owncloud / owncloud/ocis

Desktop client authentication. forwards to https://localhost

Open
#10,909 0 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug
Fresh New install Running OCIS in docker on a remote server. Trying to set up desktop client locally. I have two seperate issues
- Need to reauthenticate desktop client (MacOS 5.3.1) every few hours (which hopefully is solved with the next issue)
- When going through authentication sequence. Client -> forward to browser. -> Choose user -> Approve permission access. -> Error
The last step it forwards to https://127.0.0.1:port/url
This last step fails because of https on localhost. And so i have to manually change https to http://127.0.0.1:port/url to get desktop client to finish authentication flow.

## Steps to reproduce
1. Spin up fresh docker of OCIS Rolling
2. change username/password of admin.
3. Setup of desktop client.

## Expected behavior
Should authenticate with having to manually adjust browser url.
Desktop Client should only need re-authentication every 30 days (720 hours) according to default config.

## Actual behavior
- Desktop client asks to authenticate every couple of hours.
- Authentication has https://127.0.0.1

## Setup
using OCIS-rolling:Latest of today.

docker-compose.yml:

```console
services:
ocis:
hostname: ocis
image: owncloud/ocis-rolling:latest
user: 1000:1000
depends_on:
tika:
condition: service_started
ports:
- 9200:9200
entrypoint:
- /bin/sh
# run ocis init to initialize a configuration file with random secrets
# it will fail on subsequent runs, because the config file already exists
# therefore we ignore the error and then start the ocis server
command: ["-c", "ocis init || true; ocis server"]
environment:
OCIS_URL: https://ocis.domain.com
OCIS_LOG_LEVEL: error # make oCIS less verbose
PROXY_TLS: false # do not use SSL between reverse proxy and oCIS
OCIS_INSECURE: true
# basic auth (not recommended, but needed for eg. WebDav clients that do no>
PROXY_ENABLE_BASIC_AUTH: false
# admin user password
IDM_ADMIN_PASSWORD: "admin" # this overrides the admin password from the co>
# make settings service available to oCIS Hello
SETTINGS_GRPC_ADDR: 0.0.0.0:9191
GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the REVA gateway accessible to the a>
# email server (if configured)
NOTIFICATIONS_SMTP_HOST: "smtp.gmail.com"
NOTIFICATIONS_SMTP_PORT: "587"
NOTIFICATIONS_SMTP_SENDER: "email@gmail.com"
NOTIFICATIONS_SMTP_USERNAME: "email@gmail.com"
NOTIFICATIONS_SMTP_PASSWORD: "password"
# PROXY_TLS is set to "false", the download url has no https
STORAGE_USERS_DATA_GATEWAY_URL: http://ocis:9200/data

# better fulltext search
SEARCH_EXTRACTOR_TYPE: tika
SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
volumes:
- ./docker/ocis/config:/etc/ocis
- ./docker/ocis/data:/var/lib/ocis

logging:
driver: "local"
restart: always

# better full text search
tika:
image: apache/tika:latest-full
restart: always
# command: apt update && apt install tesseract-ocr-xxx -y add additional lang>
logging:
driver: local

networks:
default:
name: swag_default. #NGINX reverse proxy using https.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.