Use the opencloud reva from now on

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/appauth/appauth.go

@@ -0,0 +1,99 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package appauth
+
+import (
+	"context"
+
+	appauthpb "github.com/cs3org/go-cs3apis/cs3/auth/applications/v1beta1"
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("appauth", New)
+}
+
+type manager struct {
+	GatewayAddr string `mapstructure:"gateway_addr"`
+}
+
+// New returns a new auth Manager.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+	return mgr, nil
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	err := mapstructure.Decode(ml, m)
+	if err != nil {
+		return errors.Wrap(err, "error decoding conf")
+	}
+	return nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, username, password string) (*user.User, map[string]*authpb.Scope, error) {
+	gtw, err := pool.GetGatewayServiceClient(m.GatewayAddr)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// get user info
+	userResponse, err := gtw.GetUserByClaim(ctx, &user.GetUserByClaimRequest{
+		Claim: "username",
+		Value: username,
+	})
+
+	switch {
+	case err != nil:
+		return nil, nil, err
+	case userResponse.Status.Code == rpcv1beta1.Code_CODE_NOT_FOUND:
+		return nil, nil, errtypes.NotFound(userResponse.Status.Message)
+	case userResponse.Status.Code != rpcv1beta1.Code_CODE_OK:
+		return nil, nil, errtypes.InternalError(userResponse.Status.Message)
+	}
+
+	// get the app password associated with the user and password
+	appAuthResponse, err := gtw.GetAppPassword(ctx, &appauthpb.GetAppPasswordRequest{
+		User:     userResponse.GetUser().Id,
+		Password: password,
+	})
+
+	switch {
+	case err != nil:
+		return nil, nil, err
+	case appAuthResponse.Status.Code == rpcv1beta1.Code_CODE_NOT_FOUND:
+		return nil, nil, errtypes.NotFound(appAuthResponse.Status.Message)
+	case appAuthResponse.Status.Code != rpcv1beta1.Code_CODE_OK:
+		return nil, nil, errtypes.InternalError(appAuthResponse.Status.Message)
+	}
+
+	return userResponse.GetUser(), appAuthResponse.GetAppPassword().TokenScope, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/demo/demo.go

@@ -0,0 +1,127 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package demo
+
+import (
+	"context"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+)
+
+func init() {
+	registry.Register("demo", New)
+}
+
+type manager struct {
+	credentials map[string]Credentials
+}
+
+// Credentials holds a pair of secret and userid
+type Credentials struct {
+	User   *user.User
+	Secret string
+}
+
+// New returns a new auth Manager.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	// m not used
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	return mgr, err
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	creds := getCredentials()
+	m.credentials = creds
+	return nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	if c, ok := m.credentials[clientID]; ok {
+		if c.Secret == clientSecret {
+			var scopes map[string]*authpb.Scope
+			var err error
+			if c.User.Id != nil && (c.User.Id.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || c.User.Id.Type == user.UserType_USER_TYPE_FEDERATED) {
+				scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
+				if err != nil {
+					return nil, nil, err
+				}
+			} else {
+				scopes, err = scope.AddOwnerScope(nil)
+				if err != nil {
+					return nil, nil, err
+				}
+			}
+			return c.User, scopes, nil
+		}
+	}
+	return nil, nil, errtypes.InvalidCredentials(clientID)
+}
+
+func getCredentials() map[string]Credentials {
+	return map[string]Credentials{
+		"einstein": {
+			Secret: "relativity",
+			User: &user.User{
+				Id: &user.UserId{
+					Idp:      "http://localhost:9998",
+					OpaqueId: "4c510ada-c86b-4815-8820-42cdf82c3d51",
+					Type:     user.UserType_USER_TYPE_PRIMARY,
+				},
+				Username:    "einstein",
+				Groups:      []string{"sailing-lovers", "violin-haters", "physics-lovers"},
+				Mail:        "einstein@example.org",
+				DisplayName: "Albert Einstein",
+			},
+		},
+		"marie": {
+			Secret: "radioactivity",
+			User: &user.User{
+				Id: &user.UserId{
+					Idp:      "http://localhost:9998",
+					OpaqueId: "f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c",
+					Type:     user.UserType_USER_TYPE_PRIMARY,
+				},
+				Username:    "marie",
+				Groups:      []string{"radium-lovers", "polonium-lovers", "physics-lovers"},
+				Mail:        "marie@example.org",
+				DisplayName: "Marie Curie",
+			},
+		},
+		"richard": {
+			Secret: "superfluidity",
+			User: &user.User{
+				Id: &user.UserId{
+					Idp:      "http://localhost:9998",
+					OpaqueId: "932b4540-8d16-481e-8ef4-588e4b6b151c",
+					Type:     user.UserType_USER_TYPE_PRIMARY,
+				},
+				Username:    "richard",
+				Groups:      []string{"quantum-lovers", "philosophy-haters", "physics-lovers"},
+				Mail:        "richard@example.org",
+				DisplayName: "Richard Feynman",
+			},
+		},
+	}
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/impersonator/impersonator.go

@@ -0,0 +1,67 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package impersonator
+
+import (
+	"context"
+	"strings"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+)
+
+func init() {
+	registry.Register("impersonator", New)
+}
+
+type mgr struct{}
+
+// New returns an auth manager implementation that allows to authenticate with any credentials.
+func New(c map[string]interface{}) (auth.Manager, error) {
+	return &mgr{}, nil
+}
+
+func (m *mgr) Configure(ml map[string]interface{}) error {
+	return nil
+}
+
+func (m *mgr) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	// allow passing in uid as <opaqueid>@<idp>
+	at := strings.LastIndex(clientID, "@")
+	uid := &user.UserId{Type: user.UserType_USER_TYPE_PRIMARY}
+	if at < 0 {
+		uid.OpaqueId = clientID
+	} else {
+		uid.OpaqueId = clientID[:at]
+		uid.Idp = clientID[at+1:]
+	}
+
+	scope, err := scope.AddOwnerScope(nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return &user.User{
+		Id: uid,
+		// not much else to provide
+	}, scope, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/json/json.go

@@ -0,0 +1,146 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package json
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	typespb "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("json", New)
+}
+
+// Credentials holds a pair of secret and userid
+type Credentials struct {
+	ID           *user.UserId    `mapstructure:"id" json:"id"`
+	Username     string          `mapstructure:"username" json:"username"`
+	Mail         string          `mapstructure:"mail" json:"mail"`
+	MailVerified bool            `mapstructure:"mail_verified" json:"mail_verified"`
+	DisplayName  string          `mapstructure:"display_name" json:"display_name"`
+	Secret       string          `mapstructure:"secret" json:"secret"`
+	Groups       []string        `mapstructure:"groups" json:"groups"`
+	UIDNumber    int64           `mapstructure:"uid_number" json:"uid_number"`
+	GIDNumber    int64           `mapstructure:"gid_number" json:"gid_number"`
+	Opaque       *typespb.Opaque `mapstructure:"opaque" json:"opaque"`
+}
+
+type manager struct {
+	credentials map[string]*Credentials
+}
+
+type config struct {
+	// Users holds a path to a file containing json conforming the Users struct
+	Users string `mapstructure:"users"`
+}
+
+func (c *config) init() {
+	if c.Users == "" {
+		c.Users = "/etc/revad/users.json"
+	}
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	c.init()
+	return c, nil
+}
+
+// New returns a new auth Manager.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+	return mgr, nil
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	c, err := parseConfig(ml)
+	if err != nil {
+		return err
+	}
+
+	m.credentials = map[string]*Credentials{}
+	f, err := os.ReadFile(c.Users)
+	if err != nil {
+		return err
+	}
+
+	credentials := []*Credentials{}
+
+	err = json.Unmarshal(f, &credentials)
+	if err != nil {
+		return err
+	}
+
+	for _, c := range credentials {
+		m.credentials[c.Username] = c
+	}
+	return nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, username string, secret string) (*user.User, map[string]*authpb.Scope, error) {
+	if c, ok := m.credentials[username]; ok {
+		if c.Secret == secret {
+			var scopes map[string]*authpb.Scope
+			var err error
+			if c.ID != nil && (c.ID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || c.ID.Type == user.UserType_USER_TYPE_FEDERATED) {
+				scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
+				if err != nil {
+					return nil, nil, err
+				}
+			} else {
+				scopes, err = scope.AddOwnerScope(nil)
+				if err != nil {
+					return nil, nil, err
+				}
+			}
+			return &user.User{
+				Id:           c.ID,
+				Username:     c.Username,
+				Mail:         c.Mail,
+				MailVerified: c.MailVerified,
+				DisplayName:  c.DisplayName,
+				Groups:       c.Groups,
+				UidNumber:    c.UIDNumber,
+				GidNumber:    c.GIDNumber,
+				Opaque:       c.Opaque,
+				// TODO add arbitrary keys as opaque data
+			}, scopes, nil
+		}
+	}
+	return nil, nil, errtypes.InvalidCredentials(username)
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/ldap/ldap.go

