Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable27] fix(Session): avoid password confirmation on SSO #45703

Merged
merged 3 commits into from
Jun 12, 2024

Conversation

backportbot[bot]
Copy link

@backportbot backportbot bot commented Jun 7, 2024

Backport of #43942 and #45809

Warning, This backport's changes differ from the original and might be incomplete ⚠️

Todo

  • Review and resolve any conflicts
  • Amend HEAD commit to remove the line stating to skip CI

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

@blizzz blizzz mentioned this pull request Jun 12, 2024
1 task
@blizzz blizzz marked this pull request as ready for review June 12, 2024 10:12
@blizzz blizzz added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Jun 12, 2024
@blizzz
Copy link
Member

blizzz commented Jun 12, 2024

Pushed small adjustments (first commit is fixed up):

  • one syntax fix after automatic merge resolution
  • some classes where not yet exposed in OCP
+use OC\Authentication\Exceptions\ExpiredTokenException;
+use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Exceptions\WipeTokenException;
-use OCP\Authentication\Exceptions\ExpiredTokenException;
-use OCP\Authentication\Exceptions\InvalidTokenException;
-use OCP\Authentication\Exceptions\WipeTokenException;

P.S.: and another similar change for the nodb unit tests

diff --git a/tests/lib/AppFramework/Middleware/Security/PasswordConfirmationMiddlewareTest.php b/tests/lib/AppFramework/Middleware/Security/PasswordConfirmationMiddlewareTest.php
index 280a10fe90a..dd233dfa079 100644
--- a/tests/lib/AppFramework/Middleware/Security/PasswordConfirmationMiddlewareTest.php
+++ b/tests/lib/AppFramework/Middleware/Security/PasswordConfirmationMiddlewareTest.php
@@ -28,7 +28,7 @@ use OC\AppFramework\Middleware\Security\PasswordConfirmationMiddleware;
-use OCP\Authentication\Token\IToken;
+use OC\Authentication\Token\IToken;

SSO backends like SAML and OIDC tried a trick to suppress password
confirmations as they are not possible by design. At least for SAML it was
not reliable when existing user backends where used as user repositories.

Now we are setting a special scope with the token, and also make sure that
the scope is taken over when tokens are regenerated.

Signed-off-by: Arthur Schiwon <[email protected]>
- "password-unconfirmable" is the effective name for 30, but a draft
  name was backported.

Signed-off-by: Arthur Schiwon <[email protected]>
@blizzz blizzz merged commit 21bc68f into stable27 Jun 12, 2024
38 checks passed
@blizzz blizzz deleted the backport/43942/stable27 branch June 12, 2024 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
4. to release Ready to be released and/or waiting for tests to finish bug feature: authentication
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants