fix(auth): Fix logging in with email and app password

[ChristophWurst]

• Resolves: [Bug]: DAV login with email address: Call to a member function getUID() on null #42961

Summary

Logging in with email and app password is only allowed if the token was created in a web session authenticated with the email. That's because Nextcloud enforces the login name to match when logging in with an app password.

\OCA\DAV\Connector\Sabre\Auth::validateUserPass calls \OC\User\Session::logClientIn, which tries to log in with \OC\User\Session::login, which validates the token. Because of the login name mismatch login "fails". Yet \OC\User\Session::logClientIn continues the email login fallback. Since #42651 there is a shortcut to not do a second login. But the return value indicates a successful login that never happened.

Tested

• Log in with username and password -> works as expected
• Log in with username and app password generated with username login -> works as expected
• Log in with email and password -> works as expected
• Log in with email and app password generated with username login -> fails gracefully as expected
• Log in with email and app password generated with email login -> fails gracefully as expected

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[ChristophWurst]

Log in with email and app password generated with email login

Weirdly enough that is not possible anymore. If I log in using email+password on web, any generated app token receives my user's UID as login name, not the email address. This is another regression.

[ChristophWurst]

If I log in using email+password on web, any generated app token receives my user's UID as login name, not the email address. This is another regression.

That has even been the case since #15365. I guess sessions with email login names are not possible unless it's ldap.

[ChristophWurst]

/backport to stable28

[ChristophWurst]

/backport to stable27

[ChristophWurst]

/backport to stable26

[ChristophWurst]

/backport to stable25

[blizzz]

If I log in using email+password on web, any generated app token receives my user's UID as login name, not the email address. This is another regression.

That has even been the case since #15365. I guess sessions with email login names are not possible unless it's ldap.

IIRC we have a questionable design where mail login is attempted independent of the user backends. The LDAP backend passes on the provided login name, and by configuration it could be compared against a user id, email, both, or other attributes as well.

[nickvergessen]

LGTM and login using the email still works for me, but didn't test with app passwords.

[ChristophWurst]

mysql killed after 1h. rest passed.