Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

O365 IMAP Auth end of life 2022-10-01

Aperta
  • Qualcosa non va?
#205 5 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Ferma
Ambito
authentication

Direzione di ricerca

Start by tracing the IMAP authentication path in user_external and review the linked Microsoft Exchange guidance on basic-authentication deprecation. Define a supported replacement for O365 authentication and migration expectations; done means affected users can authenticate after basic authentication is disabled without relying on manual SQL changes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

0. Needs triage bug

IMAP Authentication in user_external uses basic authentication.

As of October 1, 2022 Microsoft will begin disabling basic authentication in Exchange365.

(There is information in the Microsoft link above describing how you can opt out of having Microsoft disable IMAP basic authentication for your tenant.)

Normally it is not possible to set a password in /settings/users for accounts authenticating through user_external. However, if you manually create an entry in oc_users with a uid that matches an entry in oc_users_external, it becomes possible to set a local nextcloud password.

My plan at the moment is to move my existing users from IMAP auth to internal Nextcloud Auth, then require twofactor_email for the migrated users.

The code snippet below works on my system to create entries in oc_users with matching uid values from oc_users_external.

My database settings from config.php:

  'dbtype' => 'pgsql',
  'dbname' => 'nextcloud',
  'dbtableprefix' => 'oc_',

  1. Connect to the sql database

    sudo -u postgres psql -t -d nextcloud

  2. Manually create an entry in 'oc_users' using the same value for uid and displayname used in oc_users_external:

    insert into oc_users(uid,displayname,uid_lower)
select uid, displayname,lower(uid) from  oc_users_external where uid like '<uid-from-oc_users_external>';

  3. Once there is an entry in "oc_users" with a uid that matches an entry in oc_users_external, the user's password can be set in /settings/users

  4. The User now sees the same files & shares if logging in using the original IMAP password or the new locally set password

  5. Requring two factor auth using twofactor_email ensures that security remains tied to the user's email

There is some fine-tuning that could be applied to this procedure:

  • All accounts could be migrated (remove the "where..." clause)
  • All accounts could have a pre-defined password applied
    • Create a bogus user
    • Set the password for the bogus user
    • Get the encrypted password info from oc_users for the bogus user
    • Add the encrypted password to the sql 'insert' command

This code snippet sets the selected user's local password to "badPassword" -

insert into oc_users(uid,displayname,uid_lower,password)
select 
  uid, 
  displayname,
  lower(uid),
  '3|$argon2id$v=19$m=65536,t=4,p=1$aWZKcTZsV08yczguSHlNWA$3Tdbsc4hVuiM4o6zLtsR1xxhL9T27HzE2cM1umYl7nI' 
from  oc_users_external where uid like '<uid-from-oc_users_external>';
Lingua principale
JavaScript
Stelle
121
Fork
73
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/user_external

Tutte le issue di nextcloud/user_external

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.