Oauth2 support #2013

davigonz · 2017-08-04T08:51:39Z

Fixes #1724
Requires owncloud/android-library#173

How Has This Been Tested?

QA repository test plan -> https://github.com/owncloud/QA/issues/ MOVED TO Authentication based in token (OAuth2) #1724

Bugs & Improvements

[UX] - Clicking back button on new login view relaunches the URL input form [WONTFIX] Follow up: App is reopened from login view after double tap on "Back" button #2009
~~Clicking on any https:// link on the auth. webview causes a SSL handshake error - Oauth2 support #2013 (comment)~~ [WONTFIX]
~~Switching the scheme on the server URL does not generate a second request - Oauth2 support #2013 (comment)~~
[BUG] OAuth2 accounts are missing the display_name on the account construct - Oauth2 support #2013 (comment) [READY_TO_TEST]
[BUG] SAML session is not being expired Oauth2 support #2013 (comment)
[IMPROVEMENT] Password field in OAuth webview is covered by the keyboard in tablets in landscape mode -- MOVED TO Authentication based in token (OAuth2) #1724
Oauth2 support #2013 (comment)
[BUG] Basic login is shown in OAuth webview when changing auth endpoint to an incorrect one -- MOVED TO Authentication based in token (OAuth2) #1724
Oauth2 support #2013 (comment)

davivel · 2017-08-07T12:39:49Z

Did code review and applied changes by myself.

👍

@pablocarmu , @SamuAlfageme , ready to test.

SamuAlfageme · 2017-08-10T13:10:19Z

[UX] - Clicking back button on new login view relaunches the URL input form:

Device: Nexus 6P (Android v7.1.2)
Related with: #2009

Steps to reproduce:

The initial 'connect' view	The basic auth form

SamuAlfageme · 2017-08-10T13:43:41Z

[WONTFIX] Clicking on any `https://` link on the auth. webview causes a SSL handshake error

Device: Nexus 6P (Android v7.1.2)

Note: this is tightly related to specific proxy settings on the device

Since the webview does not have any inherent settings but the default, performing an SSL handshake (trying to display an https:// external URL) will throw an error. Some possible explanations:

~~Date and Time being sent from the webview are incorrect.~~
The webview is using SSLv3 instead of TLS 1.2 for the HTTP requests. (most likely)

e.g. clicking on the clickable part of the default login form: "ownCloud, webservices under your control" displays:

owncloud.org:443 (sni: owncloud.org): TlsException("SSL handshake error: 
    Error([(\'SSL routines\', \'ssl3_read_bytes\', \'sslv3 alert handshake failure\')],)",)',

... on said webview.

SamuAlfageme · 2017-08-11T08:40:48Z

[WONTFIX] Switching the scheme on the server URL does not generate a second request

Note: this is tightly related to specific proxy settings on the device

Device: Samsung Galaxy Tab S2 (Android v5.0.2)

When no scheme is specified in the server URL (e.g. demo.owncloud.com) the client appends http:// to the request; if it turns out to be wrong and the server is only accessible via https://, a 'Bad Gateway error' is returned. The client is not able to recover by appending the right scheme in the URL (i.e. the client does not generate a second GET request)

Steps to Reproduce

Write demo.owncloud.com on the server URL input field - curl http://demo.owncloud.com
Click 'Connect' returns 302: Found
After the 'Bad Gateway' error is returned, insert the right scheme: https://demo.owncloud.com

Actual Result

No new GET request is generated and therefore 'Bad Request' error persists:

SamuAlfageme · 2017-08-11T13:13:30Z

[BUG] OAuth2 accounts are missing the `display_name` on the account construct

Device: Samsung Galaxy S7 edge (Android v7.0) / Samsung Galaxy Tab S2 (Android v5.0.2)

This screenshot compares a Basic Auth. account (the second one) to one set with OAuth:

I'm wondering if this can have collaterals later on (i.e. on token revoked, maybe the app will cross the new display_name with an empty string to determine if the user logged in the webview is the same that did before) - Haven't verified this scenario yet. (TC47)

davivel · 2017-08-14T08:27:20Z

Jumping in to fix bugs,

davivel · 2017-08-14T09:39:41Z

Missing display name recovered, ready to test.