@@ -0,0 +1,221 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package ldap
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	"github.com/go-ldap/ldap/v3"
+	"github.com/google/uuid"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("ldap", New)
+}
+
+type mgr struct {
+	c          *config
+	ldapClient ldap.Client
+}
+
+type config struct {
+	utils.LDAPConn  `mapstructure:",squash"`
+	LDAPIdentity    ldapIdentity.Identity `mapstructure:",squash"`
+	Idp             string                `mapstructure:"idp"`
+	GatewaySvc      string                `mapstructure:"gatewaysvc"`
+	Nobody          int64                 `mapstructure:"nobody"`
+	LoginAttributes []string              `mapstructure:"login_attributes"`
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{
+		LDAPIdentity:    ldapIdentity.New(),
+		LoginAttributes: []string{"cn"},
+	}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	return c, nil
+}
+
+// New returns an auth manager implementation that connects to a LDAP server to validate the user.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	manager := &mgr{}
+	err := manager.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+	manager.ldapClient, err = utils.GetLDAPClientWithReconnect(&manager.c.LDAPConn)
+	if err != nil {
+		return nil, err
+	}
+	return manager, nil
+}
+
+func (am *mgr) Configure(m map[string]interface{}) error {
+	c, err := parseConfig(m)
+	if err != nil {
+		return err
+	}
+
+	if c.Nobody == 0 {
+		c.Nobody = 99
+	}
+
+	if err = c.LDAPIdentity.Setup(); err != nil {
+		return fmt.Errorf("error setting up Identity config: %w", err)
+	}
+	c.GatewaySvc = sharedconf.GetGatewaySVC(c.GatewaySvc)
+	am.c = c
+	return nil
+}
+
+func (am *mgr) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	log := appctx.GetLogger(ctx)
+
+	filter := am.getLoginFilter(clientID)
+
+	userEntry, err := am.c.LDAPIdentity.GetLDAPUserByFilter(log, am.ldapClient, filter)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Bind as the user to verify their password
+	la, err := utils.GetLDAPClientForAuth(&am.c.LDAPConn)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer la.Close()
+	err = la.Bind(userEntry.DN, clientSecret)
+	switch {
+	case err == nil:
+		break
+	case ldap.IsErrorWithCode(err, ldap.LDAPResultInvalidCredentials):
+		return nil, nil, errtypes.InvalidCredentials(clientID)
+	default:
+		log.Debug().Err(err).Interface("userdn", userEntry.DN).Msg("bind with user credentials failed")
+		return nil, nil, err
+	}
+
+	var uid string
+	if am.c.LDAPIdentity.User.Schema.IDIsOctetString {
+		rawValue := userEntry.GetEqualFoldRawAttributeValue(am.c.LDAPIdentity.User.Schema.ID)
+		if value, err := uuid.FromBytes(rawValue); err == nil {
+			uid = value.String()
+		}
+	} else {
+		uid = userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.ID)
+	}
+
+	userID := &user.UserId{
+		Idp:      am.c.Idp,
+		OpaqueId: uid,
+		Type:     am.c.LDAPIdentity.GetUserType(userEntry),
+	}
+	gwc, err := pool.GetGatewayServiceClient(am.c.GatewaySvc)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "ldap: error getting gateway grpc client")
+	}
+	getGroupsResp, err := gwc.GetUserGroups(ctx, &user.GetUserGroupsRequest{
+		UserId: userID,
+	})
+	if err != nil {
+		log.Warn().Err(err).Msg("error getting user groups")
+		return nil, nil, errors.Wrap(err, "ldap: error getting user groups")
+	}
+	if getGroupsResp.Status.Code != rpc.Code_CODE_OK {
+		log.Warn().Err(err).Str("msg", getGroupsResp.Status.Message).Msg("grpc getting user groups failed")
+		return nil, nil, fmt.Errorf("ldap: grpc getting user groups failed: '%s'", getGroupsResp.Status.Message)
+	}
+	gidNumber := am.c.Nobody
+	gidValue := userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.GIDNumber)
+	if gidValue != "" {
+		gidNumber, err = strconv.ParseInt(gidValue, 10, 64)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	uidNumber := am.c.Nobody
+	uidValue := userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.UIDNumber)
+	if uidValue != "" {
+		uidNumber, err = strconv.ParseInt(uidValue, 10, 64)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	u := &user.User{
+		Id: userID,
+		// TODO add more claims from the StandardClaims, eg EmailVerified
+		Username: userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.Username),
+		// TODO groups
+		Groups:      getGroupsResp.Groups,
+		Mail:        userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.Mail),
+		DisplayName: userEntry.GetEqualFoldAttributeValue(am.c.LDAPIdentity.User.Schema.DisplayName),
+		UidNumber:   uidNumber,
+		GidNumber:   gidNumber,
+	}
+
+	var scopes map[string]*authpb.Scope
+	if userID != nil && userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT {
+		scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	} else {
+		scopes, err = scope.AddOwnerScope(nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	log.Debug().Interface("entry", userEntry).Interface("user", u).Msg("authenticated user")
+
+	return u, scopes, nil
+}
+
+func (am *mgr) getLoginFilter(login string) string {
+	var filter string
+	for _, attr := range am.c.LoginAttributes {
+		filter = fmt.Sprintf("%s(%s=%s)", filter, attr, ldap.EscapeFilter(login))
+	}
+
+	return fmt.Sprintf("(&%s(objectclass=%s)(|%s))",
+		am.c.LDAPIdentity.User.Filter,
+		am.c.LDAPIdentity.User.Objectclass,
+		filter,
+	)
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/loader/loader.go

@@ -0,0 +1,36 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package loader
+
+import (
+	// Load core authentication managers.
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/appauth"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/demo"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/impersonator"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/json"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/ldap"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/machine"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/nextcloud"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/ocmshares"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/oidc"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/owncloudsql"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/publicshares"
+	_ "github.com/opencloud-eu/reva/v2/pkg/auth/manager/serviceaccounts"
+	// Add your own here
+)

