nextcloud / nextcloud/user_saml

Allow authentication for specific implementations of Public Key Infrastructure

Open
#223 0 comments 0 reactions 1 assignee View on GitHub

@fgsl is already working on this.

Since Jun 26, 2018.

enhancement
Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

Overview

Aim of this change is allowing specific implementations for authentication based on security tokens.
Nowadays, user_saml app accepts two types of login: saml and environment-variable. But there are different sets of OIDs for different public key infrastructures. Then, there are different strategies of authentication.
The proposal of implementation is allowing that programmers use properly strategy for public infrastructure public they are working with.
It's no intention to discard current implementation, but to allow that it can be adapted according reality of environment.

Steps to reproduce
  1. Extends OCA\User_SAML\Strategies\AuthenticationAbstractPKIStrategy.
  2. Extends OCA\User_SAML\UserBackend.
Expected behaviour

A user logs in Nextcloud using a security token.

Actual behaviour

Nextcloud does not support login for any security token.

Server configuration

It is necessary to config certificate in web server. Below are items that must to be set in apache site configuration file.
`
<VirtualHost *:443>

UseCanonicalName On
ServerName [SERVERNAME]

SSLEngine on
SSLProxyEngine on

SSLCertificateFile      [CRT FILE]
SSLCertificateKeyFile   [KEY FILE]
SSLCACertificateFile    [CRT FILE]
SSLVerifyDepth 3
SSLOptions +ExportCertData +StdEnvVars

# Initialize the special headers to a blank value to avoid http header forgeries
RequestHeader set SSL_CLIENT_CERT ""
RequestHeader set SSL_CLIENT_VERIFY ""

SSLVerifyClient none
<Location "/index.php/apps/user_saml/saml/login">
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

    SSLVerifyClient optional
    SSLVerifyDepth 3
    SSLOptions +ExportCertData +StdEnvVars

    RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
    RewriteRule .* /apps/user_saml/ssl_error.html [R=302,L]
    RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
    RequestHeader set SSL_CLIENT_VERIFY "%{SSL_CLIENT_VERIFY}s"
</Location>

SSLProtocol All -SSLv2 -SSLv3

SSLHonorCipherOrder  on

SSLCipherSuite [CIPHER]

SetEnv nokeepalive ssl-unclean-shutdown

`

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.