-
Notifications
You must be signed in to change notification settings - Fork 667
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make "open owncloud in browser" log on automatically #633
Comments
PR 2 requires to merge the pull request #42, which adds support for what you are asking via libattica (using OCS specs). This does not require to hand over sessions. On the other hand, opening a browser does. |
This is waiting for owncloud/core#5453. |
Proposed process
Acceptance criteriaClient
Server
ConsiderationsWhile using a cryptographic generated token (e.g. HMAC) might be a solution that would not require requesting a nonce I see the drawback that once an attacker has the secret he is able to request tokens all the time even if you have changed the password. This is not desirable. Needed changes
If we can agree on this implementation I'll begin working on the required change in core. Then we can finally make this happen ;-) |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
@LukasReschke sounds good to me - final question: is this part of core or an isolated app. Building it as an app would already cover the requirement to allow the admin to disable the functionality |
Implementing this as isolated application would be possible and makes - in my opinion - also sense. We should ship and enable it per default then. |
Sounds good from my side. Not sure about the 'encrypt nonce in memory' part, because this usually doesn't work as expected, even if you go down to C-level, and because encryption only means that some attacker that has access to the application's memory must look in two places to also find the key, which is not really a challenge. Am I missing anything? |
@LukasReschke sooner or later we will need some oauth mechanism as well - would it make sense to bundle the development of both features because both will touch the very core of the our auth mechanisms? |
@danimo You're obviously right, this is more or less an obfuscation measure that doesn't work with opensource software. That's how you end after reviewing applications where this is a key requirement. (You know, managers and banksters love snake-oil ;-)) @DeepDiver1975 I agree on the fact that OAuth is something important that we have to tackle for ownCloud 8 and should be in core. To be honest, the whole login system could need a rewrite. This change would be unrelated since this can be implemented without a complete reimplementation. But yeah, let's solve this together to avoid rewriting the nonce-based authentication in the future ;-) |
This comment has been minimized.
This comment has been minimized.
I like the feature, it is a parity thing. Definitely nice to have, but does a lot for the end user experience. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Moved to backlog since this is waiting for a server support. |
@DeepDiver1975 Is there a server issue to track the server part of this? Edit: I re-opened owncloud/core#5453 |
The button "open owncloud in browser" currently opens the logon form in browser.
Like dropbox, the button should do a logon automatically
The text was updated successfully, but these errors were encountered: