Draft OAuth2 Documenation #3464

settermjd · 2017-10-18T13:59:49Z

Very much a WIP.

mmattel · 2017-11-16T14:53:10Z

Pls add possible changes soon, then I suggest to merge this and add/change content with additional PR´s. 10.0.4 is released soon ... IMHO better this than nothing

mmattel · 2017-11-17T12:24:42Z

admin_manual/configuration/server/security/oauth2.rst

+The OAuth2 App
+--------------
+
+OAuth2 support is available in ownCloud via `an OAuth2 application`_ which is available from the ownCloud Marketplace.


Does the App work as Authorisation Server in ownCloud (what I believe so reading the text)? If yes than it should be stated to make the role more clear. If not or if not only, than describe the role(s) to get a link to the picture above.

As I read that text, it is saying that via the OAuth2 application from the Marketplace, OAuth2 client support can be added to ownCloud.

Proposal:
OAuth2 support is available --> OAuth2 authorisation server support is available
This would make the role of the app clear.
Because an external client independent coming from owncloud itself or from any other source authorizes and connects to the server. When owncloud connects eg to dropbox via the dp-app, the dp-app is in the role of the client where db is in the role of the server.
Reduces confusion: aahhh Oauth2 app - let´s connect to sharepoint which is exactly not the possible because of the role of the app...

mmattel · 2017-11-17T12:27:59Z

admin_manual/configuration/server/security/oauth2.rst

+^^^^^^^^^^^^^^^^^^^^^^^
+
+After the resource owner's authorization, the app redirects to the `redirect_uri` specified in the authorization request and adds the authorization code as URL parameter `code`.
+An authorization code is valid for 10 minutes.


What happens after the 10min? Is there a user interaction necessary or are there processes running in the background automatically ? If yes which or what happens?

Isn't this rather something for a developer documentation? I think here we need to document what administrators need to know. Technical overview, benefits, configuration details, minimum client versions, etc..

I agree with you @pmaier1. @mmattel, without having looked over the code, I'd suggest that on the next request, the user would have to grant access again to gain a new authorization code.

Actually, @pmaier1, on reading the text again, it makes sense to keep the background information and configuration documentation together, rather than have the admin/user search for one or the other. I'd suggest to keep it as it is.

Proposal:
An authorization code is valid for 10 minutes. --> For security reasons, an authorization code is valid for 10 minutes. If the client tries to use the authorization code more than once, the authorization server denies the request.

mmattel · 2017-11-17T12:29:35Z

admin_manual/configuration/server/security/oauth2.rst

+^^^^^^^^^^^^^^^^^^^^^
+
+The app responses to a valid access token request with a JSON response like the following.
+An access token is valid for 1 hour and can be refreshed with a refresh token.


Above, the token is valid for 10min. Now the token is valid for 1h...
Additionally same question as above, what happens if it expires... Can be refreshed means what ?

I guess above is referring to the authorization code, with this being valid for 10 minutes. An authorization code can then be used for requesting an access token, with this being valid for max 1 hour. Or at least this is what I understood..

I'd suggest there's some confusion between authorization code and access token going on. Here's a good description of them.

Why not adding the link (good description) to ease understanding?

mmattel · 2017-11-17T12:29:58Z

admin_manual/configuration/server/security/oauth2.rst

+Installation
+------------
+
+To install the application, place the content of the OAuth2 app inside your installation's ``app`` directory.


Respectively use the Market App

As with other ownCloud apps we do not have to document the installation process as it's always the same. Either you install it manually as described or you use the market app. IMO we only need to explain installation when there are dependencies on other software like Collabora or full text search or stuff like that.

mmattel · 2017-11-17T12:31:01Z

admin_manual/configuration/server/security/oauth2.rst

+Limitations
+-----------
+
+Since the app handles no user passwords, only master key encryption works (similar to `the Shibboleth app`_).


What to do in case of any other encryption type ?

Where does this info come from? I use OAuth on an instance that uses credential-based storage encryption. Works like a charm.

Correction: The statement regarding credential-based storage encryption is correct. Sorry, my bad.

