Save the MFA status after the user is resolved so signed-URL downloads
inherit it, and check its age on read. Build the signing-key URL with
the URL API so it works with the vault base URL.
* fix: [OCISDEV-1476] fix AuthApp requests failing with a custom PROXY_USER_OIDC_CLAIM
* fix: [OCISDEV-1476] map ErrAccountNotFound to 401 in verifyUser
AccountResolver.verifyUser only mapped ErrAccountDisabled to 401 before
falling through to a generic 500. The identity backend excludes disabled
accounts from by-username lookups and returns ErrAccountNotFound instead,
so a disabled user authenticating via AppAuth or basic auth got a 500
instead of a 401, caught by the acceptance test suite.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Requests on unprotected routes can carry a reva token without a resolved
user: reva's internal downloads to the data gateway (/data) are sent with
the caller's token. create_home logged "no user in context" at error level
for each of them, so every download added an error line. Log at debug with
the path instead; the request is passed on unchanged, as before.
Fixes#13101
Claude-Session: https://claude.ai/code/session_01WpoeSoKYEdgQcWjEzTVKpT
Signed-off-by: Paul Faure <paul@faure.ca>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The proxy public share authenticator set the brute force protection skip
marker on every authentication, including requests where the proxy is the
only authenticator. Failed password attempts on those requests were never
counted, so the rate limit for password protected public links was not
enforced.
The skip marker is now only set for requests that are re-authenticated
downstream, so failed attempts are reliably counted and the throttle is
applied consistently.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: use specific gookit config instance instance of using global
Using the global instance was causing a panic when the service was
restarted. That panic won't happen now.
* chore: add changelog entry
getClaims rejected a request with jwt.ErrTokenExpired whenever the cached
userinfo entry's expiry had passed, instead of re-verifying the access token.
The cached "exp" is not always the real token expiry: for opaque access tokens
extractExpiration falls back to the configured cache TTL. A still-valid token
could therefore be rejected merely because its cache entry aged out, producing
spurious logouts (most visible under frequent PROPFIND requests).
getClaims now treats an expired cache entry as a cache miss and falls through to
VerifyAccessToken/UserInfo re-verification. A genuinely expired or invalid token
is still rejected by that re-verification, so authentication is not weakened.
The test's mock now returns a fresh claims map per call, mirroring the real
client, so the suite is race-clean (getClaims caches asynchronously).
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
signatureIsValid indexed signingKey[0] without checking the slice length. When
the signing-key store returns an empty result without an error — which the
"noop" store does, and OCIS_CACHE_STORE=noop also switches the presigned-URL
signing-key store to noop — every signed-URL download panicked with
"index out of range [0] with length 0" (recovered per request as a 502), so all
signed-URL downloads failed.
Guard the index access and return a real authentication error. The previous
empty-value branch also returned a nil error, which would have accepted an empty
signing key; it now returns an error so the request is rejected.
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: metadata autopropagation
* feat: autoprop support for MFA / vault mode
* fix: replace some http clients with reva ones
* chore: required lib update
* fix: adjust unit tests and generate new mocks
* fix: apply autopropagation to all regular graph routes
* chore: updated reva dependency
* fix: return the right decorator for the thumbnails
* fix: remove autopropagation headers in the proxy
The space management middleware removed users from all project spaces
when processing signed URL requests because no OIDC claims are present
in that auth context. Return early when claims are nil to prevent the
oscillating add/remove cycle.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Implemet the vault-storage
feat: Separate the storage-users and graph to handle
feat: move the space create cache
configurate the vault srorage Postprocessing
hide the assignment of the MountID to VaultStorageProviderID behind a flag to avoid the ID mismatch
configurate the proxy to create the vault home space
update the filter
Make the graph able to handle vault prefix. no extra service needed
apply the vault filter to sharedbyme and sharedwithme
added vault-storage docker
use squashed reva
fix the finishUpload event
restict webdav copy/move from the vault
feat: provide the mfa to webdav and grpc
feat: refactoring: provide the mfa to webdav and grpc
mfa collaboration
fix GetRootDriveChildren and more
fix: send the MFA header in HTTP clients from the collaboration service
provide the default storage user vault configuration
update create_home middleware
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
Update services/gateway/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/graph/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/proxy/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update services/storage-users/pkg/config/config.go
Co-authored-by: Martin <github@diemattels.at>
Update deployments/examples/ocis_full/vault-storage.yml
Co-authored-by: Martin <github@diemattels.at>
bump reva
deduplicate the requireMFA middeware on vault routes. fix AppendPlainToOpaque.
added the changlog and comments
* feat: add the vault mode search
* Update changelog/unreleased/enhancement-vault-storage.md
Co-authored-by: Martin <github@diemattels.at>
* update the readme. the reva vault storage provider configuration disabled by default
* feat: [OCISDEV-531] add vault capabilities to the OCS capabilities endpoint
* the port range allocated. the configuration updated.
---------
Co-authored-by: Martin <github@diemattels.at>
Extract homeKnown() and createHome() from ServeHTTP to bring
cognitive complexity under the SonarCloud limit of 15.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allow operators to disable the in-memory CreateHome cache via
PROXY_CREATEHOME_CACHE_DISABLED as a fallback if the cache causes
unexpected behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use canonical header casing "X-Access-Token" (canonicalheader)
- Return true instead of nil on success to avoid nilnil (nilnil)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The CreateHome middleware fired a gRPC CreateHome request on every
authenticated HTTP request. On first login the browser sends ~11
parallel requests, each triggering a redundant call. Use singleflight
to collapse concurrent calls for the same user and sync.Map to cache
successful results so subsequent requests skip the gRPC call entirely.
Fixes: #12068
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The server handlers for go-micro reuse the data from reva so the
propagation also works with reva services.
Both reva and go-micro services will propagate the data correctly.
Change the Referrer-Policy from 'strict-origin-when-cross-origin'
to 'no-referrer' to enhance user privacy and security.
Previously, the origin was sent on cross-origin requests. This change
completely removes the Referrer header from all outgoing requests,
preventing any potential leakage of browsing information to third parties.
This is a more robust approach to protecting user privacy.
For now, only some hardcoded paths will check the claims (if there is a
checker configured). If the check fails for those paths, the
authentication will fail and it will return a 401 error
otelchi and other custom solutions have been replaced with otelhttp to
trace HTTP requests; new middleware is provided to be used across the
platform.
The proxy service will use a custom HTTP client to forward the headers
needed for telemetry automatically (also based on otelhttp)
