movePersonalMountPoint()

registerBackend() has been rewritten as a shim around BackendService,
allowing legacy code to interact with the new API seamlessly

addMountPoint() was already disconnected from all production code, so
this commit completes the job and removes the function itself, along
with disconnecting and removing related functions. Unit tests have
likewise been removed.

getAbsoluteMountPoints(), getSystemMountPoints() and
getPersonalMountPoints() have been rewritten to use the StoragesServices
2015-08-19 10:08:14 +01:00
Robin McCorkell 1eeca031f8 Split backend identifiers from the class name
Prior to this, the storage class name was stored in mount.json under the
"class" parameter, and the auth mechanism class name under the
"authMechanism" parameter. This decouples the class name from the
identifier used to retrieve the backend or auth mechanism.

Now, backends/auth mechanisms have a unique identifier, which is saved in
the "backend" or "authMechanism" parameter in mount.json respectively.
An identifier is considered unique for the object it references, but the
underlying class may change (e.g. files_external gets pulled into core
and namespaces are modified).
2015-08-19 10:05:11 +01:00
Robin McCorkell 272a46ebe1 Authentication mechanisms for external storage backends
A backend can now specify generic authentication schemes that it
supports, instead of specifying the parameters for its authentication
method directly. This allows multiple authentication mechanisms to be
implemented for a single scheme, providing altered functionality.

This commit introduces the backend framework for this feature, and so at
this point the UI will be broken as the frontend does not specify the
required information.

Terminology:
 - authentication scheme
    Parameter interface for the authentication method. A backend
    supporting the 'password' scheme accepts two parameters, 'user' and
    'password'.
 - authentication mechanism
    Specific mechanism implementing a scheme. Basic mechanisms may
    forward configuration options directly to the backend, more advanced
    ones may lookup parameters or retrieve them from the session

New dropdown selector for external storage configurations to select the
authentication mechanism to be used.

Authentication mechanisms can have visibilities, just like backends.
The API was extended too to make it easier to add/remove visibilities.
In addition, the concept of 'allowed visibility' has been introduced, so
a backend/auth mechanism can force a maximum visibility level (e.g.
Local storage type) that cannot be overridden by configuration in the
web UI.

An authentication mechanism is a fully instantiated implementation. This
allows an implementation to have dependencies injected into it, e.g. an
\OCP\IDB for database operations.

When a StorageConfig is being prepared for mounting, the authentication
mechanism implementation has manipulateStorage() called,
which inserts the relevant authentication method options into the
storage ready for mounting.
2015-08-19 10:05:11 +01:00