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/machine/machine.go

@@ -0,0 +1,125 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package machine
+
+import (
+	"context"
+	"strings"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/pkg/errors"
+)
+
+// 'machine' is an authentication method used to impersonate users.
+// To impersonate the given user it's only needed an api-key, saved
+// in a config file.
+
+// supported claims
+var claims = []string{"mail", "uid", "username", "gid", "userid"}
+
+type manager struct {
+	APIKey      string `mapstructure:"api_key"`
+	GatewayAddr string `mapstructure:"gateway_addr"`
+}
+
+func init() {
+	registry.Register("machine", New)
+}
+
+// Configure parses the map conf
+func (m *manager) Configure(conf map[string]interface{}) error {
+	err := mapstructure.Decode(conf, m)
+	if err != nil {
+		return errors.Wrap(err, "error decoding conf")
+	}
+	return nil
+}
+
+// New creates a new manager for the 'machine' authentication
+func New(conf map[string]interface{}) (auth.Manager, error) {
+	m := &manager{}
+	err := m.Configure(conf)
+	if err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Authenticate impersonate an user if the provided secret is equal to the api-key
+func (m *manager) Authenticate(ctx context.Context, user, secret string) (*userpb.User, map[string]*authpb.Scope, error) {
+	if m.APIKey != secret {
+		return nil, nil, errtypes.InvalidCredentials("")
+	}
+
+	gtw, err := pool.GetGatewayServiceClient(m.GatewayAddr)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// username could be either a normal username or a string <claim>:<value>
+	// in the first case the claim is "username"
+	claim, value := parseUser(user)
+
+	userResponse, err := gtw.GetUserByClaim(ctx, &userpb.GetUserByClaimRequest{
+		Claim: claim,
+		Value: value,
+	})
+
+	switch {
+	case err != nil:
+		return nil, nil, err
+	case userResponse.Status.Code == rpc.Code_CODE_NOT_FOUND:
+		return nil, nil, errtypes.NotFound(userResponse.Status.Message)
+	case userResponse.Status.Code != rpc.Code_CODE_OK:
+		return nil, nil, errtypes.InternalError(userResponse.Status.Message)
+	}
+
+	scope, err := scope.AddOwnerScope(nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return userResponse.GetUser(), scope, nil
+
+}
+
+func contains(lst []string, s string) bool {
+	for _, e := range lst {
+		if e == s {
+			return true
+		}
+	}
+	return false
+}
+
+func parseUser(user string) (string, string) {
+	s := strings.SplitN(user, ":", 2)
+	if len(s) == 2 && contains(claims, s[0]) {
+		return s[0], s[1]
+	}
+	return "username", user
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/nextcloud/nextcloud.go

@@ -0,0 +1,197 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+// Package nextcloud verifies a clientID and clientSecret against a Nextcloud backend.
+package nextcloud
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("nextcloud", New)
+}
+
+// Manager is the Nextcloud-based implementation of the auth.Manager interface
+// see https://github.com/cs3org/reva/blob/v1.13.0/pkg/auth/auth.go#L32-L35
+type Manager struct {
+	client       *http.Client
+	sharedSecret string
+	endPoint     string
+}
+
+// AuthManagerConfig contains config for a Nextcloud-based AuthManager
+type AuthManagerConfig struct {
+	EndPoint     string `mapstructure:"endpoint" docs:";The Nextcloud backend endpoint for user check"`
+	SharedSecret string `mapstructure:"shared_secret"`
+	MockHTTP     bool   `mapstructure:"mock_http"`
+}
+
+// Action describes a REST request to forward to the Nextcloud backend
+type Action struct {
+	verb     string
+	username string
+	argS     string
+}
+
+func (c *AuthManagerConfig) init() {
+}
+
+func parseConfig(m map[string]interface{}) (*AuthManagerConfig, error) {
+	c := &AuthManagerConfig{}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	return c, nil
+}
+
+// New returns an auth manager implementation that verifies against a Nextcloud backend.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	c, err := parseConfig(m)
+	if err != nil {
+		return nil, err
+	}
+	c.init()
+
+	return NewAuthManager(c)
+}
+
+// NewAuthManager returns a new Nextcloud-based AuthManager
+func NewAuthManager(c *AuthManagerConfig) (*Manager, error) {
+	var client *http.Client
+	if c.MockHTTP {
+		// called := make([]string, 0)
+		// nextcloudServerMock := GetNextcloudServerMock(&called)
+		// client, _ = TestingHTTPClient(nextcloudServerMock)
+
+		// Wait for SetHTTPClient to be called later
+		client = nil
+	} else {
+		if len(c.EndPoint) == 0 {
+			return nil, errors.New("Please specify 'endpoint' in '[grpc.services.authprovider.auth_managers.nextcloud]'")
+		}
+		client = &http.Client{}
+	}
+
+	return &Manager{
+		endPoint:     c.EndPoint, // e.g. "http://nc/apps/sciencemesh/"
+		sharedSecret: c.SharedSecret,
+		client:       client,
+	}, nil
+}
+
+// Configure method as defined in https://github.com/cs3org/reva/blob/v1.13.0/pkg/auth/auth.go#L32-L35
+func (am *Manager) Configure(ml map[string]interface{}) error {
+	return nil
+}
+
+// SetHTTPClient sets the HTTP client
+func (am *Manager) SetHTTPClient(c *http.Client) {
+	am.client = c
+}
+
+func (am *Manager) do(ctx context.Context, a Action) (int, []byte, error) {
+	log := appctx.GetLogger(ctx)
+	url := am.endPoint + "~" + a.username + "/api/auth/" + a.verb
+	log.Info().Msgf("am.do %s %s %s", url, a.argS, am.sharedSecret)
+	req, err := http.NewRequest(http.MethodPost, url, strings.NewReader(a.argS))
+	if err != nil {
+		return 0, nil, err
+	}
+	req.Header.Set("X-Reva-Secret", am.sharedSecret)
+
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := am.client.Do(req)
+	if err != nil {
+		return 0, nil, err
+	}
+
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return 0, nil, err
+	}
+
+	log.Info().Msgf("am.do response %d %s", resp.StatusCode, body)
+	return resp.StatusCode, body, nil
+}
+
+// Authenticate method as defined in https://github.com/cs3org/reva/blob/28500a8/pkg/auth/auth.go#L31-L33
+func (am *Manager) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	type paramsObj struct {
+		ClientID     string `json:"clientID"`
+		ClientSecret string `json:"clientSecret"`
+		// Scope        authpb.Scope
+	}
+	bodyObj := &paramsObj{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		// Scope: authpb.Scope{
+		// 	Resource: &types.OpaqueEntry{
+		// 		Decoder: "json",
+		// 		Value:   []byte(`{"resource_id":{"storage_id":"storage-id","opaque_id":"opaque-id"},"path":"some/file/path.txt"}`),
+		// 	},
+		// 	Role: authpb.Role_ROLE_OWNER,
+		// },
+	}
+	bodyStr, err := json.Marshal(bodyObj)
+	if err != nil {
+		return nil, nil, err
+	}
+	log := appctx.GetLogger(ctx)
+	log.Info().Msgf("Authenticate %s %s", clientID, bodyStr)
+
+	statusCode, body, err := am.do(ctx, Action{"Authenticate", clientID, string(bodyStr)})
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if statusCode != 200 {
+		return nil, nil, errors.New("Username/password not recognized by Nextcloud backend")
+	}
+
+	type resultsObj struct {
+		User   user.User                `json:"user"`
+		Scopes map[string]*authpb.Scope `json:"scopes"`
+	}
+	result := &resultsObj{}
+	err = json.Unmarshal(body, &result)
+	if err != nil {
+		return nil, nil, err
+	}
+	var pointersMap = make(map[string]*authpb.Scope)
+	for k := range result.Scopes {
+		scope := result.Scopes[k]
+		pointersMap[k] = scope
+	}
+	return &result.User, pointersMap, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/nextcloud/nextcloud_server_mock.go

