Implement basic OIDC core server handling by tisoft · Pull Request #12567 · nextcloud/server

tisoft · 2018-11-21T11:30:15Z

Allow Nextcloud to be used as a OpenID Connect provider. OpenID Connect Clients can authenticate against it. Fixes a part of #8846.

Manually tested with the OpenID Connect Playground and the OpenID Connect Generic Wordpress plugin

This is a minimal implementation. It could be extended by the following:

Handling claim requests
Supporting nonce values for additional security
Providing a UserInfo Backend
Providing a well-known URL handler
and probably more...

This is my first contribution to nextcloud, so I would be very helpful if someone would point out the shortcomings of my code. I will add a test case, but wanted to have feedback first, if this has any chance on being accepted.

tisoft · 2018-11-22T09:47:20Z

@rullzer Would you be willing to review this, since you worked as the last person on these files?

rullzer · 2018-11-22T10:11:14Z

@tisoft yes I will :)

I must admit I have not read up a lot on OIDC. I would need to do that as well. I'll try to look into this and get back to you.

Allow Nextcloud to be used as a OpenID Connect server. CLients can authenticate against it. Signed-off-by: Markus Heberling <markus.heberling@hengsbeck.de>

tisoft · 2019-01-28T19:39:19Z

I have rebased to latest master. The test failures seem unrelated to me. Anything I can do to help the review process?

rullzer · 2019-01-31T15:26:02Z

@tisoft sorry for having this around for so long. Reading up on openid is still on my list but time 😉

Could you point me to the related RFC/component of openID I have to read up on to check this?

Also I'll do a pass over the code tomorrow to give some more feedback. Thnx again.

tisoft · 2019-01-31T15:42:38Z

I tried to implement the minimal required elements of the specification here: https://openid.net/specs/openid-connect-core-1_0.html

I have especially focused on the parts noted in the section 15.1. Mandatory to Implement Features for All OpenID Providers. In my opinion that section basically says, I must return an id_token, with some required fields and I must "support" some url parameters. Where "support" means, I can ignore them, as long as its usage does not lead to an error).

Section 15.2 defines more requirements, that I would love to implement but that isn't basic anymore. :) I wanted to start with the most minimalistic implementation, that is actually usable.

rullzer · 2019-02-12T20:06:11Z

+ 'auth_time' => $this->time->getTime(),
+
+ // optional, can be requested by claims, we don't support requesting claims as of now, so we just send them always
+ 'email' => $user->getEMailAddress(),


Is it a problem if those are empty?

As I understand it, they can be left empty.

rullzer · 2019-02-12T20:06:47Z

+ $base64UrlPayload = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($payload));
+
+ // Create Signature Hash
+ $signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $client->getSecret(), true);


So the signature is required it seems. But how can it every be validated?

The OpenID Connect client will do the same hash calculation on his side. Since the client knows the oauth client secret he can do that. That way the signature can be verified.

kesselb · 2019-02-15T15:06:18Z

I think it would be useful to add https://github.com/RobDWaller/ReallySimpleJWT as dependency so that we get automatic updates.

tisoft · 2019-02-15T15:11:31Z

I think it would be useful to add https://github.com/RobDWaller/ReallySimpleJWT as dependency so that we get automatic updates.

I was unsure on the process to get external dependencies in, so I tried to do this without :) But if using a library is preferred, I can change this.

Signed-off-by: Markus Heberling <markus.heberling@hengsbeck.de>

MorrisJobke · 2019-03-06T09:02:54Z

Hi @tisoft - sorry that we didn't had time to look into this for the Nextcloud 16 milestone. We were quite busy with other tasks. We still appreciate the work you put into this, but the freeze for Nextcloud 16 is active since last Friday and I will put this into the Nextcloud 17 bucket. I hope that is okay for you.

tisoft · 2019-03-06T15:12:31Z

@MorrisJobke No problem. Just ping me, when I need to change something. 😄

MrMcX · 2020-01-14T20:21:48Z

Is this still worked on? And is there anything someone not from the nextcloud team can do?

tisoft · 2020-01-15T20:01:38Z

I‘m still willing to bring this in. Would need a feedback from the Nextcloud team.

kesselb · 2020-01-15T21:46:27Z

cc @rullzer

Crow-Control · 2020-02-28T22:15:54Z

It's time someone from Nextcloud steps up to the plate and do SOMETHING with this.
Even if it's a "dont want it", thats more than just plainy ignoring this.

