From 5b5d3611ad6fa7ed3912a6046472fcc66c04b9dd Mon Sep 17 00:00:00 2001 From: "A.Unger" Date: Fri, 4 Dec 2020 14:22:16 +0100 Subject: [PATCH] add changelog --- .../user-agent-challenge-lock-in.md | 20 +++++++++++++++++++ changelog/unreleased/user-agent-lock-in.md | 5 ----- 2 files changed, 20 insertions(+), 5 deletions(-) create mode 100644 changelog/unreleased/user-agent-challenge-lock-in.md delete mode 100644 changelog/unreleased/user-agent-lock-in.md diff --git a/changelog/unreleased/user-agent-challenge-lock-in.md b/changelog/unreleased/user-agent-challenge-lock-in.md new file mode 100644 index 000000000..f89ab4eb2 --- /dev/null +++ b/changelog/unreleased/user-agent-challenge-lock-in.md @@ -0,0 +1,20 @@ +Enhancement: Add www-authenticate based on user agent + +Tags: reva, proxy + +We now comply with HTTP spec by adding Www-Authenticate headers on every `401` request. Furthermore, we not only take care of such a thing at the Proxy but also Reva will take care of it. In addition, we now are able to lock-in a set of User-Agent to specific challenges. + +Admins can use this feature by configuring OCIS + Reva following this approach: + +``` +STORAGE_FRONTEND_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT="mirall:basic, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0:bearer" \ +PROXY_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT="mirall:basic, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0:bearer" \ +PROXY_ENABLE_BASIC_AUTH=true \ +go run cmd/ocis/main.go server +``` + +We introduced two new environment variables: + +`STORAGE_FRONTEND_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT` as well as `PROXY_MIDDLEWARE_AUTH_CREDENTIALS_BY_USER_AGENT`, The reason they have the same value is not to rely on the os env on a distributed environment, so in redundancy we trust. They both configure the same on the backend storage and OCIS Proxy. + +https://github.com/owncloud/ocis/pull/1009 diff --git a/changelog/unreleased/user-agent-lock-in.md b/changelog/unreleased/user-agent-lock-in.md deleted file mode 100644 index aec155353..000000000 --- a/changelog/unreleased/user-agent-lock-in.md +++ /dev/null @@ -1,5 +0,0 @@ -Enhancement: Add www-authenticate based on user agent - -We now comply with HTTP spec by adding Www-Authenticate headers on every `401` request. Furthermore we not only take care of such thing at the Proxy but also Reva will take care of it. In addition we now are able to lock-in user-agents to specific challenges. - -https://github.com/owncloud/ocis/pull/1009