@@ -0,0 +1,99 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package nextcloud
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+)
+
+// Response contains data for the Nextcloud mock server to respond
+// and to switch to a new server state
+type Response struct {
+	code           int
+	body           string
+	newServerState string
+}
+
+const serverStateError = "ERROR"
+const serverStateEmpty = "EMPTY"
+const serverStateHome = "HOME"
+
+var serverState = serverStateEmpty
+
+var responses = map[string]Response{
+	`POST /apps/sciencemesh/~einstein/api/auth/Authenticate {"clientID":"einstein","clientSecret":"relativity"}`: {200, `{"user":{"id":{"idp":"some-idp","opaque_id":"some-opaque-user-id","type":1}},"scopes":{"user":{"resource":{"decoder":"json","value":"eyJyZXNvdXJjZV9pZCI6eyJzdG9yYWdlX2lkIjoic3RvcmFnZS1pZCIsIm9wYXF1ZV9pZCI6Im9wYXF1ZS1pZCJ9LCJwYXRoIjoic29tZS9maWxlL3BhdGgudHh0In0="},"role":1}}}`, serverStateHome},
+}
+
+// GetNextcloudServerMock returns a handler that pretends to be a remote Nextcloud server
+func GetNextcloudServerMock(called *[]string) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := new(strings.Builder)
+		_, err := io.Copy(buf, r.Body)
+		if err != nil {
+			panic("Error reading response into buffer")
+		}
+		var key = fmt.Sprintf("%s %s %s", r.Method, r.URL, buf.String())
+		*called = append(*called, key)
+		response := responses[key]
+		if (response == Response{}) {
+			key = fmt.Sprintf("%s %s %s %s", r.Method, r.URL, buf.String(), serverState)
+			response = responses[key]
+		}
+		if (response == Response{}) {
+			fmt.Printf("%s %s %s %s", r.Method, r.URL, buf.String(), serverState)
+			response = Response{500, fmt.Sprintf("response not defined! %s", key), serverStateEmpty}
+		}
+		serverState = responses[key].newServerState
+		if serverState == `` {
+			serverState = serverStateError
+		}
+		w.WriteHeader(response.code)
+		// w.Header().Set("Etag", "mocker-etag")
+		_, err = w.Write([]byte(responses[key].body))
+		if err != nil {
+			panic(err)
+		}
+	})
+}
+
+// TestingHTTPClient thanks to https://itnext.io/how-to-stub-requests-to-remote-hosts-with-go-6c2c1db32bf2
+// Ideally, this function would live in tests/helpers, but
+// if we put it there, it gets excluded by .dockerignore, and the
+// Docker build fails (see https://github.com/cs3org/reva/issues/1999)
+// So putting it here for now - open to suggestions if someone knows
+// a better way to inject this.
+func TestingHTTPClient(handler http.Handler) (*http.Client, func()) {
+	s := httptest.NewServer(handler)
+
+	cli := &http.Client{
+		Transport: &http.Transport{
+			DialContext: func(_ context.Context, network, _ string) (net.Conn, error) {
+				return net.Dial(network, s.Listener.Addr().String())
+			},
+		},
+	}
+
+	return cli, s.Close
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/ocmshares/ocmshares.go

@@ -0,0 +1,196 @@
+// Copyright 2018-2023 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package ocmshares
+
+import (
+	"context"
+
+	provider "github.com/cs3org/go-cs3apis/cs3/app/provider/v1beta1"
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	ocminvite "github.com/cs3org/go-cs3apis/cs3/ocm/invite/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	ocm "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
+	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"github.com/opencloud-eu/reva/v2/pkg/utils/cfg"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("ocmshares", New)
+}
+
+type manager struct {
+	c  *config
+	gw gateway.GatewayAPIClient
+}
+
+type config struct {
+	GatewayAddr string `mapstructure:"gatewaysvc"`
+}
+
+func (c *config) ApplyDefaults() {
+	c.GatewayAddr = sharedconf.GetGatewaySVC(c.GatewayAddr)
+}
+
+// New creates a new ocmshares authentication manager.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	var mgr manager
+	if err := mgr.Configure(m); err != nil {
+		return nil, err
+	}
+	gw, err := pool.GetGatewayServiceClient(mgr.c.GatewayAddr)
+	if err != nil {
+		return nil, err
+	}
+	mgr.gw = gw
+
+	return &mgr, nil
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	var c config
+	if err := cfg.Decode(ml, &c); err != nil {
+		return errors.Wrap(err, "ocmshares: error decoding config")
+	}
+	m.c = &c
+	return nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, ocmshare, sharedSecret string) (*userpb.User, map[string]*authpb.Scope, error) {
+	log := appctx.GetLogger(ctx).With().Str("ocmshare", ocmshare).Logger()
+	// We need to use GetOCMShareByToken, as GetOCMShare would require a user in the context
+	shareRes, err := m.gw.GetOCMShareByToken(ctx, &ocm.GetOCMShareByTokenRequest{
+		Token: sharedSecret,
+	})
+
+	switch {
+	case err != nil:
+		log.Error().Err(err).Msg("error getting ocm share by token")
+		return nil, nil, err
+	case shareRes.Status.Code == rpc.Code_CODE_NOT_FOUND:
+		log.Debug().Msg("ocm share not found")
+		return nil, nil, errtypes.NotFound(shareRes.Status.Message)
+	case shareRes.Status.Code == rpc.Code_CODE_PERMISSION_DENIED:
+		log.Debug().Msg("permission denied")
+		return nil, nil, errtypes.InvalidCredentials(shareRes.Status.Message)
+	case shareRes.Status.Code != rpc.Code_CODE_OK:
+		log.Error().Interface("status", shareRes.Status).Msg("got unexpected error in the grpc call to GetOCMShare")
+		return nil, nil, errtypes.InternalError(shareRes.Status.Message)
+	}
+
+	// compare ocm share id
+	if shareRes.GetShare().GetId().GetOpaqueId() != ocmshare {
+		log.Error().Str("persisted", ocmshare).Str("requested", shareRes.GetShare().GetId().GetOpaqueId()).Msg("mismatching ocm share id for existing secret")
+		return nil, nil, errtypes.InvalidCredentials("invalid shared secret")
+	}
+
+	// the user authenticated using the ocmshares authentication method
+	// is the recipient of the share
+	u := shareRes.Share.Grantee.GetUserId()
+
+	d, err := utils.MarshalProtoV1ToJSON(shareRes.GetShare().Creator)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	o := &types.Opaque{
+		Map: map[string]*types.OpaqueEntry{
+			"user-filter": {
+				Decoder: "json",
+				Value:   d,
+			},
+		},
+	}
+
+	userRes, err := m.gw.GetAcceptedUser(ctx, &ocminvite.GetAcceptedUserRequest{
+		RemoteUserId: u,
+		Opaque:       o,
+	})
+
+	switch {
+	case err != nil:
+		return nil, nil, err
+	case userRes.Status.Code == rpc.Code_CODE_NOT_FOUND:
+		return nil, nil, errtypes.NotFound(shareRes.Status.Message)
+	case userRes.Status.Code != rpc.Code_CODE_OK:
+		return nil, nil, errtypes.InternalError(userRes.Status.Message)
+	}
+
+	role, roleStr := getRole(shareRes.Share)
+
+	scope, err := scope.AddOCMShareScope(shareRes.Share, role, nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	user := userRes.RemoteUser
+	user.Opaque = &types.Opaque{
+		Map: map[string]*types.OpaqueEntry{
+			"ocm-share-role": {
+				Decoder: "plain",
+				Value:   []byte(roleStr),
+			},
+		},
+	}
+
+	user.Opaque = utils.AppendJSONToOpaque(user.Opaque, "impersonating-user", userRes.RemoteUser)
+
+	return user, scope, nil
+}
+
+func getRole(s *ocm.Share) (authpb.Role, string) {
+	// TODO: consider to somehow merge the permissions from all the access methods?
+	// it's not clear infact which should be the role when webdav is editor role while
+	// webapp is only view mode for example
+	// this implementation considers only the simple case in which when a client creates
+	// a share with multiple access methods, the permissions are matching in all of them.
+	for _, m := range s.AccessMethods {
+		switch v := m.Term.(type) {
+		case *ocm.AccessMethod_WebdavOptions:
+			p := v.WebdavOptions.Permissions
+			if p.InitiateFileUpload {
+				return authpb.Role_ROLE_EDITOR, "editor"
+			}
+			if p.InitiateFileDownload {
+				return authpb.Role_ROLE_VIEWER, "viewer"
+			}
+		case *ocm.AccessMethod_WebappOptions:
+			viewMode := v.WebappOptions.ViewMode
+			if viewMode == provider.ViewMode_VIEW_MODE_VIEW_ONLY ||
+				viewMode == provider.ViewMode_VIEW_MODE_READ_ONLY ||
+				viewMode == provider.ViewMode_VIEW_MODE_PREVIEW {
+				return authpb.Role_ROLE_VIEWER, "viewer"
+			}
+			if viewMode == provider.ViewMode_VIEW_MODE_READ_WRITE {
+				return authpb.Role_ROLE_EDITOR, "editor"
+			}
+		}
+	}
+	return authpb.Role_ROLE_INVALID, "invalid"
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/oidc/oidc.go

@@ -0,0 +1,363 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+// Package oidc  verifies an OIDC token against the configured OIDC provider
+// and obtains the necessary claims to obtain user information.
+package oidc
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	oidc "github.com/coreos/go-oidc/v3/oidc"
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	"github.com/juliangruber/go-intersect"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/rhttp"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
+	"github.com/pkg/errors"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	registry.Register("oidc", New)
+}
+
+type mgr struct {
+	provider         *oidc.Provider // cached on first request
+	c                *config
+	oidcUsersMapping map[string]*oidcUserMapping
+}
+
+type config struct {
+	Insecure     bool   `mapstructure:"insecure" docs:"false;Whether to skip certificate checks when sending requests."`
+	Issuer       string `mapstructure:"issuer" docs:";The issuer of the OIDC token."`
+	IDClaim      string `mapstructure:"id_claim" docs:"sub;The claim containing the ID of the user."`
+	UIDClaim     string `mapstructure:"uid_claim" docs:";The claim containing the UID of the user."`
+	GIDClaim     string `mapstructure:"gid_claim" docs:";The claim containing the GID of the user."`
+	GatewaySvc   string `mapstructure:"gatewaysvc" docs:";The endpoint at which the GRPC gateway is exposed."`
+	UsersMapping string `mapstructure:"users_mapping" docs:"; The optional OIDC users mapping file path"`
+	GroupClaim   string `mapstructure:"group_claim" docs:"; The group claim to be looked up to map the user (default to 'groups')."`
+}
+
+type oidcUserMapping struct {
+	OIDCIssuer string `mapstructure:"oidc_issuer" json:"oidc_issuer"`
+	OIDCGroup  string `mapstructure:"oidc_group" json:"oidc_group"`
+	Username   string `mapstructure:"username" json:"username"`
+}
+
+func (c *config) init() {
+	if c.IDClaim == "" {
+		// sub is stable and defined as unique. the user manager needs to take care of the sub to user metadata lookup
+		c.IDClaim = "sub"
+	}
+	if c.GroupClaim == "" {
+		c.GroupClaim = "groups"
+	}
+	if c.UIDClaim == "" {
+		c.UIDClaim = "uid"
+	}
+	if c.GIDClaim == "" {
+		c.GIDClaim = "gid"
+	}
+
+	c.GatewaySvc = sharedconf.GetGatewaySVC(c.GatewaySvc)
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	return c, nil
+}
+
+// New returns an auth manager implementation that verifies the oidc token and obtains the user claims.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	manager := &mgr{}
+	err := manager.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+	return manager, nil
+}
+
+func (am *mgr) Configure(m map[string]interface{}) error {
+	c, err := parseConfig(m)
+	if err != nil {
+		return err
+	}
+	c.init()
+	am.c = c
+
+	am.oidcUsersMapping = map[string]*oidcUserMapping{}
+	if c.UsersMapping == "" {
+		// no mapping defined, leave the map empty and move on
+		return nil
+	}
+
+	f, err := os.ReadFile(c.UsersMapping)
+	if err != nil {
+		return fmt.Errorf("oidc: error reading the users mapping file: +%v", err)
+	}
+	oidcUsers := []*oidcUserMapping{}
+	err = json.Unmarshal(f, &oidcUsers)
+	if err != nil {
+		return fmt.Errorf("oidc: error unmarshalling the users mapping file: +%v", err)
+	}
+	for _, u := range oidcUsers {
+		if _, found := am.oidcUsersMapping[u.OIDCGroup]; found {
+			return fmt.Errorf("oidc: mapping error, group \"%s\" is mapped to multiple users", u.OIDCGroup)
+		}
+		am.oidcUsersMapping[u.OIDCGroup] = u
+	}
+
+	return nil
+}
+
+// The clientID would be empty as we only need to validate the clientSecret variable
+// which contains the access token that we can use to contact the UserInfo endpoint
+// and get the user claims.
+func (am *mgr) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	ctx = am.getOAuthCtx(ctx)
+	log := appctx.GetLogger(ctx)
+
+	oidcProvider, err := am.getOIDCProvider(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("oidc: error creating oidc provider: +%v", err)
+	}
+
+	oauth2Token := &oauth2.Token{
+		AccessToken: clientSecret,
+	}
+
+	// query the oidc provider for user info
+	userInfo, err := oidcProvider.UserInfo(ctx, oauth2.StaticTokenSource(oauth2Token))
+	if err != nil {
+		return nil, nil, fmt.Errorf("oidc: error getting userinfo: +%v", err)
+	}
+
+	// claims contains the standard OIDC claims like iss, iat, aud, ... and any other non-standard one.
+	// TODO(labkode): make claims configuration dynamic from the config file so we can add arbitrary mappings from claims to user struct.
+	// For now, only the group claim is dynamic.
+	// TODO(labkode): may do like K8s does it: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go
+	var claims map[string]interface{}
+	if err := userInfo.Claims(&claims); err != nil {
+		return nil, nil, fmt.Errorf("oidc: error unmarshaling userinfo claims: %v", err)
+	}
+
+	log.Debug().Interface("claims", claims).Interface("userInfo", userInfo).Msg("unmarshalled userinfo")
+
+	if claims["iss"] == nil { // This is not set in simplesamlphp
+		claims["iss"] = am.c.Issuer
+	}
+	if claims["email_verified"] == nil { // This is not set in simplesamlphp
+		claims["email_verified"] = false
+	}
+	if claims["preferred_username"] == nil {
+		claims["preferred_username"] = claims[am.c.IDClaim]
+	}
+	if claims["preferred_username"] == nil {
+		claims["preferred_username"] = claims["email"]
+	}
+	if claims["name"] == nil {
+		claims["name"] = claims[am.c.IDClaim]
+	}
+	if claims["name"] == nil {
+		return nil, nil, fmt.Errorf("no \"name\" attribute found in userinfo: maybe the client did not request the oidc \"profile\"-scope")
+	}
+	if claims["email"] == nil {
+		return nil, nil, fmt.Errorf("no \"email\" attribute found in userinfo: maybe the client did not request the oidc \"email\"-scope")
+	}
+
+	uid, _ := claims[am.c.UIDClaim].(float64)
+	claims[am.c.UIDClaim] = int64(uid) // in case the uid claim is missing and a mapping is to be performed, resolveUser() will populate it
+	// Note that if not, will silently carry a user with 0 uid, potentially problematic with storage providers
+	gid, _ := claims[am.c.GIDClaim].(float64)
+	claims[am.c.GIDClaim] = int64(gid)
+
+	err = am.resolveUser(ctx, claims)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "oidc: error resolving username for external user '%v'", claims["email"])
+	}
+
+	userID := &user.UserId{
+		OpaqueId: claims[am.c.IDClaim].(string), // a stable non reassignable id
+		Idp:      claims["iss"].(string),        // in the scope of this issuer
+		Type:     getUserType(claims[am.c.IDClaim].(string)),
+	}
+
+	gwc, err := pool.GetGatewayServiceClient(am.c.GatewaySvc)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "oidc: error getting gateway grpc client")
+	}
+	getGroupsResp, err := gwc.GetUserGroups(ctx, &user.GetUserGroupsRequest{
+		UserId: userID,
+	})
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "oidc: error getting user groups for '%+v'", userID)
+	}
+	if getGroupsResp.Status.Code != rpc.Code_CODE_OK {
+		return nil, nil, status.NewErrorFromCode(getGroupsResp.Status.Code, "oidc")
+	}
+
+	u := &user.User{
+		Id:           userID,
+		Username:     claims["preferred_username"].(string),
+		Groups:       getGroupsResp.Groups,
+		Mail:         claims["email"].(string),
+		MailVerified: claims["email_verified"].(bool),
+		DisplayName:  claims["name"].(string),
+		UidNumber:    claims[am.c.UIDClaim].(int64),
+		GidNumber:    claims[am.c.GIDClaim].(int64),
+	}
+
+	var scopes map[string]*authpb.Scope
+	if userID != nil && (userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || userID.Type == user.UserType_USER_TYPE_FEDERATED) {
+		scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	} else {
+		scopes, err = scope.AddOwnerScope(nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	return u, scopes, nil
+}
+
+func (am *mgr) getOAuthCtx(ctx context.Context) context.Context {
+	// Sometimes for testing we need to skip the TLS check, that's why we need a
+	// custom HTTP client.
+	customHTTPClient := rhttp.GetHTTPClient(
+		rhttp.Context(ctx),
+		rhttp.Timeout(time.Second*10),
+		rhttp.Insecure(am.c.Insecure),
+		// Fixes connection fd leak which might be caused by provider-caching
+		rhttp.DisableKeepAlive(true),
+	)
+	ctx = context.WithValue(ctx, oauth2.HTTPClient, customHTTPClient)
+	return ctx
+}
+
+// getOIDCProvider returns a singleton OIDC provider
+func (am *mgr) getOIDCProvider(ctx context.Context) (*oidc.Provider, error) {
+	ctx = am.getOAuthCtx(ctx)
+	log := appctx.GetLogger(ctx)
+
+	if am.provider != nil {
+		return am.provider, nil
+	}
+
+	// Initialize a provider by specifying the issuer URL.
+	// Once initialized this is a singleton that is reused for further requests.
+	// The provider is responsible to verify the token sent by the client
+	// against the security keys oftentimes available in the .well-known endpoint.
+	provider, err := oidc.NewProvider(ctx, am.c.Issuer)
+
+	if err != nil {
+		log.Error().Err(err).Msg("oidc: error creating a new oidc provider")
+		return nil, fmt.Errorf("oidc: error creating a new oidc provider: %+v", err)
+	}
+
+	am.provider = provider
+	return am.provider, nil
+}
+
+func (am *mgr) resolveUser(ctx context.Context, claims map[string]interface{}) error {
+	if len(am.oidcUsersMapping) > 0 {
+		var username string
+
+		// map and discover the user's username when a mapping is defined
+		if claims[am.c.GroupClaim] == nil {
+			// we are required to perform a user mapping but the group claim is not available
+			return fmt.Errorf("no \"%s\" claim found in userinfo to map user", am.c.GroupClaim)
+		}
+		mappings := make([]string, 0, len(am.oidcUsersMapping))
+		for _, m := range am.oidcUsersMapping {
+			if m.OIDCIssuer == claims["iss"] {
+				mappings = append(mappings, m.OIDCGroup)
+			}
+		}
+
+		intersection := intersect.Simple(claims[am.c.GroupClaim], mappings)
+		if len(intersection) > 1 {
+			// multiple mappings are not implemented as we cannot decide which one to choose
+			return errtypes.PermissionDenied("more than one user mapping entry exists for the given group claims")
+		}
+		if len(intersection) == 0 {
+			return errtypes.PermissionDenied("no user mapping found for the given group claim(s)")
+		}
+		for _, m := range intersection {
+			username = am.oidcUsersMapping[m.(string)].Username
+		}
+
+		upsc, err := pool.GetUserProviderServiceClient(am.c.GatewaySvc)
+		if err != nil {
+			return errors.Wrap(err, "error getting user provider grpc client")
+		}
+		getUserByClaimResp, err := upsc.GetUserByClaim(ctx, &user.GetUserByClaimRequest{
+			Claim: "username",
+			Value: username,
+		})
+		if err != nil {
+			return errors.Wrapf(err, "error getting user by username '%v'", username)
+		}
+		if getUserByClaimResp.Status.Code != rpc.Code_CODE_OK {
+			return status.NewErrorFromCode(getUserByClaimResp.Status.Code, "oidc")
+		}
+
+		// take the properties of the mapped target user to override the claims
+		claims["preferred_username"] = username
+		claims[am.c.IDClaim] = getUserByClaimResp.GetUser().GetId().OpaqueId
+		claims["iss"] = getUserByClaimResp.GetUser().GetId().Idp
+		claims[am.c.UIDClaim] = getUserByClaimResp.GetUser().UidNumber
+		claims[am.c.GIDClaim] = getUserByClaimResp.GetUser().GidNumber
+		appctx.GetLogger(ctx).Debug().Str("username", username).Interface("claims", claims).Msg("resolveUser: claims overridden from mapped user")
+	}
+	return nil
+}
+
+func getUserType(upn string) user.UserType {
+	var t user.UserType
+	switch {
+	case strings.HasPrefix(upn, "guest"):
+		t = user.UserType_USER_TYPE_LIGHTWEIGHT
+	case strings.Contains(upn, "@"):
+		t = user.UserType_USER_TYPE_FEDERATED
+	default:
+		t = user.UserType_USER_TYPE_PRIMARY
+	}
+	return t
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/owncloudsql/accounts/accounts.go