So @rullzer and @MorrisJobke is anyone interested in getting this merged/reviewed before... lets say... 2025? or shall we start working op Startrek-Connect instead for Nextcloud 654?

yrammos · 2020-04-28T20:56:25Z

Fervently hoping this gets triaged for NC20 @rullzer @MorrisJobke

rullzer · 2020-07-02T18:47:46Z

This is one of those things where as I said I'm not against it. But we'll really need proper intergration test of OAuth (and then of course of OIDC as well). Since else this becomes this untested complex beast.

If anybody is up to add those please do. That would help a lot. And then we can move this forward as well.

ChristophWurst · 2021-06-25T12:01:18Z

This is one of those things where as I said I'm not against it. But we'll really need proper intergration test of OAuth (and then of course of OIDC as well). Since else this becomes this untested complex beast.

if I'm not mistaken this is still not done. shall we close this for now?

LukasReschke · 2021-07-13T16:56:50Z

Closing for now as there has been no traction on this.

tisoft force-pushed the oidc branch from cfe9a89 to 92ecfc0Compare November 21, 2018 16:04

tisoft mentioned this pull request Nov 21, 2018
Nextcloud as an OIDC provider (core) #8846
Closed

rullzer self-requested a review November 22, 2018 10:11

MorrisJobke added the 3. to review Waiting for reviews label Nov 22, 2018

MorrisJobke added this to the Nextcloud 16 milestone Nov 22, 2018

tisoft force-pushed the oidc branch 2 times, most recently from 3f95ae5 to d3585f7Compare January 28, 2019 10:49

Implement basic OIDC core server handling
f9d3840
Allow Nextcloud to be used as a OpenID Connect server. CLients can authenticate against it. Signed-off-by: Markus Heberling <markus.heberling@hengsbeck.de>

tisoft force-pushed the oidc branch from d3585f7 to f9d3840Compare January 28, 2019 12:10

rullzer reviewed Feb 12, 2019
View reviewed changes

Merge remote-tracking branch 'upstream/master' into oidc
fd3983b

tisoft force-pushed the oidc branch from a15d6da to 9735df5Compare February 15, 2019 14:52

tisoft force-pushed the oidc branch from 9735df5 to 7989830Compare February 15, 2019 15:15

extract idToken generation into own function
21eef41
Signed-off-by: Markus Heberling <markus.heberling@hengsbeck.de>

tisoft force-pushed the oidc branch from 7989830 to 21eef41Compare February 15, 2019 15:23

MorrisJobke mentioned this pull request Mar 4, 2019
16.0.0 Alpha 1 #14501
Merged
45 tasks

MorrisJobke modified the milestones: Nextcloud 16, Nextcloud 17 Mar 6, 2019

MorrisJobke mentioned this pull request Jul 17, 2019
17.0.0 Beta 1 #16408
Merged
28 tasks

MorrisJobke modified the milestones: Nextcloud 17, Nextcloud 18 Jul 17, 2019

rullzer removed this from the Nextcloud 18 milestone Dec 9, 2019

MorrisJobke added 2. developing Work in progress and removed 3. to review Waiting for reviews labels Jul 7, 2020

LukasReschke closed this Jul 13, 2021

Uh oh!

Uh oh!

Conversation

tisoft commented Nov 21, 2018

Uh oh!

tisoft commented Nov 22, 2018

Uh oh!

rullzer commented Nov 22, 2018

Uh oh!

tisoft commented Jan 28, 2019

Uh oh!

rullzer commented Jan 31, 2019

Uh oh!

tisoft commented Jan 31, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rullzerFeb 12, 2019

Choose a reason for hiding this comment

Uh oh!

tisoftFeb 15, 2019

Choose a reason for hiding this comment

Uh oh!

rullzerFeb 12, 2019

Choose a reason for hiding this comment

Uh oh!

tisoftFeb 15, 2019

Choose a reason for hiding this comment

Uh oh!

kesselb commented Feb 15, 2019

Uh oh!

tisoft commented Feb 15, 2019

Uh oh!

MorrisJobke commented Mar 6, 2019

Uh oh!

tisoft commented Mar 6, 2019

Uh oh!

MrMcX commented Jan 14, 2020• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tisoft commented Jan 15, 2020

Uh oh!

kesselb commented Jan 15, 2020

Uh oh!

Crow-Control commented Feb 28, 2020

Uh oh!

yrammos commented Apr 28, 2020• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rullzer commented Jul 2, 2020

Uh oh!

ChristophWurst commented Jun 25, 2021

Uh oh!

LukasReschke commented Jul 13, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

MrMcX commented Jan 14, 2020•
edited
Loading

yrammos commented Apr 28, 2020•
edited
Loading