mirror/opencloud
1
0 Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-09-12 21:58:58 -04:00
Code Issues Packages Projects Releases Wiki Activity
23,818 Commits 104 Branches 73 Tags
d3391f2a3e62df464eaf300ce5709366a1d189ff
Commit Graph
473 Commits
Author SHA1 Message Date
Ralf Haferkamp a256da502b fix(proxy): suppress auth challenges for failed signed URLs 
Do not set WWW-Authenticate headers when an active signed URL
authentication attempt fails. Signed URL clients cannot respond to Basic
or Bearer challenges, and advertising them may trigger unintended
authentication prompts.

Keep returning 401 Unauthorized while preserving the existing challenge
behavior for unsigned requests and disabled signed URL mechanisms.
 2026-09-11 11:51:01 +02:00
Sigurd Aaknes 7016020dbf fix: oidcHTTPClient now use proxy from environment 2026-09-11 11:50:49 +02:00
Alex Ababii 8875d062b0 upd tests for auth requests middelware 2026-09-08 09:37:51 +02:00
Alex Ababii d1d20edbd2 log jwt expired on debug level instead of error 2026-09-08 09:37:51 +02:00
Dominik Schmidt 7f7a938c3f fix(proxy): restrict JWT signed urls to the allowed HTTP methods 
The legacy OC-Signature path already rejects methods outside
PRE_SIGNED_URL_ALLOWED_HTTP_METHODS, the JWT path did not. A leaked
signed download url could be used for PUT, DELETE, MOVE or PROPFIND
as the signing user for the lifetime of the signature.
 2026-09-07 13:00:09 +02:00
Benedikt Kulmann 709543234f chore: set introduction version to 7.5.0 for new env vars 2026-08-25 12:53:03 +02:00
Jörn Friedrich Dreyer 0776a479da send all /data throught middleware 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-08-21 07:34:46 +02:00
Jörn Friedrich Dreyer a93ec92789 rewrite more /data urls 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-08-21 07:34:46 +02:00
Jörn Friedrich Dreyer c0d5380017 drop unused datagateway service and gateway config 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-08-21 07:34:46 +02:00
Jörn Friedrich Dreyer a74661618e refactor datagateway into proxy middleware 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-08-21 07:34:46 +02:00
Florian Schade 8b922127b8 feat: move the collaboration mentioning api to graph 2026-08-17 15:44:04 +02:00
Alex b2cf7a965f fix(csp): allow blob: in style-src for EPUB reader iframe (#3300) 2026-08-13 13:16:04 +02:00
Jörn Friedrich Dreyer 8478b5daa1 allow tuning the proxies http client 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-08-13 11:54:42 +02:00
Jörn Friedrich Dreyer 6f5f993ada Merge pull request #3288 from fschade/feat-modernize-opa 
perf(policies): reuse the compiled rego query across evaluations
 2026-08-12 17:58:13 +02:00
Florian Schade 1e7cfaf92d refactor(policies): read the rego policies once at startup 2026-08-12 17:01:49 +02:00
Florian Schade cd7f8f91b6 fix: oidc middleware claim race 2026-08-11 11:39:50 +02:00
Dominik Schmidt 51dd107767 feat: add announcement banner 2026-07-29 00:39:59 +02:00
Viktor Scharf 5accb6056b set 7.3.0 version placeholder (#3132) 2026-07-14 18:12:24 +02:00
Elias Schneider 4734c57f2b fix(proxy): honor access token cache ttl 2026-07-14 17:49:40 +02:00
Thomas Schweiger 50be30e5db fix: fix typo in proxy service documentation 2026-07-08 10:25:47 +02:00
André Duffeck 1ea634e6e3 Do not try to create personal spaces for lightweight or service users 
This fixes error logs like

RR error when calling Createhome error="gateway: grpc failed with code CODE_INVALID_ARGUMENT" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/create_home.go:87 service=proxy

