mirrors/nextcloud-desktop
1
0
Fork 0
mirror of https://github.com/nextcloud/desktop.git synced 2024-12-20 21:02:02 +03:00
Code Issues Projects Releases Packages Wiki Activity
nextcloud-desktop/src/gui/creds/oauth.cpp

186 lines
9.6 KiB
C++
Raw Normal View History

Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
/*
* Copyright (C) by Olivier Goffart <ogoffart@woboq.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <QDesktopServices>
#include <QNetworkReply>
#include <QTimer>
OAuth: Don't use implicit POST bodies The query args of POST requests become the request body. If there's a redirect, the redirected url will therefore not contain the query arguments. Use an explicit request body to make the redirection work.
2017-09-11 13:24:29 +03:00
#include <QBuffer>
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
#include "account.h"
#include "creds/oauth.h"
#include <QJsonObject>
#include <QJsonDocument>
#include "theme.h"
OAuth: Use redirectable jobs for oauth token management
2017-09-08 17:43:59 +03:00
#include "networkjobs.h"
Wizard + OAuth: Make opening a new browser after clicking back works again Issue #6574 When there is an error in the advanced page, OwncloudAdvancedSetupPage::updateStatus (and others) call completeChanged(), which is connected to QWizardPrivate::_q_updateButtonStates which will re-enable the back button from the last page. When the user click "back" and re-open the browser, the account's credentials already have a oauth token set. So the call to the API to get a new token fails because we use the previous token instead of using the client's secret_id. Fix this with the HttpCredentials::DontAddCredentialsAttribute. Now, this is still not working because the session cookies are confusing the server. So we'll clear the cookies when re-opening the browser
2018-06-18 13:43:21 +03:00
#include "creds/httpcredentials.h"
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
namespace OCC {
Prepend "nextcloud" for all logging categories Thus making easier to exclude logging from kio, qt and only enable "nextcloud.*"
2017-12-28 22:33:10 +03:00
Q_LOGGING_CATEGORY(lcOauth, "nextcloud.sync.credentials.oauth", QtInfoMsg)
OAuth: cleanup debug messages - Add category to the all messages (they did not have it was merged right after the patch to add category everywhere, but this code did not have it.) - Make sure there is no warnings in the normal flow. (The wizard does a request without authentication to determine the auth type)
2017-06-13 11:24:26 +03:00
Use = default for trivial ctors and dtors Signed-off-by: Kevin Ottens <kevin.ottens@nextcloud.com>
2020-05-25 22:33:24 +03:00
OAuth::~OAuth() = default;
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
static void httpReplyAndClose(QTcpSocket *socket, const char *code, const char *html,
const char *moreHeaders = nullptr)
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
{
OAuth: Fix crash when closing the browser while identifying To reproduce, log in and click "authorize" on the browser, then close the browser before the client has replied, (but after redirected to localhost, i.e. when the client is asking the server for the token) The problem is that socket can be destroyed so we don't need to answer on a destroyed socket.
2017-09-25 17:44:33 +03:00
if (!socket)
return; // socket can have been deleted if the browser was closed
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
socket->write("HTTP/1.1 ");
socket->write(code);
socket->write("\r\nContent-Type: text/html\r\nConnection: close\r\nContent-Length: ");
socket->write(QByteArray::number(qstrlen(html)));
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
if (moreHeaders) {
socket->write("\r\n");
socket->write(moreHeaders);
}
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
socket->write("\r\n\r\n");
socket->write(html);
socket->disconnectFromHost();
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
// We don't want that deleting the server too early prevent queued data to be sent on this socket.
// The socket will be deleted after disconnection because disconnected is connected to deleteLater
socket->setParent(nullptr);
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
}
void OAuth::start()
{
// Listen on the socket to get a port which will be used in the redirect_uri
if (!_server.listen(QHostAddress::LocalHost)) {
emit result(NotSupported, QString());
return;
}
if (!openBrowser())
return;
QObject::connect(&_server, &QTcpServer::newConnection, this, [this] {
OAuth: Fix crash when closing the browser while identifying To reproduce, log in and click "authorize" on the browser, then close the browser before the client has replied, (but after redirected to localhost, i.e. when the client is asking the server for the token) The problem is that socket can be destroyed so we don't need to answer on a destroyed socket.
2017-09-25 17:44:33 +03:00
while (QPointer<QTcpSocket> socket = _server.nextPendingConnection()) {
OAuth: fix compilation with old gcc We need to used QPointer::data in the signal slot connection Relates to pr #6065
2017-09-28 11:54:27 +03:00
QObject::connect(socket.data(), &QTcpSocket::disconnected, socket.data(), &QTcpSocket::deleteLater);
QObject::connect(socket.data(), &QIODevice::readyRead, this, [this, socket] {
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
QByteArray peek = socket->peek(qMin(socket->bytesAvailable(), 4000LL)); //The code should always be within the first 4K
if (peek.indexOf('\n') < 0)
return; // wait until we find a \n
QRegExp rx("^GET /\\?code=([a-zA-Z0-9]+)[& ]"); // Match a /?code=... URL
if (rx.indexIn(peek) != 0) {
httpReplyAndClose(socket, "404 Not Found", "<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center></body></html>");
return;
}
QString code = rx.cap(1); // The 'code' is the first capture of the regexp
OAuth2: Fix double slash in URL We need to use concatPath to avoid possible double '/' in the URLs if the account url() ends with '/'. This has become even more of a problem since commit d1b8370a4ad21c741da507f64a5dbfe82a3fad05 which was resolving the url after a redirect where most server actually add a '/' if the url is a folder
2017-09-22 19:05:47 +03:00
QUrl requestToken = Utility::concatUrlPath(_account->url().toString(), QLatin1String("/index.php/apps/oauth2/api/v1/token"));
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
QNetworkRequest req;
req.setHeader(QNetworkRequest::ContentTypeHeader, "application/x-www-form-urlencoded");
OAuth: Don't use implicit POST bodies The query args of POST requests become the request body. If there's a redirect, the redirected url will therefore not contain the query arguments. Use an explicit request body to make the redirection work.
2017-09-11 13:24:29 +03:00
OAuth: Pass client auth in header instead of url To play more nicely with redirects.
2017-09-11 13:23:52 +03:00
QString basicAuth = QString("%1:%2").arg(
Theme::instance()->oauthClientId(), Theme::instance()->oauthClientSecret());
req.setRawHeader("Authorization", "Basic " + basicAuth.toUtf8().toBase64());
Wizard + OAuth: Make opening a new browser after clicking back works again Issue #6574 When there is an error in the advanced page, OwncloudAdvancedSetupPage::updateStatus (and others) call completeChanged(), which is connected to QWizardPrivate::_q_updateButtonStates which will re-enable the back button from the last page. When the user click "back" and re-open the browser, the account's credentials already have a oauth token set. So the call to the API to get a new token fails because we use the previous token instead of using the client's secret_id. Fix this with the HttpCredentials::DontAddCredentialsAttribute. Now, this is still not working because the session cookies are confusing the server. So we'll clear the cookies when re-opening the browser
2018-06-18 13:43:21 +03:00
// We just added the Authorization header, don't let HttpCredentialsAccessManager tamper with it
req.setAttribute(HttpCredentials::DontAddCredentialsAttribute, true);
OAuth: Don't use implicit POST bodies The query args of POST requests become the request body. If there's a redirect, the redirected url will therefore not contain the query arguments. Use an explicit request body to make the redirection work.
2017-09-11 13:24:29 +03:00
auto requestBody = new QBuffer;
QUrlQuery arguments(QString(
"grant_type=authorization_code&code=%1&redirect_uri=http://localhost:%2")
.arg(code, QString::number(_server.serverPort())));
requestBody->setData(arguments.query(QUrl::FullyEncoded).toLatin1());
auto job = _account->sendRequest("POST", requestToken, req, requestBody);
Reduce timeout for some admin jobs The oauth token jobs and the wizard redirect check job shouldn't have 5min timeouts.
2017-09-15 10:11:52 +03:00
job->setTimeout(qMin(30 * 1000ll, job->timeoutMsec()));
OAuth: Use redirectable jobs for oauth token management
2017-09-08 17:43:59 +03:00
QObject::connect(job, &SimpleNetworkJob::finishedSignal, this, [this, socket](QNetworkReply *reply) {
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
auto jsonData = reply->readAll();
QJsonParseError jsonParseError;
QJsonObject json = QJsonDocument::fromJson(jsonData, &jsonParseError).object();
QString accessToken = json["access_token"].toString();
QString refreshToken = json["refresh_token"].toString();
QString user = json["user_id"].toString();
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
QUrl messageUrl = json["message_url"].toString();
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
if (reply->error() != QNetworkReply::NoError || jsonParseError.error != QJsonParseError::NoError
OAuth2: Better error logging This does not fix a bug, just was found while spotting a bug that was no bug. For https://github.com/owncloud/enterprise/issues/2951
2019-05-14 15:00:14 +03:00
|| jsonData.isEmpty() || json.isEmpty() || refreshToken.isEmpty() || accessToken.isEmpty()
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
|| json["token_type"].toString() != QLatin1String("Bearer")) {
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
QString errorReason;
QString errorFromJson = json["error"].toString();
if (!errorFromJson.isEmpty()) {
errorReason = tr("Error returned from the server: <em>%1</em>")
.arg(errorFromJson.toHtmlEscaped());
} else if (reply->error() != QNetworkReply::NoError) {
errorReason = tr("There was an error accessing the 'token' endpoint: <br><em>%1</em>")
.arg(reply->errorString().toHtmlEscaped());
OAuth2: Better error logging This does not fix a bug, just was found while spotting a bug that was no bug. For https://github.com/owncloud/enterprise/issues/2951
2019-05-14 15:00:14 +03:00
} else if (jsonData.isEmpty()) {
// Can happen if a funky load balancer strips away POST data, e.g. BigIP APM my.policy
errorReason = tr("Empty JSON from OAuth2 redirect");
// We explicitly have this as error case since the json qcWarning output below is misleading,
// it will show a fake json will null values that actually never was received like this as
// soon as you access json["whatever"] the debug output json will claim to have "whatever":null
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
} else if (jsonParseError.error != QJsonParseError::NoError) {
errorReason = tr("Could not parse the JSON returned from the server: <br><em>%1</em>")
.arg(jsonParseError.errorString());
} else {
errorReason = tr("The reply from the server did not contain all expected fields");
}
qCWarning(lcOauth) << "Error when getting the accessToken" << json << errorReason;
httpReplyAndClose(socket, "500 Internal Server Error",
tr("<h1>Login Error</h1><p>%1</p>").arg(errorReason).toUtf8().constData());
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
emit result(Error);
return;
}
OAuth: Better message when loggin in with the wrong username Since the user is already in the browser, put the error message in the browser with a message to log out and then log in as the right user. Issue #5895
2017-07-13 16:58:07 +03:00
if (!_expectedUser.isNull() && user != _expectedUser) {
// Connected with the wrong user
QString message = tr("<h1>Wrong user</h1>"
"<p>You logged-in with user <em>%1</em>, but must login with user <em>%2</em>.<br>"
"Please log out of %3 in another tab, then <a href='%4'>click here</a> "
"and log in as user %2</p>")
.arg(user, _expectedUser, Theme::instance()->appNameGUI(),
authorisationLink().toString(QUrl::FullyEncoded));
httpReplyAndClose(socket, "200 OK", message.toUtf8().constData());
// We are still listening on the socket so we will get the new connection
return;
}
OAuth: Redirects to the server in case of sucessfull login Requires https://github.com/owncloud/oauth2/pull/45 This commit moves the reply after we got the token reply from the server, that allows to reply with an error to the browser if the login does not work.
2017-07-03 15:51:20 +03:00
const char *loginSuccessfullHtml = "<h1>Login Successful</h1><p>You can close this window.</p>";
if (messageUrl.isValid()) {
httpReplyAndClose(socket, "303 See Other", loginSuccessfullHtml,
QByteArray("Location: " + messageUrl.toEncoded()).constData());
} else {
httpReplyAndClose(socket, "200 OK", loginSuccessfullHtml);
}
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
emit result(LoggedIn, user, accessToken, refreshToken);
});
});
}
});
}
OAuth2: Have a link to the browser in the owncloud UI When the browser is open, ad a link in the ui to re-open the browser. Issue #5893
2017-07-13 12:27:02 +03:00
QUrl OAuth::authorisationLink() const
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
{
Q_ASSERT(_server.isListening());
Utility: use QUrlQuery For QUrl::setQuery is deprecated in Qt5
2017-12-08 12:10:28 +03:00
QUrlQuery query;
query.setQueryItems({ { QLatin1String("response_type"), QLatin1String("code") },
{ QLatin1String("client_id"), Theme::instance()->oauthClientId() },
{ QLatin1String("redirect_uri"), QLatin1String("http://localhost:") + QString::number(_server.serverPort()) } });
OAuth: Add the user in the authorize call Issues: #5897, https://github.com/owncloud/oauth2/issues/48
2017-07-14 16:56:32 +03:00
if (!_expectedUser.isNull())
Utility: use QUrlQuery For QUrl::setQuery is deprecated in Qt5
2017-12-08 12:10:28 +03:00
query.addQueryItem("user", _expectedUser);
QUrl url = Utility::concatUrlPath(_account->url(), QLatin1String("/index.php/apps/oauth2/authorize"), query);
OAuth: Add the user in the authorize call Issues: #5897, https://github.com/owncloud/oauth2/issues/48
2017-07-14 16:56:32 +03:00
return url;
OAuth2: Have a link to the browser in the owncloud UI When the browser is open, ad a link in the ui to re-open the browser. Issue #5893
2017-07-13 12:27:02 +03:00
}
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
OAuth2: Have a link to the browser in the owncloud UI When the browser is open, ad a link in the ui to re-open the browser. Issue #5893
2017-07-13 12:27:02 +03:00
bool OAuth::openBrowser()
{
if (!QDesktopServices::openUrl(authorisationLink())) {
Authentication with OAuth2 When the OAuth2 app (https://github.com/owncloud/oauth2) is enabled, We will open a browser and perform the OAuth2 authentication Issue: #4798 and https://github.com/owncloud/platform/issues/17
2017-03-28 11:31:38 +03:00
// We cannot open the browser, then we claim we don't support OAuth.
emit result(NotSupported, QString());
return false;
}
return true;
}
} // namespace OCC
Reference in a new issue Copy permalink