Hunting next ...

davivel · 2017-08-14T12:50:40Z

Fixed problem with silent refresh of access token found accidentally. :(

davivel · 2017-08-14T12:54:07Z

Problem with https:// browsing in WebView is a false positive introduced by mitmproxy.

davigonz · 2017-08-18T06:34:49Z

[BUG] SAML session is not being expired

Steps

Login with SAML
Change SAML session lifetime in the server
Perform any operation such as upload a file or refresh the folder

Current behaviour

Operation is performed successfully

Expected behaviour

App is redirected to login view, showing an error about the SAML session expiration

Device: Huawei 6P v7.

davigonz · 2017-08-18T07:38:52Z

[IMPROVEMENT] [UI] Password field in OAuth webview is covered by the keyboard

Steps

Open the app in a tablet in landscape mode
Introduce server and press connect button
A webview asking for credentials appears
Press username field, the keyboard appears, introduce the data
There's no way to introduce the password easily because the field is covered by the keyboard

Current behaviour

Password field is covered by the keyboard.

Expected behaviour

Webview is resized properly, staying completely above the keyboard or showing a clear scrollbar.

Nexus 10 v5.0.2

davigonz · 2017-08-21T08:17:09Z

[BUG] Basic login is shown in OAuth webview when changing auth endpoint to an incorrect one

Steps

Go to setup.xml file and change oauth2_url_endpoint_auth to an incorrect one such as index.php/apps/oauth2/authoriinstead of index.php/apps/oauth2/authorize
Open the app, write the server and press the connect button.

Current behaviour

Step 1: Enter credentials	Step 2: Login successful

Expected behaviour

Show an error about the incorrect auth endpoint

Devices:

Samsung Galaxy Note 4 v6
Samsung Galaxy Tab S v6

…rver URL

…ileUploader, FileDownloader and SyncAdapter

…ing an OAuth2 account

…ed state is correctly shown

…on 1.0

…ess token when this expired

davivel · 2017-08-23T15:05:49Z

This PR will be merge for a new beta release.

Pending test cases and bugs will be tracked in original issue, #1724 .

davivel · 2017-08-24T06:39:44Z

Merging for beta.

davigonz force-pushed the oauth2_support branch from c4faf7b to 39e1f21 Compare August 4, 2017 08:52

SamuAlfageme assigned SamuAlfageme and pablocarmu Aug 7, 2017

SamuAlfageme added this to the 2.5.0 milestone Aug 7, 2017

davivel force-pushed the oauth2_support branch from 27af424 to acc25b9 Compare August 9, 2017 07:46

davivel self-assigned this Aug 14, 2017

davivel force-pushed the oauth2_support branch from c9f71ad to 39e13c1 Compare August 14, 2017 08:53

davigonz force-pushed the oauth2_support branch from ff5718d to ad6ecb1 Compare August 16, 2017 06:44

davivel force-pushed the oauth2_support branch 2 times, most recently from 96c2ec6 to 3ce20df Compare August 17, 2017 07:24

davigonz force-pushed the oauth2_support branch from 3ff1c51 to 027def5 Compare August 18, 2017 06:40

davigonz force-pushed the oauth2_support branch from 027def5 to 5208d9e Compare August 21, 2017 06:42

davigonz force-pushed the oauth2_support branch from 5208d9e to 532d1df Compare August 22, 2017 08:03

