Skip to content

Commit 7685c21

Browse files
memuratsmemurats
committed
Merge #13 Central customization setup V31
2 parents 145d0cb + 9ebabab commit 7685c21

File tree

5 files changed

+149
-6
lines changed

5 files changed

+149
-6
lines changed

‎.github/README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# MagentaCLOUD user_oidc
2+
3+
Customisation of the Nextcloud delivered OpenID connect app for MagentaCLOUD.
4+
5+
The app extends the standard `user_oidc` Nextcloud app,
6+
see [upstream configuration hints for basic setup](https://github.com/nextcloud/user_oidc/blob/main/README.md)
7+
8+
9+
## Feature: Event-based provisioning (upstream contribution candidate)
10+
The mechanism allows to implement custom puser provisioning logic in a separate Nextcloud app by
11+
registering and handling a attribute change and provisioning event:
12+
13+
```
14+
use OCP\AppFramework\App;
15+
use OCP\AppFramework\Bootstrap\IBootContext;
16+
use OCP\AppFramework\Bootstrap\IBootstrap;
17+
use OCP\AppFramework\Bootstrap\IRegistrationContext;
18+
19+
class Application extends App implements IBootstrap {
20+
...
21+
public function register(IRegistrationContext $context): void {
22+
$context->registerEventListener(AttributeMappedEvent::class, MyUserAttributeListener::class);
23+
$context->registerEventListener(UserAccountChangeEvent::class, MyUserAccountChangeListener::class);
24+
}
25+
...
26+
}
27+
```
28+
The provisioning handler should return a `OCA\UserOIDC\Event\UserAccountChangeResult` object
29+
30+
## Feature: Telekom-specific bearer token
31+
32+
Due to historic reason, Telekom bearer tokens have a close to standard structure, but
33+
require special security implementation in detail. The customisation overrides te standard
34+
35+
36+
### Requiring web-token libraries
37+
The central configuration branch `nmc/2372-central-setup` automatic merge will frequently fail if composer
38+
upstream
39+
40+
The fast and easy way to bring it back to sync with upstream is:
41+
```
42+
git checkout nmc/2372-central-setup
43+
git rebase --onto main nmc/2372-central-setup
44+
# manually take over everything from upstream for composer.lock (TODO: automate that)
45+
46+
# ALWAYS update web-token dependencies in composer.lock
47+
# to avoid upstream conflicts. The lock file diff should only contain adds to upstream state!
48+
composer update "web-token/jwt-*"
49+
```
50+
51+
52+
### Configuring an additional Bearer preshared secret with provider
53+
TODO
54+
55+
### Testing Bearer secrets
56+
TODO

‎COPYING.DTAG‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Although this Nextcloud app code is free and available under the AGPL3 license, Deutsche Telekom
2+
(including T-Systems) fully reserves all rights to the Telekom brand. To prevent users from getting confused about
3+
the source of a digital product or experience, there are stringent restrictions on using the Telekom brand and design,
4+
even when built into code that we provide. For any customization other than explicitly for Telekom or T-Systems, you must
5+
replace the Deutsche Telekom and T-Systems brand elements contained in the provided sources.

‎appinfo/routes.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,12 @@
1717
['name' => 'login#singleLogoutService', 'url' => '/sls', 'verb' => 'GET'],
1818
['name' => 'login#backChannelLogout', 'url' => '/backchannel-logout/{providerIdentifier}', 'verb' => 'POST'],
1919

20-
['name' => 'api#createUser', 'url' => '/user', 'verb' => 'POST'],
21-
['name' => 'api#deleteUser', 'url' => '/user/{userId}', 'verb' => 'DELETE'],
20+
// compatibility with NMC V24 until reconfig on SAM
21+
['name' => 'login#telekomBackChannelLogout', 'url' => '/logout', 'verb' => 'POST'],
22+
23+
// this is a security problem combined with Telekom provisioning, so we have to disable the endpoint
24+
// ['name' => 'api#createUser', 'url' => '/user', 'verb' => 'POST'],
25+
// ['name' => 'api#deleteUser', 'url' => '/user/{userId}', 'verb' => 'DELETE'],
2226

2327
['name' => 'id4me#showLogin', 'url' => '/id4me', 'verb' => 'GET'],
2428
['name' => 'id4me#login', 'url' => '/id4me', 'verb' => 'POST'],

‎lib/AppInfo/Application.php‎

Lines changed: 81 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,11 @@
1414
use OCA\Files\Event\LoadAdditionalScriptsEvent;
1515
use OCA\UserOIDC\Db\ProviderMapper;
1616
use OCA\UserOIDC\Listener\TimezoneHandlingListener;
17+
use OCA\UserOIDC\MagentaBearer\MBackend;
1718
use OCA\UserOIDC\Service\ID4MeService;
19+
use OCA\UserOIDC\Service\ProvisioningEventService;
20+
use OCA\UserOIDC\Service\ProvisioningService;
1821
use OCA\UserOIDC\Service\SettingsService;
19-
use OCA\UserOIDC\User\Backend;
2022
use OCP\AppFramework\App;
2123
use OCP\AppFramework\Bootstrap\IBootContext;
2224
use OCP\AppFramework\Bootstrap\IBootstrap;
@@ -27,6 +29,11 @@
2729
use OCP\IUserManager;
2830
use OCP\IUserSession;
2931
use Throwable;
32+
use Psr\Container\ContainerInterface;
33+
34+
// this is needed only for the special, shortened client login flow
35+
use OCP\Security\ISecureRandom;
36+
use OCP\ISession;
3037

