Skip to content

Commit f03a9cd

Browse files
memuratsmemurats
committed
Merge #3 Central customization setup
2 parents dfa9a85 + 6c861bc commit f03a9cd

File tree

5 files changed

+145
-8
lines changed

5 files changed

+145
-8
lines changed

‎.github/README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# MagentaCLOUD user_oidc
2+
3+
Customisation of the Nextcloud delivered OpenID connect app for MagentaCLOUD.
4+
5+
The app extends the standard `user_oidc` Nextcloud app,
6+
see [upstream configuration hints for basic setup](https://github.com/nextcloud/user_oidc/blob/main/README.md)
7+
8+
9+
## Feature: Event-based provisioning (upstream contribution candidate)
10+
The mechanism allows to implement custom puser provisioning logic in a separate Nextcloud app by
11+
registering and handling a attribute change and provisioning event:
12+
13+
```
14+
use OCP\AppFramework\App;
15+
use OCP\AppFramework\Bootstrap\IBootContext;
16+
use OCP\AppFramework\Bootstrap\IBootstrap;
17+
use OCP\AppFramework\Bootstrap\IRegistrationContext;
18+
19+
class Application extends App implements IBootstrap {
20+
...
21+
public function register(IRegistrationContext $context): void {
22+
$context->registerEventListener(AttributeMappedEvent::class, MyUserAttributeListener::class);
23+
$context->registerEventListener(UserAccountChangeEvent::class, MyUserAccountChangeListener::class);
24+
}
25+
...
26+
}
27+
```
28+
The provisioning handler should return a `OCA\UserOIDC\Event\UserAccountChangeResult` object
29+
30+
## Feature: Telekom-specific bearer token
31+
32+
Due to historic reason, Telekom bearer tokens have a close to standard structure, but
33+
require special security implementation in detail. The customisation overrides te standard
34+
35+
36+
### Requiring web-token libraries
37+
The central configuration branch `nmc/2372-central-setup` automatic merge will frequently fail if composer
38+
upstream
39+
40+
The fast and easy way to bring it back to sync with upstream is:
41+
```
42+
git checkout nmc/2372-central-setup
43+
git rebase --onto main nmc/2372-central-setup
44+
# manually take over everything from upstream for composer.lock (TODO: automate that)
45+
46+
# ALWAYS update web-token dependencies in composer.lock
47+
# to avoid upstream conflicts. The lock file diff should only contain adds to upstream state!
48+
composer update "web-token/jwt-*"
49+
```
50+
51+
52+
### Configuring an additional Bearer preshared secret with provider
53+
TODO
54+
55+
### Testing Bearer secrets
56+
TODO

‎COPYING.DTAG‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Although this Nextcloud app code is free and available under the AGPL3 license, Deutsche Telekom
2+
(including T-Systems) fully reserves all rights to the Telekom brand. To prevent users from getting confused about
3+
the source of a digital product or experience, there are stringent restrictions on using the Telekom brand and design,
4+
even when built into code that we provide. For any customization other than explicitly for Telekom or T-Systems, you must
5+
replace the Deutsche Telekom and T-Systems brand elements contained in the provided sources.

‎appinfo/routes.php‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,12 @@
1616
['name' => 'login#code', 'url' => '/code', 'verb' => 'GET'],
1717
['name' => 'login#singleLogoutService', 'url' => '/sls', 'verb' => 'GET'],
1818
['name' => 'login#backChannelLogout', 'url' => '/backchannel-logout/{providerIdentifier}', 'verb' => 'POST'],
19+
// compatibility with NMC V24 until reconfig on SAM
20+
['name' => 'login#telekomBackChannelLogout', 'url' => '/logout', 'verb' => 'POST'],
1921

20-
['name' => 'api#createUser', 'url' => '/user', 'verb' => 'POST'],
21-
['name' => 'api#deleteUser', 'url' => '/user/{userId}', 'verb' => 'DELETE'],
22+
// this is a security problem combined with Telekom provisioning, so we habe to disable the endpoint
23+
// ['name' => 'api#createUser', 'url' => '/user', 'verb' => 'POST'],
24+
// ['name' => 'api#deleteUser', 'url' => '/user/{userId}', 'verb' => 'DELETE'],
2225

2326
['name' => 'id4me#showLogin', 'url' => '/id4me', 'verb' => 'GET'],
2427
['name' => 'id4me#login', 'url' => '/id4me', 'verb' => 'POST'],

‎lib/AppInfo/Application.php‎

Lines changed: 78 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
use OCA\UserOIDC\Listener\TimezoneHandlingListener;
1717
use OCA\UserOIDC\Service\ID4MeService;
1818
use OCA\UserOIDC\Service\SettingsService;
19-
use OCA\UserOIDC\User\Backend;
19+
use OCA\UserOIDC\Service\ProvisioningService;
20+
use OCA\UserOIDC\Service\ProvisioningEventService;
21+
use OCA\UserOIDC\MagentaBearer\MBackend;
2022
use OCP\AppFramework\App;
2123
use OCP\AppFramework\Bootstrap\IBootContext;
2224
use OCP\AppFramework\Bootstrap\IBootstrap;
@@ -27,6 +29,11 @@
2729
use OCP\IUserManager;
2830
use OCP\IUserSession;
2931
use Throwable;
32+
use Psr\Container\ContainerInterface;
33+
34+
// this is needed only for the special, shortened client login flow
35+
use OCP\Security\ISecureRandom;
36+
use OCP\ISession;
3037

3138
class Application extends App implements IBootstrap {
3239
public const APP_ID = 'user_oidc';
@@ -40,15 +47,20 @@ public function __construct(array $urlParams = []) {
4047
}
4148

4249
public function register(IRegistrationContext $context): void {
50+
// Register the composer autoloader required for the added jwt-token libs
51+
include_once __DIR__ . '/../../vendor/autoload.php';
52+
53+
// override registration of provisioning srevice to use event-based solution
54+
$this->getContainer()->registerService(ProvisioningService::class, function (ContainerInterface $c): ProvisioningService {
55+
return $c->get(ProvisioningEventService::class);
56+
});
57+
4358
/** @var IUserManager $userManager */
4459
$userManager = $this->getContainer()->get(IUserManager::class);
4560

4661
/* Register our own user backend */
47-
$this->backend = $this->getContainer()->get(Backend::class);
48-
// this was done before but OC_User::useBackend calls OC::$server->getUserManager()->registerBackend anyway
49-
// so the backend was registered twice, leading to wrong user count (double)
50-
// $userManager->registerBackend($this->backend);
51-
// TODO check if it can be replaced by $userManager->registerBackend($this->backend); in our case
62+
$this->backend = $this->getContainer()->get(MBackend::class);
63+
$userManager->registerBackend($this->backend);
5264
OC_User::useBackend($this->backend);
5365

5466
$context->registerEventListener(LoadAdditionalScriptsEvent::class, TimezoneHandlingListener::class);
@@ -65,10 +77,70 @@ public function boot(IBootContext $context): void {
6577
try {
6678
$context->injectFn(\Closure::fromCallable([$this, 'registerRedirect']));
6779
$context->injectFn(\Closure::fromCallable([$this, 'registerLogin']));
80+
// this is the custom auto-redirect for MagentaCLOUD client access
81+
$context->injectFn(\Closure::fromCallable([$this, 'registerNmcClientFlow']));
6882
} catch (Throwable $e) {
6983
}
7084
}
7185

86+
/**
87+
* This is the automatic redirect exclusively for Nextcloud/Magentacloud clients
88+
* completely skipping consent layer
89+
*/
90+
private function registerNmcClientFlow(IRequest $request,
91+
IURLGenerator $urlGenerator,
92+
ProviderMapper $providerMapper,
93+
ISession $session,
94+
ISecureRandom $random): void {
95+
$providers = $this->getCachedProviders($providerMapper);
96+
97+
// Handle immediate redirect on client first-time login
98+
$isClientLoginFlow = false;
99+
try {
100+
$isClientLoginFlow = $request->getPathInfo() === '/login/flow';
101+
} catch (Exception $e) {
102+
// in case any errors happen when checking for the path do not apply redirect logic as it is only needed for the login
103+
}
104+
if ($isClientLoginFlow) {
105+
// only redirect if Telekom provider registered
106+
$tproviders = array_values(array_filter($providers, function ($p) {
107+
return strtolower($p->getIdentifier()) === "telekom";
108+
}));
109+
if (count($tproviders) == 0) {
110+
// always show normal login flow as error fallback
111+
return;
112+
}
113+
114+
$stateToken = $random->generate(
115+
64,
116+
ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS
117+
);
118+
$session->set('client.flow.state.token', $stateToken);
119+
120+
// call the service to get the params, but suppress the template
121+
// compute grant redirect Url to go directly to Telekom login
122+
$redirectUrl = $urlGenerator->linkToRoute('core.ClientFlowLogin.grantPage', [
123+
'stateToken' => $stateToken,
124+
// grantPage service operation is deriving oauth2 client name (again),
125+
// so we simply pass on clientIdentifier or empty string
126+
'clientIdentifier' => $request->getParam('clientIdentifier', ''),
127+
'direct' => $request->getParam('direct', '0')
128+
]);
129+
if ($redirectUrl === null) {
130+
// always show normal login flow as error fallback
131+
return;
132+
}
133+
134+
// direct login, consent layer later
135+
$targetUrl = $urlGenerator->linkToRoute(self::APP_ID . '.login.login', [
136+
'providerId' => $tproviders[0]->getId(),
137+
'redirectUrl' => $redirectUrl
138+
]);
139+
header('Location: ' . $targetUrl);
140+
exit();
141+
}
142+
}
143+
72144
private function registerRedirect(IRequest $request, IURLGenerator $urlGenerator, SettingsService $settings, ProviderMapper $providerMapper): void {
73145
$providers = $this->getCachedProviders($providerMapper);
74146
$redirectUrl = $request->getParam('redirect_url');

‎tests/bootstrap.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
require_once __DIR__ . '/../vendor/autoload.php';
1212

1313
\OC::$loader->addValidRoot(OC::$SERVERROOT . '/tests');
14+
\OC::$composerAutoloader->addPsr4('OCA\\UserOIDC\\BaseTest\\', dirname(__FILE__) . '/unit/MagentaCloud/', true);
1415
\OC_App::loadApp('user_oidc');
1516

1617
OC_Hook::clear();

0 commit comments

Comments
 (0)