Enable creation of app specific password via the CLI tool (occ)

[baldurmen]

Nextcloud version:
13.0.5

Hi!

App specific passwords are a great feature, but it would be very nice to to be able to generate them from the CLI too (occ).

For large deployments using webDAV mounts via davfs2, one should really use app specific passwords. At the moment, the only way I have to generate them is to log in as the user as the the web interface.

[nextcloud-bot]

GitMate.io thinks possibly related issues are #2431 (App passwords vanish), #6075 (App Passwords not displayed ), #3228 (App passwords should be optional), #6717 (App password descriptions should be editable), and #6376 (App password restrictions for specific nextcloud apps).

[blizzz]

@baldurmen correct, but the app password is also used as private key phrase to encrypt the main password. Therefore, being logged in is a requirement for generating those. I don't think there is a way around, unless you provide those information on cli too…

[blizzz]

fyi @rullzer

[xatru42]

coming across this topic during investigation how we could provision automatically users for webdav access (in combination with SAML2/LDAP backend)

@blizzz that raises the question how this is done when you have SAML2 authentication enabled - there is no password transferred from IdP to nextcloud that can be used to "open" the private key.

Is there a current description how nextcloud 18 works, e.g. something similar to:

https://rullzer.com/2018/09/05/improved-apppasswords-in-nextcloud-14/

Hence, I assume it should be possible (now) to add apppassword's for users via ./occ when the user pw isn't a dependency (anymore).

Cheers,
Xat

[rullzer]

Yeah we could have that as an option in the SAML app I guess.

[xatru42]

@rullzer shall we file new issue for SAML app or track it here? Is there any description how app token differ when SAML/oauth etc is used (when plain password never is known) ?

Cheers,
Xat

[rullzer]

The issue is there is no public api for this. So it might break at any time.

Imo it would be better to have the login flow being used to obtain a proper token.

[szaimen]

This was added with #24317