e.g. during internal requests to the data provider.
 2026-06-19 11:05:44 +02:00
Jörn Friedrich Dreyer 81fd00043e Merge pull request #2063 from opencloud-eu/nats-tls-options 
add tls support for all nats connections
 2026-06-16 13:21:22 +02:00
Florian Schade f1208cfa32 enhancement: make collaboration mention functionality public 2026-06-11 09:28:37 +02:00
Florian Schade 159785a3b5 enhancement: make collaboration font management functionality public 2026-06-11 09:28:37 +02:00
Jörn Friedrich Dreyer 77fd4fca69 add tls support for all nats connections 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-06-10 17:04:18 +02:00
Heiko Pohl 9502e00dc3 switch role_name from guest to user-light in proxy README.md 2026-06-09 11:41:52 +02:00
Florian Schade 457284885b fix: remove unnecessary error log it the oidc access token verify method is set to none 2026-05-20 15:11:03 +02:00
Jörn Friedrich Dreyer 5d7bfc9033 delete unused constants 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-05-13 10:54:00 +02:00
Jörn Friedrich Dreyer fb4112dc68 update generated code 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-05-13 10:52:44 +02:00
Florian Schade d0e3f14539 chore: remove loop var references 2026-04-23 17:11:55 +02:00
Florian Schade 288e67cc39 chore: replace interface with any 2026-04-23 09:31:11 +02:00
Viktor Scharf f8b28b12e9 combine version placeholder check steps [🎉 release]. set 6.1.0. version for upcoming release (#2626) 
* 🎉 release: combine version placeholder check steps

* set 6.1.0 version
 2026-04-20 10:43:22 +02:00
Ralf Haferkamp d9f39773e7 proxy: add memory cache for tenant id mapping 
This is to reduce the number of "proxy->gateway->users->ldap" roundtrips
for the tenant id mapping.

The cache currently has a non-configurable ttl of 10 min.

Related: #2310
 2026-04-09 17:46:50 +02:00
Ralf Haferkamp a931e53c26 proxy: Allow mapping from an external tenant id to the internal id 
When the tenant id coming in via the OIDC claims doesn't match the
tenant id on the provisioned user, a mapping can be configured and
resolved via the reva TenantAPI service (now started as part of the
"users" service).

Closes: #2310
 2026-04-09 17:46:50 +02:00
Ralf Haferkamp 33f45fa965 feat(multi-tenancy): verify tenant via OIDC claim 
When multi-tenancy is enable we now allow to specify an OIDC claim
against which the tenantid of the user resolved via CS3 apis is matched.

Partial: #2310
 2026-04-02 16:10:53 +02:00
Michael Barz f0836c54fb feat: add userid to spans (#2536) 2026-03-30 10:32:24 +02:00
Florian Schade c7fd33c919 fix: send the backchannel logout event only if a session exists 2026-02-27 11:16:53 +01:00
Florian Schade b69b9cd569 fix: simplify subject.session key parsing 2026-02-25 14:02:09 +01:00
Florian Schade e8ecbd7af1 refactor: make the logout mode private 2026-02-25 14:02:09 +01:00
Florian Schade fd614eacf1 fix: use base64 record keys to prevent separator clashes with subjects or sessionIds that contain a dot 2026-02-25 14:02:09 +01:00
Florian Schade 910298aa05 chore: change naming 2026-02-25 14:02:09 +01:00
Florian Schade 7350050a05 test: add more backchannellogout tests 2026-02-25 14:02:09 +01:00
Florian Schade f72e3f1e32 chore: cleanup backchannel logout pr for review 2026-02-25 14:02:09 +01:00
Florian Schade 0c62c45494 enhancement: document idp side-effects 2026-02-25 14:02:09 +01:00
Florian Schade f6553498f6 enhancement: finalize backchannel logout 2026-02-25 14:02:09 +01:00
Christian RichterJörn DreyerMichael Barz
 		6a0fd89475 refactor deletion 
Co-authored-by: Jörn Dreyer <j.dreyer@opencloud.eu>
Co-authored-by: Michael Barz <m.barz@opencloud.eu>
Signed-off-by: Christian Richter <c.richter@opencloud.eu>
 2026-02-25 14:02:09 +01:00
Christian Richter cb38aaab16 create mapping in cache for subject => sessionid 
Signed-off-by: Christian Richter <c.richter@opencloud.eu>
 2026-02-25 14:02:09 +01:00
Christian Richter 762062bfa3 add mapping to backchannel logout for subject => sessionid 
Signed-off-by: Christian Richter <c.richter@opencloud.eu>
 2026-02-25 14:02:09 +01:00
Christian RichterandMichael Barz 291265afb0 add additional validation to logout token 
Signed-off-by: Christian Richter <c.richter@opencloud.eu>
Co-authored-by: Michael Barz <m.barz@opencloud.eu>
 2026-02-25 14:02:09 +01:00
Ralf Haferkamp 6dde2839df fix(oidc_auth): Fix userinfo cache expiration logic 
When the userinfo claims store in the usercache is found to be expired,
do not return an error but ignore the cached entry and force a
re-verification of the access token (either via parsing the JWT again or
via a UserInfo lookup).
This is required for setups with non-JWT access tokes where the expiry
date set in the cached claims does not reflect the actual token expiry,
but just the CacheTTL.

Fixes: #1493
 2026-02-19 13:17:17 +01:00