d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
8acb734854
add 2fa backup codes app
...
* add backup codes app unit tests
* add integration tests for the backup codes app
2016-09-05 08:51:13 +02:00
6af2efb679
prevent infinite redirect loops if the there is no 2fa provider to pass
...
This fixes infinite loops that are caused whenever a user is about to solve a 2FA
challenge, but the provider app is disabled at the same time. Since the session
value usually indicates that the challenge needs to be solved before we grant access
we have to remove that value instead in this special case.
2016-08-24 10:49:23 +02:00
e90f00791d
add invalidateOldTokens to IProvider interface
2016-08-02 12:08:13 +02:00
681ac9f19f
Check if an app provide two-factor-auth providers before we try to use them
2016-07-23 13:26:57 +02:00
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
3db5de95bd
Merge pull request #25172 from owncloud/token-login-validation
...
Token login validation
2016-06-22 13:58:56 +02:00
b805908dca
update session token password on user password change
2016-06-21 10:24:25 +02:00
88b9f5a357
Merge pull request #25162 from owncloud/password-login-forbidden-hint
...
Password login forbidden hint
2016-06-20 17:05:20 +02:00
b0f2878f6e
close cursor after loading a token
2016-06-17 16:13:28 +02:00
0c0a216f42
store last check timestamp in token instead of session
2016-06-17 15:42:28 +02:00
c4149c59c2
use token last_activity instead of session value
2016-06-17 15:42:28 +02:00
82b50d126c
add PasswordLoginForbiddenException
2016-06-17 11:02:07 +02:00
a40d64ff7f
load 2FA provider apps before querying classes
2016-06-16 10:12:16 +02:00
5daa9a5417
fail hard if 2fa provider can not be loaded ( #25061 )
2016-06-13 12:46:45 +02:00
8f7a4aaa4d
do not generate device token if 2FA is enable for user
2016-06-07 09:09:51 +02:00
c58d8159d7
Create session tokens for apache auth users
2016-05-31 17:07:49 +02:00
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
87fa86a69a
Merge pull request #24559 from owncloud/2fa
...
two factor auth
2016-05-23 20:50:03 +02:00
847bbc51b6
add OCC command to enable/disable 2FA for a user
2016-05-23 11:21:13 +02:00
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
74277c25be
add button to invalidate browser sessions/device tokens
2016-05-23 09:11:12 +02:00
6495534bcd
add button to add new device tokens
2016-05-23 09:11:12 +02:00
12431aa399
list user's auth tokens on the personal settings page
2016-05-23 09:11:12 +02:00
0626578739
add method to query all user auth tokens
2016-05-18 18:25:37 +02:00
98b465a8b9
a single token provider suffices
2016-05-18 09:20:48 +02:00
ed01305e29
don't spam the log file with failed token validation entries
2016-05-13 09:53:50 +02:00
69dafd727d
delete the token in case an exception is thrown when decrypting the password
2016-05-11 13:36:46 +02:00
af707fba41
use the query builder instead of raw sql statements
2016-05-11 13:36:46 +02:00
46bdf6ea2b
fix PHPDoc and other minor issues
2016-05-11 13:36:46 +02:00
f0f8bdd495
PHPDoc and other minor fixes
2016-05-11 13:36:46 +02:00
fdc2cd7554
Add token auth for OCS APIs
2016-05-11 13:36:46 +02:00
8d48502187
Add index on 'last_activity'
...
add token type column and delete only temporary tokens in the background job
debounce token updates; fix wrong class import
2016-05-11 13:36:46 +02:00
3ab922601a
Check if session token is valid and log user out if the check fails
...
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
2016-05-11 13:36:46 +02:00
2fa5e0a24e
invalidate (delete) session token on logout
...
add 'last_activity' column to session tokens and delete old ones via a background job
2016-05-11 13:36:46 +02:00
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
Christoph Wurst
Robin Appelman
Joas Schilling
Vincent Petry
Christoph Wurst
Christoph Wurst
Lukas Reschke