davivel and others added 5 commits August 23, 2017 08:38

Proof of concept pre-configured to work with OAuth2 app for OC server

2263ef7

Update lib ref

ac76025

Move oauth2_configuration.xml params to setup.xml

3135786

Move grant_type and response_type from setup.xml to code as variables

f79b898

Delete oauth2_scope param

24dfff0

davigonz and others added 21 commits August 23, 2017 08:38

Use refresh token grant type instead of authorization code

35fc70d

Use OAuth2RequestBuilder to refresh token

f546353

Execute oauth2GetRefreshedAccessToken operation in AccountAuthenticator

51de987

Trigger check of server when user types 'enter' after entering the se…

cabb2a3

…rver URL

Retry synchronous and asynchonorus remote operations in library

93af073

Refresh access token silently when expired, in background services: F…

42edf28

…ileUploader, FileDownloader and SyncAdapter

Show an error if the user enters credentials of other user when updat…

0de7df1

…ing an OAuth2 account

Refactor update account methods

d3d9d82

Fix style of buttons extending Widget...Button.Colored so that disabl…

2d6ebf2

…ed state is correctly shown

Delete useless button style

e1bde6e

Delete progress message about OAuth2 log-in when web dialog is cancelled

ecda2e2

Replace usage of deprecated methods in OC library, deleted with versi…

aa09081

…on 1.0

Update library reference

b6ec666

Clean-up after code review

52f66ac

Fix Clicking back button on new login view relaunches the URL input form

eb94f3e

Read userId correctly during account creation / update with OAuth2

bf0840a

Fix refresh of access token for folder refresh in UI

292feb1

Grant that any remote request can trigger a refresh of the OAuth2 acc…

6149e3e

…ess token when this expired

Changes in library to handle SAML credentials invalidation

82ddfbe

Fix in library to invalidate SAML sessions properlY

baab696

Delete unneeded oauth flag

121fdbd

davigonz force-pushed the oauth2_support branch from 04fe0e6 to 121fdbd Compare August 23, 2017 06:38

davigonz mentioned this pull request Aug 23, 2017

OAuth2: Bugs & improvements #2018

Closed

3 tasks

jesmrec mentioned this pull request Aug 23, 2017

Authentication based in token (OAuth2) #1724

Closed

31 tasks

Update library reference after fix for redirections and SAML log-out

8cd8654

davivel force-pushed the oauth2_support branch from 56fe54b to 8cd8654 Compare August 23, 2017 14:57

davivel merged commit 5b334c0 into master Aug 24, 2017

davivel deleted the oauth2_support branch August 24, 2017 06:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Oauth2 support #2013

Oauth2 support #2013

davigonz commented Aug 4, 2017 •

edited by davivel

Loading

davivel commented Aug 7, 2017

SamuAlfageme commented Aug 10, 2017 •

edited by davigonz

Loading

SamuAlfageme commented Aug 10, 2017 •

edited

Loading

SamuAlfageme commented Aug 11, 2017 •

edited

Loading

SamuAlfageme commented Aug 11, 2017 •

edited

Loading

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davigonz commented Aug 18, 2017 •

edited

Loading

davigonz commented Aug 18, 2017 •

edited

Loading

davigonz commented Aug 21, 2017 •

edited

Loading

davivel commented Aug 23, 2017

davivel commented Aug 24, 2017

Oauth2 support #2013

Oauth2 support #2013

Conversation

davigonz commented Aug 4, 2017 • edited by davivel Loading

How Has This Been Tested?

Bugs & Improvements

davivel commented Aug 7, 2017

SamuAlfageme commented Aug 10, 2017 • edited by davigonz Loading

[UX] - Clicking back button on new login view relaunches the URL input form:

Steps to reproduce:

SamuAlfageme commented Aug 10, 2017 • edited Loading

[WONTFIX] Clicking on any https:// link on the auth. webview causes a SSL handshake error

Note: this is tightly related to specific proxy settings on the device

SamuAlfageme commented Aug 11, 2017 • edited Loading

[WONTFIX] Switching the scheme on the server URL does not generate a second request

Note: this is tightly related to specific proxy settings on the device

Steps to Reproduce

Actual Result

SamuAlfageme commented Aug 11, 2017 • edited Loading

[BUG] OAuth2 accounts are missing the display_name on the account construct

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davivel commented Aug 14, 2017

davigonz commented Aug 18, 2017 • edited Loading

[BUG] SAML session is not being expired

davigonz commented Aug 18, 2017 • edited Loading

[IMPROVEMENT] [UI] Password field in OAuth webview is covered by the keyboard

davigonz commented Aug 21, 2017 • edited Loading

[BUG] Basic login is shown in OAuth webview when changing auth endpoint to an incorrect one

davivel commented Aug 23, 2017

davivel commented Aug 24, 2017

davigonz commented Aug 4, 2017 •

edited by davivel

Loading

SamuAlfageme commented Aug 10, 2017 •

edited by davigonz

Loading

SamuAlfageme commented Aug 10, 2017 •

edited

Loading

[WONTFIX] Clicking on any `https://` link on the auth. webview causes a SSL handshake error

SamuAlfageme commented Aug 11, 2017 •

edited

Loading

SamuAlfageme commented Aug 11, 2017 •

edited

Loading

[BUG] OAuth2 accounts are missing the `display_name` on the account construct

davigonz commented Aug 18, 2017 •

edited

Loading

davigonz commented Aug 18, 2017 •

edited

Loading

davigonz commented Aug 21, 2017 •

edited

Loading