Add a link to owncloud/oauth2#105?

mmattel · 2017-11-29T15:18:15Z

@DeepDiver1975
you have filed a lot of PR´s in oAuth2.
Can you pls take a look on this and give some advice for corrections and/or additions?

pmaier1 · 2017-11-30T15:02:33Z

admin_manual/configuration/server/security/oauth2.rst

+To install the application, place the content of the OAuth2 app inside your installation's ``app`` directory.
+
+Basic Configuration
+-------------------


You basically don't have to configure anything in oC itself. Here we need information on configuring the basic infrastructure around it and how to cover special cases like SSO #3456 owncloud/oauth2#49

pmaier1 · 2017-11-30T15:04:07Z

admin_manual/configuration/server/security/oauth2.rst

+
+Restricting Usage
+-----------------
+


Here we need info about how to "lock-out" the original oC clients and e.g. only allow the usage of branded clients with special client id/secret.

Ref. owncloud/oauth2#72

I've added content around this point, taken from owncloud/oauth2#72.

pmaier1 · 2017-11-30T15:16:11Z

admin_manual/configuration/server/security/oauth2.rst

+
+Connecting Clients via OAuth2
+-----------------------------
+


Basic howto is explained in the blog post

Basic auth will still be possible for e.g. legacy WebDAV clients that don't support OAuth

SamuAlfageme · 2018-03-15T09:10:42Z

Requires references to owncloud/oauth2#110

SamuAlfageme

This owncloud/core#29300 is also worth a mention somewhere in the docs.

SamuAlfageme · 2018-03-15T09:15:37Z

admin_manual/configuration/server/security/oauth2.rst

+-----------------
+
+
+Limitations


One more limitation: owncloud/oauth2#109 (comment) -> clients are unable to migrate an account from Basic Auth. to OAuth2 if they come from the user_ldap backend.

SamuAlfageme · 2018-03-15T09:16:47Z

admin_manual/configuration/server/security/oauth2.rst

+
+Restricting Usage
+-----------------
+


Ref. owncloud/oauth2#72

This relates to owncloud/oauth2#110 and #3464.

Relates to #3464.

settermjd · 2018-03-15T13:20:10Z

@SamuAlfageme, as owncloud/core#29300 and owncloud/core#29324 are not yet implemented, can you create an issue to document it when that functionality is completed and merged, pls?

Edit:
issue: owncloud/core#29300 has been closed on 23 Oct 2017 in favor of 29324
issue: owncloud/core#29324 [FR] Add a switch to enable/disable token authentication enforcement

settermjd · 2018-03-15T13:22:01Z

@SamuAlfageme, reference to owncloud/oauth2#110 has been added.

SamuAlfageme · 2018-03-15T13:28:53Z

@settermjd

owncloud/core#29300 and owncloud/core#29324 are not yet implemented, can you create an issue to document it when that functionality is completed and merged, pls?

They're tho, see status and refer to owncloud/core#29300 (comment) for instructions on how to enable token-only based logins.

Relates to #3464.

mmattel · 2018-03-29T14:37:14Z

Enable token-only based logins: config.sample.php: 'token_auth_enforced' => false,

settermjd · 2018-05-09T10:00:50Z

@SamuAlfageme @mmattel are your final two comments all that's left to be implemented on this PR?

mmattel · 2018-05-09T10:27:55Z

If you add my 2 proposal texts I am fine.
Pls fix them if they do not look nice, but contentwise they should be in.

It is better to have that merged soon instead discussing / keeping this open endless.
Further improvements can always be added, just my opinion.

settermjd · 2018-05-17T07:59:28Z

@mmattel doing that today.

settermjd · 2018-05-17T08:34:01Z

@mmattel your changes have been integrated in the text.

settermjd · 2018-05-17T08:51:24Z

Is it correct to say: To enable token-only based logins in config/config.php set token_auth_enforced to true?

mmattel · 2018-05-18T09:48:46Z

From that whatI understood the key was implemented for - yes.
I would be be more precise:
To enable token-only based logins --> To enable token-only based app or client logins
as web login is not affected

Relates to #3464.

settermjd · 2018-05-22T11:42:32Z

@mmattel, line added. Thanks for the further suggestion.

mmattel · 2018-05-24T16:29:29Z

Let´s merge this, additions can be added later.

This relates to owncloud/oauth2#110 and #3464.

Relates to #3464.

settermjd · 2018-06-01T13:06:00Z

Backported to Antora build in 482a918.

Draft OAuth2 documenation

f806c64

Very much a WIP.

settermjd added the WIP label Oct 18, 2017

settermjd self-assigned this Oct 18, 2017

Rework the OAuth2 documentation

6729796

mmattel reviewed Nov 17, 2017

View reviewed changes

SamuAlfageme self-requested a review November 30, 2017 09:04

pmaier1 reviewed Nov 30, 2017

View reviewed changes

SamuAlfageme suggested changes Mar 15, 2018

View reviewed changes

settermjd added 3 commits March 15, 2018 14:15

Document the mod_headers is mandatory for OAuth2 support

d1e91ff

This relates to owncloud/oauth2#110 and #3464.

Document the mod_headers is mandatory for OAuth2 support

c2ae312

This relates to owncloud/oauth2#110 and #3464.

Document OAuth2 limitations and requirements

ac4d527

Relates to #3464.

settermjd added a commit that referenced this pull request Mar 19, 2018

Document OAuth2 limitations and requirements

7a1bf35

Relates to #3464.

settermjd added the Waiting On Review/Feedback label May 17, 2018

Document OAuth2 limitations and requirements

8a233a8

Relates to #3464.

settermjd force-pushed the document-oauth2 branch from cc031e1 to 8a233a8 Compare May 22, 2018 11:42

settermjd merged commit 12549e1 into master Jun 1, 2018

settermjd deleted the document-oauth2 branch June 1, 2018 11:53

settermjd added a commit that referenced this pull request Jun 1, 2018

Document the mod_headers is mandatory for OAuth2 support

25540cb

This relates to owncloud/oauth2#110 and #3464.

settermjd added a commit that referenced this pull request Jun 1, 2018

Document the mod_headers is mandatory for OAuth2 support

89d1863

This relates to owncloud/oauth2#110 and #3464.

settermjd added a commit that referenced this pull request Jun 1, 2018

Document OAuth2 limitations and requirements

f9fbb78

Relates to #3464.

settermjd added a commit that referenced this pull request Jun 1, 2018

Document OAuth2 limitations and requirements

fe0a521

Relates to #3464.

settermjd mentioned this pull request Jun 1, 2018

Backport document oauth2 #4178

Merged

mmattel mentioned this pull request Jun 1, 2018

Document in which cases only master key encryption will work (or is suggested) #4179

Closed

settermjd added a commit that referenced this pull request Jun 1, 2018

Backport #3464 to Antora build

482a918


		Restricting Usage
		-----------------

		-----------------


		Limitations


		Restricting Usage
		-----------------

Draft OAuth2 Documenation #3464

Draft OAuth2 Documenation #3464

Conversation

settermjd commented Oct 18, 2017 • edited by SamuAlfageme Loading

mmattel commented Nov 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

settermjd Mar 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mmattel commented Nov 29, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SamuAlfageme commented Mar 15, 2018

SamuAlfageme left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

settermjd commented Mar 15, 2018 • edited by mmattel Loading

settermjd commented Mar 15, 2018

SamuAlfageme commented Mar 15, 2018

mmattel commented Mar 29, 2018

settermjd commented May 9, 2018

mmattel commented May 9, 2018

settermjd commented May 17, 2018

settermjd commented May 17, 2018

settermjd commented May 17, 2018

mmattel commented May 18, 2018

settermjd commented May 22, 2018

mmattel commented May 24, 2018

settermjd commented Jun 1, 2018

settermjd commented Oct 18, 2017 •

edited by SamuAlfageme

Loading

settermjd Mar 15, 2018 •

edited

Loading

settermjd commented Mar 15, 2018 •

edited by mmattel

Loading