@@ -0,0 +1,165 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package accounts
+
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"time"
+
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/pkg/errors"
+)
+
+// Accounts represents oc10-style Accounts
+type Accounts struct {
+	driver                                     string
+	db                                         *sql.DB
+	joinUsername, joinUUID, enableMedialSearch bool
+	selectSQL                                  string
+}
+
+// NewMysql returns a new accounts instance connecting to a MySQL database
+func NewMysql(dsn string, joinUsername, joinUUID, enableMedialSearch bool) (*Accounts, error) {
+	sqldb, err := sql.Open("mysql", dsn)
+	if err != nil {
+		return nil, errors.Wrap(err, "error connecting to the database")
+	}
+
+	// FIXME make configurable
+	sqldb.SetConnMaxLifetime(time.Minute * 3)
+	sqldb.SetConnMaxIdleTime(time.Second * 30)
+	sqldb.SetMaxOpenConns(100)
+	sqldb.SetMaxIdleConns(10)
+
+	err = sqldb.Ping()
+	if err != nil {
+		return nil, errors.Wrap(err, "error connecting to the database")
+	}
+
+	return New("mysql", sqldb, joinUsername, joinUUID, enableMedialSearch)
+}
+
+// New returns a new accounts instance connecting to the given sql.DB
+func New(driver string, sqldb *sql.DB, joinUsername, joinUUID, enableMedialSearch bool) (*Accounts, error) {
+
+	sel := "SELECT id, email, user_id, display_name, quota, last_login, backend, home, state, password"
+	from := `
+		FROM oc_accounts a
+		LEFT JOIN oc_users u
+			ON a.user_id=u.uid
+		`
+	if joinUsername {
+		sel += ", p.configvalue AS username"
+		from += `LEFT JOIN oc_preferences p
+						ON a.user_id=p.userid
+						AND p.appid='core'
+						AND p.configkey='username'`
+	} else {
+		// fallback to user_id as username
+		sel += ", user_id AS username"
+	}
+	if joinUUID {
+		sel += ", p2.configvalue AS ownclouduuid"
+		from += `LEFT JOIN oc_preferences p2
+						ON a.user_id=p2.userid
+						AND p2.appid='core'
+						AND p2.configkey='ownclouduuid'`
+	} else {
+		// fallback to user_id as ownclouduuid
+		sel += ", user_id AS ownclouduuid"
+	}
+
+	return &Accounts{
+		driver:             driver,
+		db:                 sqldb,
+		joinUsername:       joinUsername,
+		joinUUID:           joinUUID,
+		enableMedialSearch: enableMedialSearch,
+		selectSQL:          sel + from,
+	}, nil
+}
+
+// Account stores information about accounts.
+type Account struct {
+	ID           uint64
+	Email        sql.NullString
+	UserID       string
+	DisplayName  sql.NullString
+	Quota        sql.NullString
+	LastLogin    int
+	Backend      string
+	Home         string
+	State        int8
+	PasswordHash string         // from oc_users
+	Username     sql.NullString // optional comes from the oc_preferences
+	OwnCloudUUID sql.NullString // optional comes from the oc_preferences
+}
+
+func (as *Accounts) rowToAccount(ctx context.Context, row Scannable) (*Account, error) {
+	a := Account{}
+	if err := row.Scan(&a.ID, &a.Email, &a.UserID, &a.DisplayName, &a.Quota, &a.LastLogin, &a.Backend, &a.Home, &a.State, &a.PasswordHash, &a.Username, &a.OwnCloudUUID); err != nil {
+		appctx.GetLogger(ctx).Error().Err(err).Msg("could not scan row, skipping")
+		return nil, err
+	}
+
+	return &a, nil
+}
+
+// Scannable describes the interface providing a Scan method
+type Scannable interface {
+	Scan(...interface{}) error
+}
+
+// GetAccountByLogin fetches an account by mail or username
+func (as *Accounts) GetAccountByLogin(ctx context.Context, login string) (*Account, error) {
+	var row *sql.Row
+	username := strings.ToLower(login) // usernames are lowercased in owncloud classic
+	if as.joinUsername {
+		row = as.db.QueryRowContext(ctx, as.selectSQL+" WHERE a.email=? OR a.lower_user_id=? OR p.configvalue=?", login, username, login)
+	} else {
+		row = as.db.QueryRowContext(ctx, as.selectSQL+" WHERE a.email=? OR a.lower_user_id=?", login, username)
+	}
+
+	return as.rowToAccount(ctx, row)
+}
+
+// GetAccountGroups reads the groups for an account
+func (as *Accounts) GetAccountGroups(ctx context.Context, uid string) ([]string, error) {
+	rows, err := as.db.QueryContext(ctx, "SELECT gid FROM oc_group_user WHERE uid=?", uid)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var group string
+	groups := []string{}
+	for rows.Next() {
+		if err := rows.Scan(&group); err != nil {
+			appctx.GetLogger(ctx).Error().Err(err).Msg("could not scan row, skipping")
+			continue
+		}
+		groups = append(groups, group)
+	}
+	if err = rows.Err(); err != nil {
+		return nil, err
+	}
+	return groups, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/owncloudsql/owncloudsql.go

