Skip to content
This repository has been archived by the owner on Feb 20, 2019. It is now read-only.

Document the Password-based Mechanisms Known Limitations #4283

Merged
merged 3 commits into from
Jul 20, 2018
Merged

Document the Password-based Mechanisms Known Limitations #4283

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bda65b0
Document the Password-based Mechanisms Known Limitations
settermjd Jul 13, 2018
099ce14
Minor corrections and updates following feedback
settermjd Jul 20, 2018
f4877cf
Minor amendments to incorporate further feedback.
settermjd Jul 20, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions admin_manual/configuration/files/external_storage/auth_mechanisms.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,21 @@ does not work.
(See :doc:`../../server/background_jobs_configuration`.) Be
aware that the Ajax cron mode is triggered by browsing the ownCloud Web GUI.

Known Limitations
~~~~~~~~~~~~~~~~~

Please be aware that because of the way that credentials are stored in ownCloud, any operations must be performed by the logged-in mount owner, because credentials are not stored anywhere.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about: are stored in ownCloud --> are stored in ownCloud community version

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: is this at least true for personal shared mounts. Is it also true for admin shared mounts or is it the same?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this sentence sounds contradictory because first it talks about "the way that credentials are stored" then later it says "not stored anywhere"

the limitation exists for both admin and personal mounts where both have the "log-in credentials, save in session" option

As a result, there are three known limitations.
These are:

#. Directly sharing the storage or any its sub-folders will fail. They will not appear to the recipient, because the mount cannot be set up due to missing credentials.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or any of its...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you clarify further?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just adding the word "of"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this affect federation?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@PVince81, @phil-davis can you clarify?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have not tried this directly myself, so not confident to advise words related to "local" and ""federated" sharing.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sharing action doesn't fail. It will go through but the recipient will not see mounted.

Federated sharing is affected as well because it works on "public link share token" basis (or something similar) which itself doesn't contain the user's storage password, so the storage cannot be mounted either.

I've raised owncloud/core#32110 to hide the sharing option completely in the ext storage settings as it cannot work in such scenarios.

#. Any background task operating on the storage, such as background scanning.
#. Any :doc:`occ command <../configuration/server/occ_command>` that operates on the storage like occ files:scan will fail.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does fail mean that there will be a error message or does it just not do it without notifying the user.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. @PVince81, can you clarify?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On quick scan, the best that I can make out is that an exception will be thrown, dumping a stacktrace to the console.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@PVince81, @phil-davis can you clarify?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know and don't have a quick setup to try this out right now. How about changing to "will have no effect" which could mean any of "fail", "show an error" or "do nothing"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have not tried this directly myself, so not confident to advise!


.. note:: **Enterprise Users Only**

The enterprise version has a mode called "Save in DB" where the credentials are saved, encrypted, in the database (via :doc:`the WND app <../../../enterprise/external_storage/windows-network-drive_configuration>`). In this mode, all of the above operations can work.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can work or will work ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

credentials are saved, encrypted, --> credentials are encrypted saved

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-> credentials are saved in encrypted form

the latter sound a bit German 😉

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you are right... 🙈
Thanks for reviewing it


Public-key Mechanisms
---------------------

Expand All @@ -63,3 +78,7 @@ perform an authentication request, establishing the storage connection.
:alt: Dropbox storage mount configuration.

If ownCloud client’s are unable to connect to your ownCloud server, check that the bearer authorization header :ref:`is not being stripped out <bearer_auth_header_problem_label>`.

.. Links

.. _occ command: