[full-ci] [bump-reva] Replacement for TokenInfo endpoint

[2403905]

Description

Related Issue

#8858

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[rhafer]

Hm, wouldn't it be much easier if we'd just remove the isPublicPath here. What is wrong with trying to verify the Bearer token on e.g. /dav/public-files if it's in the request? That way we wouldn't need the inInternal check here.

I think the same is true for the BasicAuthenticator.

[2403905]

If we remove the isPublicPath we hit the m.getClaims(token, r) for every public link which sounds bad
We can filter out the requests to public-files with the sharetoken

[rhafer]

If we remove the isPublicPath we hit the m.getClaims(token, r) for every public link which sounds bad

Why is that bad? Also we can easily skip the call and error out when the Authorizatiion header does not carry a bearer token.

[2403905]

If you mean to check the token after retrieving, it makes sense

token := strings.TrimPrefix(r.Header.Get(_headerAuthorization), _bearerPrefix)
if token == "" {
    return nil, false
}

[2403905]

However, some cases will be broken because the sequence of the authenticators has been changed. the public and oidc are swapped. The request below will be failed.

http://example.com/dav/public-files/
-H Authorization Bearer some_token
-H public-token some_tocken 

It was passed with the public_share_auth
But after we swapped authenticators, it will not reach the public_share_auth

[2403905]

It means all cases that pass in a public_share_auth we should skip in an oidc.

[2403905]

Already changed to if !m.shouldServe(r) Let's see what impact this has.

[JammingBen]

I'm not 100% sure here, but after a quick research I think we can't get rid of the browser auth popup when sending a 401 response code and the WWW-Authenticate header. So we might need to find a slightly different solution. Things that come to my mind:

• Changing the status code to e.g. 400 (semantically not correct though).
• Remove the WWW-Authenticate header so clients need differentiate based on the returned error message. I guess that would be okay if we don't plan to translate it.

[2403905]

@JammingBen I removed the WWW-Authenticate Basic header
The popup authentication also made the webUITest faled
Please try without authentication popup

[JammingBen]

@JammingBen I removed the WWW-Authenticate Basic header The popup authentication also made the webUITest faled Please try without authentication popup

Yup that works 👍 I'm simply checking the error message now: https://github.com/owncloud/web/pull/10869/files#diff-90681f8aba50079e5c32cf69d1f1c61af3dbf496f0adfd5fa45936a5647eb767R144. If @micbar or @rhafer don't have any objections I'm fine with that.

[rhafer]

@2403905 This doesn't build currently. I think you need to rebase you reva fork and update the vendor files.

[rhafer]

@2403905 Now that the reva part is merged we can rebase and remove the reva replacement.

[sonarcloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
50.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud