-
-
Notifications
You must be signed in to change notification settings - Fork 4.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix passwordless app token generation #29187
Fix passwordless app token generation #29187
Conversation
This indeed seems to rather fix the symptoms than the causes. As I understand the problem is that the password is set to an empty string when no password is available for OIDC. The real solution is to set the password to |
For that it would be server/lib/private/legacy/OC_User.php Line 181 in 57a816a
|
Signed-off-by: Julien Veyssier <eneiluj@posteo.net>
c5fcea3
to
de5fea4
Compare
Signed-off-by: Julien Veyssier <eneiluj@posteo.net>
Very true 😁.
Same conclusion for me. Correctly setting the password to null in But the password can't be set to null in the |
Let's document this at #27846. PhpStorm doesn't find any other usages but the credentials update listener. The non-nullable password was a mistake when the event was created. Passwords have always been optional. |
I'm concerned with this fix. Do a quick search of the server source for That said, smarter minds than mine should probably chime in. |
Even with #29122, we still face the app token invalidation issue after 5 minutes.
An app token generated in AppPasswordController with an empty string as the password parameter has a non empty password. It can be observed there
server/lib/private/Authentication/Token/PublicKeyTokenProvider.php
Line 239 in da1b97d
when using the token like that for example:
curl -H "Authorization: Bearer APP_TOKEN_GENERATED_USING_OIDC_TOKEN_TO_AUTHENTICATE" "https://what.e.ver/ocs/v1.php/cloud/users/number6" -H "OCS-APIRequest: true"
I don't know if this is a proper way to fix this but setting a null password when generating an app token seems a safe way to make it passwordless and fixes the invalidation issue.