3138
class Application extends App implements IBootstrap {
3239
public const APP_ID = 'user_oidc';
@@ -40,14 +47,23 @@ public function __construct(array $urlParams = []) {
4047
}
4148

4249
public function register(IRegistrationContext $context): void {
50+
// Register the composer autoloader required for the added jwt-token libs
51+
include_once __DIR__ . '/../../vendor/autoload.php';
52+
53+
// override registration of provisioning srevice to use event-based solution
54+
$this->getContainer()->registerService(ProvisioningService::class, function (ContainerInterface $c): ProvisioningService {
55+
return $c->get(ProvisioningEventService::class);
56+
});
57+
4358
/** @var IUserManager $userManager */
4459
$userManager = $this->getContainer()->get(IUserManager::class);
4560

4661
/* Register our own user backend */
47-
$this->backend = $this->getContainer()->get(Backend::class);
62+
// $this->backend = $this->getContainer()->get(Backend::class);
63+
$this->backend = $this->getContainer()->get(MBackend::class);
4864
// this was done before but OC_User::useBackend calls OC::$server->getUserManager()->registerBackend anyway
4965
// so the backend was registered twice, leading to wrong user count (double)
50-
// $userManager->registerBackend($this->backend);
66+
$userManager->registerBackend($this->backend);
5167
// TODO check if it can be replaced by $userManager->registerBackend($this->backend); in our case
5268
OC_User::useBackend($this->backend);
5369

@@ -64,11 +80,72 @@ public function boot(IBootContext $context): void {
6480

6581
try {
6682
$context->injectFn(\Closure::fromCallable([$this, 'registerRedirect']));
67-
$context->injectFn(\Closure::fromCallable([$this, 'registerLogin']));
83+
$context->injectFn(\Closure::fromCallable([$this, 'registerLogin']));
84+
// this is the custom auto-redirect for MagentaCLOUD client access
85+
$context->injectFn(\Closure::fromCallable([$this, 'registerNmcClientFlow']));
6886
} catch (Throwable $e) {
6987
}
7088
}
7189

90+
/**
91+
* This is the automatic redirect exclusively for Nextcloud/Magentacloud clients completely skipping consent layer
92+
*/
93+
private function registerNmcClientFlow(IRequest $request,
94+
IURLGenerator $urlGenerator,
95+
ProviderMapper $providerMapper,
96+
ISession $session,
97+
ISecureRandom $random): void {
98+
$providers = $this->getCachedProviders($providerMapper);
99+
100+
// Handle immediate redirect on client first-time login
101+
$isClientLoginFlow = false;
102+
103+
try {
104+
$isClientLoginFlow = $request->getPathInfo() === '/login/flow';
105+
} catch (Exception $e) {
106+
// in case any errors happen when checking for the path do not apply redirect logic as it is only needed for the login
107+
}
108+
109+
if ($isClientLoginFlow) {
110+
// only redirect if Telekom provider registered
111+
$tproviders = array_values(array_filter($providers, function ($p) {
112+
return strtolower($p->getIdentifier()) === "telekom";
113+
}));
114+
115+
if (count($tproviders) == 0) {
116+
// always show normal login flow as error fallback
117+
return;
118+
}
119+
120+
$stateToken = $random->generate(64, ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS);
121+
$session->set('client.flow.state.token', $stateToken);
122+
123+
// call the service to get the params, but suppress the template
124+
// compute grant redirect Url to go directly to Telekom login
125+
$redirectUrl = $urlGenerator->linkToRoute('core.ClientFlowLogin.grantPage', [
126+
'stateToken' => $stateToken,
127+
// grantPage service operation is deriving oauth2 client name (again),
128+
// so we simply pass on clientIdentifier or empty string
129+
'clientIdentifier' => $request->getParam('clientIdentifier', ''),
130+
'direct' => $request->getParam('direct', '0')
131+
]);
132+
133+
if ($redirectUrl === null) {
134+
// always show normal login flow as error fallback
135+
return;
136+
}
137+
138+
// direct login, consent layer later
139+
$targetUrl = $urlGenerator->linkToRoute(self::APP_ID . '.login.login', [
140+
'providerId' => $tproviders[0]->getId(),
141+
'redirectUrl' => $redirectUrl
142+
]);
143+
144+
header('Location: ' . $targetUrl);
145+
exit();
146+
}
147+
}
148+
72149
private function registerRedirect(IRequest $request, IURLGenerator $urlGenerator, SettingsService $settings, ProviderMapper $providerMapper): void {
73150
$providers = $this->getCachedProviders($providerMapper);
74151
$redirectUrl = $request->getParam('redirect_url');

‎tests/bootstrap.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
require_once __DIR__ . '/../vendor/autoload.php';
1212

1313
\OC::$loader->addValidRoot(OC::$SERVERROOT . '/tests');
14+
\OC::$composerAutoloader->addPsr4('OCA\\UserOIDC\\BaseTest\\', dirname(__FILE__) . '/unit/MagentaCloud/', true);
1415
\OC_App::loadApp('user_oidc');
1516

1617
OC_Hook::clear();

0 commit comments

Comments
 (0)