@@ -0,0 +1,192 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package owncloudsql
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/owncloudsql/accounts"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/pkg/errors"
+
+	// Provides mysql drivers
+	_ "github.com/go-sql-driver/mysql"
+)
+
+func init() {
+	registry.Register("owncloudsql", NewMysql)
+}
+
+type manager struct {
+	c  *config
+	db *accounts.Accounts
+}
+
+type config struct {
+	DbUsername       string `mapstructure:"dbusername"`
+	DbPassword       string `mapstructure:"dbpassword"`
+	DbHost           string `mapstructure:"dbhost"`
+	DbPort           int    `mapstructure:"dbport"`
+	DbName           string `mapstructure:"dbname"`
+	Idp              string `mapstructure:"idp"`
+	Nobody           int64  `mapstructure:"nobody"`
+	LegacySalt       string `mapstructure:"legacy_salt"`
+	JoinUsername     bool   `mapstructure:"join_username"`
+	JoinOwnCloudUUID bool   `mapstructure:"join_ownclouduuid"`
+}
+
+// NewMysql returns a new auth manager connection to an owncloud mysql database
+func NewMysql(m map[string]interface{}) (auth.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	if err != nil {
+		err = errors.Wrap(err, "error creating a new auth manager")
+		return nil, err
+	}
+
+	mgr.db, err = accounts.NewMysql(
+		fmt.Sprintf("%s:%s@tcp(%s:%d)/%s", mgr.c.DbUsername, mgr.c.DbPassword, mgr.c.DbHost, mgr.c.DbPort, mgr.c.DbName),
+		mgr.c.JoinUsername,
+		mgr.c.JoinOwnCloudUUID,
+		false,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return mgr, nil
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	c, err := parseConfig(ml)
+	if err != nil {
+		return err
+	}
+
+	if c.Nobody == 0 {
+		c.Nobody = 99
+	}
+
+	m.c = c
+	return nil
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{}
+	if err := mapstructure.Decode(m, &c); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, login, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
+	log := appctx.GetLogger(ctx)
+
+	// 1. find user by login
+
+	account, err := m.db.GetAccountByLogin(ctx, login)
+	if err != nil {
+		return nil, nil, errtypes.NotFound(login)
+	}
+	// 2. verify the user password
+	if !m.verify(clientSecret, account.PasswordHash) {
+		return nil, nil, errtypes.InvalidCredentials(login)
+	}
+
+	userID := &user.UserId{
+		Idp:      m.c.Idp,
+		OpaqueId: account.OwnCloudUUID.String,
+		Type:     user.UserType_USER_TYPE_PRIMARY, // TODO: assign the appropriate user type for guest accounts
+	}
+
+	u := &user.User{
+		Id: userID,
+		// TODO add more claims from the StandardClaims, eg EmailVerified and lastlogin
+		Username:    account.Username.String,
+		Mail:        account.Email.String,
+		DisplayName: account.DisplayName.String,
+		//UidNumber:   uidNumber,
+		//GidNumber:   gidNumber,
+	}
+
+	if u.Groups, err = m.db.GetAccountGroups(ctx, account.UserID); err != nil {
+		return nil, nil, err
+	}
+
+	var scopes map[string]*authpb.Scope
+	if userID != nil && (userID.Type == user.UserType_USER_TYPE_LIGHTWEIGHT || userID.Type == user.UserType_USER_TYPE_FEDERATED) {
+		scopes, err = scope.AddLightweightAccountScope(authpb.Role_ROLE_OWNER, nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	} else {
+		scopes, err = scope.AddOwnerScope(nil)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	// do not log password hash
+	account.PasswordHash = "***redacted***"
+	log.Debug().Interface("account", account).Interface("user", u).Msg("authenticated user")
+
+	return u, scopes, nil
+}
+
+func (m *manager) verify(password, hash string) bool {
+	splitHash := strings.SplitN(hash, "|", 2)
+	switch len(splitHash) {
+	case 2:
+		if splitHash[0] == "1" {
+			return m.verifyHashV1(password, splitHash[1])
+		}
+	case 1:
+		return m.legacyHashVerify(password, hash)
+	}
+	return false
+}
+
+func (m *manager) legacyHashVerify(password, hash string) bool {
+	// TODO rehash $newHash = $this->hash($message);
+	switch len(hash) {
+	case 60: // legacy PHPass hash
+		return nil == bcrypt.CompareHashAndPassword([]byte(hash), []byte(password+m.c.LegacySalt))
+	case 40: // legacy sha1 hash
+		h := sha1.Sum([]byte(password))
+		return hmac.Equal([]byte(hash), []byte(hex.EncodeToString(h[:])))
+	}
+	return false
+}
+func (m *manager) verifyHashV1(password, hash string) bool {
+	// TODO implement password_needs_rehash
+	return nil == bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/publicshares/publicshares.go

@@ -0,0 +1,183 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package publicshares
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1"
+	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("publicshares", New)
+}
+
+type manager struct {
+	c *config
+}
+
+type config struct {
+	GatewayAddr string `mapstructure:"gateway_addr"`
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	return c, nil
+}
+
+// New returns a new auth Manager.
+func New(m map[string]interface{}) (auth.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+	return mgr, nil
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	conf, err := parseConfig(ml)
+	if err != nil {
+		return err
+	}
+	m.c = conf
+	return nil
+}
+
+func (m *manager) Authenticate(ctx context.Context, token, secret string) (*user.User, map[string]*authpb.Scope, error) {
+	gwConn, err := pool.GetGatewayServiceClient(m.c.GatewayAddr)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var auth *link.PublicShareAuthentication
+	if strings.HasPrefix(secret, "password|") {
+		secret = strings.TrimPrefix(secret, "password|")
+		auth = &link.PublicShareAuthentication{
+			Spec: &link.PublicShareAuthentication_Password{
+				Password: secret,
+			},
+		}
+	} else if strings.HasPrefix(secret, "signature|") {
+		secret = strings.TrimPrefix(secret, "signature|")
+		parts := strings.Split(secret, "|")
+		sig, expiration := parts[0], parts[1]
+		exp, _ := time.Parse(time.RFC3339, expiration)
+
+		auth = &link.PublicShareAuthentication{
+			Spec: &link.PublicShareAuthentication_Signature{
+				Signature: &link.ShareSignature{
+					Signature: sig,
+					SignatureExpiration: &types.Timestamp{
+						Seconds: uint64(exp.UnixNano() / 1000000000),
+						Nanos:   uint32(exp.UnixNano() % 1000000000),
+					},
+				},
+			},
+		}
+	}
+
+	publicShareResponse, err := gwConn.GetPublicShareByToken(ctx, &link.GetPublicShareByTokenRequest{
+		Token:          token,
+		Authentication: auth,
+		Sign:           true,
+	})
+	switch {
+	case err != nil:
+		return nil, nil, err
+	case publicShareResponse.Status.Code == rpcv1beta1.Code_CODE_NOT_FOUND:
+		return nil, nil, errtypes.NotFound(publicShareResponse.Status.Message)
+	case publicShareResponse.Status.Code == rpcv1beta1.Code_CODE_PERMISSION_DENIED:
+		return nil, nil, errtypes.InvalidCredentials(publicShareResponse.Status.Message)
+	case publicShareResponse.Status.Code != rpcv1beta1.Code_CODE_OK:
+		return nil, nil, errtypes.InternalError(publicShareResponse.Status.Message)
+	}
+
+	var owner *user.User
+	// FIXME use new user type SPACE_OWNER
+	if publicShareResponse.GetShare().GetOwner().GetType() == 8 {
+		owner = &user.User{Id: publicShareResponse.GetShare().GetOwner(), DisplayName: "Public", Username: "public"}
+	} else {
+		getUserResponse, err := gwConn.GetUser(ctx, &user.GetUserRequest{
+			UserId: publicShareResponse.GetShare().GetCreator(),
+		})
+		switch {
+		case err != nil:
+			return nil, nil, err
+		case getUserResponse.GetStatus().GetCode() == rpcv1beta1.Code_CODE_NOT_FOUND:
+			return nil, nil, errtypes.NotFound(getUserResponse.GetStatus().GetMessage())
+		case getUserResponse.GetStatus().GetCode() == rpcv1beta1.Code_CODE_PERMISSION_DENIED:
+			return nil, nil, errtypes.InvalidCredentials(getUserResponse.GetStatus().GetMessage())
+		case getUserResponse.GetStatus().GetCode() != rpcv1beta1.Code_CODE_OK:
+			return nil, nil, errtypes.InternalError(getUserResponse.GetStatus().GetMessage())
+		}
+		owner = getUserResponse.GetUser()
+	}
+
+	share := publicShareResponse.GetShare()
+	role := authpb.Role_ROLE_VIEWER
+	roleStr := "viewer"
+	if share.Permissions.Permissions.InitiateFileUpload && !share.Permissions.Permissions.InitiateFileDownload {
+		role = authpb.Role_ROLE_UPLOADER
+		roleStr = "uploader"
+	} else if share.Permissions.Permissions.InitiateFileUpload {
+		role = authpb.Role_ROLE_EDITOR
+		roleStr = "editor"
+	}
+
+	scope, err := scope.AddPublicShareScope(share, role, nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	owner.Opaque = &types.Opaque{
+		Map: map[string]*types.OpaqueEntry{
+			"public-share-role": {
+				Decoder: "plain",
+				Value:   []byte(roleStr),
+			},
+		},
+	}
+
+	u := &user.User{Id: &user.UserId{OpaqueId: token, Idp: "public", Type: user.UserType_USER_TYPE_GUEST}, DisplayName: "Public", Username: "public"}
+	owner.Opaque = utils.AppendJSONToOpaque(owner.Opaque, "impersonating-user", u)
+
+	return owner, scope, nil
+}
+
+// ErrPasswordNotProvided is returned when the public share is password protected, but there was no password on the request
+var ErrPasswordNotProvided = errors.New("public share is password protected, but password was not provided")

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry/registry.go

@@ -0,0 +1,36 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package registry
+
+import (
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+)
+
+// NewFunc is the function that auth implementations
+// should register to at init time.
+type NewFunc func(map[string]interface{}) (auth.Manager, error)
+
+// NewFuncs is a map containing all the registered auth managers.
+var NewFuncs = map[string]NewFunc{}
+
+// Register registers a new auth manager new function.
+// Not safe for concurrent use. Safe for use from package init.
+func Register(name string, f NewFunc) {
+	NewFuncs[name] = f
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/auth/manager/serviceaccounts/serviceaccounts.go

@@ -0,0 +1,90 @@
+package serviceaccounts
+
+import (
+	"context"
+
+	authpb "github.com/cs3org/go-cs3apis/cs3/auth/provider/v1beta1"
+	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/auth"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/auth/scope"
+	"github.com/pkg/errors"
+)
+
+type conf struct {
+	ServiceUsers []serviceuser `mapstructure:"service_accounts"`
+}
+
+type serviceuser struct {
+	ID     string `mapstructure:"id"`
+	Secret string `mapstructure:"secret"`
+}
+
+type manager struct {
+	authenticate func(userID, secret string) error
+}
+
+func init() {
+	registry.Register("serviceaccounts", New)
+}
+
+// Configure parses the map conf
+func (m *manager) Configure(config map[string]interface{}) error {
+	c := &conf{}
+	if err := mapstructure.Decode(config, c); err != nil {
+		return errors.Wrap(err, "error decoding conf")
+	}
+	// only inmem authenticator for now
+	a := &inmemAuthenticator{make(map[string]string)}
+	for _, s := range c.ServiceUsers {
+		a.m[s.ID] = s.Secret
+	}
+	m.authenticate = a.Authenticate
+	return nil
+}
+
+// New creates a new manager for the 'service' authentication
+func New(conf map[string]interface{}) (auth.Manager, error) {
+	m := &manager{}
+	err := m.Configure(conf)
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+// Authenticate authenticates the service account
+func (m *manager) Authenticate(ctx context.Context, userID string, secret string) (*userpb.User, map[string]*authpb.Scope, error) {
+	if err := m.authenticate(userID, secret); err != nil {
+		return nil, nil, err
+	}
+	scope, err := scope.AddOwnerScope(nil)
+	if err != nil {
+		return nil, nil, err
+	}
+	return &userpb.User{
+		// TODO: more details for service users?
+		Id: &userpb.UserId{
+			OpaqueId: userID,
+			Type:     userpb.UserType_USER_TYPE_SERVICE,
+			Idp:      "none",
+		},
+	}, scope, nil
+}
+
+type inmemAuthenticator struct {
+	m map[string]string
+}
+
+func (a *inmemAuthenticator) Authenticate(userID string, secret string) error {
+	if secret == "" || a.m[userID] == "" {
+		return errors.New("unknown user")
+	}
+	if a.m[userID] == secret {
+		return nil
+	}
+	return errors.New("secrets do not match")
+}