0.4.4 test run

[jnweiger]

Test Run Document

References:

• https://github.com/owncloud/oauth2/wiki/OAuth-code-Flow-Sequence-Diagram
• Test plan: 0.4.4 Testplan #257
• Test suites:
  • https://github.com/owncloud/QA/blob/master/Server/Test_Plan_OAuth2.md
  • TODO: Test plan for openIDConnect
• Release ticket: oauth2 0.4.4 #256
• Automated tests
  • oauth2 Acceptance tests https://drone.owncloud.com/owncloud/oauth2/1020/10/1
  • openidconnect (only unit tests) https://github.com/owncloud/openidconnect/tree/master/tests
• openidconnect playground: https://github.com/owncloud-docker/compose-playground/tree/master/kopano/konnect

Versions used:

• https://github.com/owncloud/oauth2/releases/download/v0.4.4RC1/oauth2-0.4.4RC1.tar.gz
• https://github.com/owncloud/openidconnect/releases/download/v0.2.0/openidconnect-0.2.0.tar.gz
• https://download.owncloud.org/community/owncloud-10.4.0.tar.bz2

OAuth2 app Test Plan

This aims to be a client-agnostic testplan for the OAuth2 application, centered in the actions available in the webUI and/or occ commands and their impact on ownCloud's core behavior. To test the application from a client standpoint see:

• Desktop Sync client: OAuth2 Desktop Client's integration testplan QA#473
• Mobile client: OAuth2 QA#474

Testing functionality

Test Case	Expected Result	Result	Related Comment
CLI commands
Enable OAuth2 app via CLI using occ app:enable oauth2	- The apps gets enabled - Replies from the WebDAV endpoint includes a new WWW-Authenticate: Bearer... header	✔️

• Step 1) enable, logout, login admin, admin check personal -> security
  no applications authorized.
• Step 2) logged out. expect:
  
  curl -I http://$SERER/remote.php/webdav | grep -i www-auth
  
  www-authendicate: bearer

Disable OAuth2 app via CLI using occ app:disable oauth2	- The apps gets disabled - Previously mentioned header goes away in further requests	✔️ :

• curl -I http://$SERER/remote.php/webdav | grep -i www-auth
  
  www-authenticate: basic ...

Registered Clients
Default clients	The default Registered clients are included among the "Settings > Admin > User Authentication" OAuth 2.0: Registered Clients	✔️	See #38 for the default values
Register new Client	64-character-length client_id and client_secret are generated together with a (required) Client Name and a (required) Redirection URL	🚧	the name is not optional ->owncloud/QA#646
Remove a Client	- Confirmation dialog is prompted before removal - All client sessions opened from those clients get removed	⛔	is removed without confirmation dialog
Unregistered Clients
Authentication flow from an unregistered client	Unsuccessful Authorization Request	⚙️	Browser displays the "Request not valid" screen.
Steps: 1. enter URL at desktop client, hit next. 2 client redirects to browser, change client_id in url to something different. Hit enter again.
Authorized Applications
Login with a Registered Client	The Client Name is displayed amongst the "Personal > Security" OAuth 2.0 Authorized Applications	⚙️
Session Revocation (i.e. delete Authorized Application)	All the sessions opened in the clients are revoked and must be re-authorized	⚙️
User Account Handling
Password change	Open sessions are revoked and new credentials must be used in further login attempts	✔️	Improvement suggestion: desktop client 2.6.1 only displays a 'cannot find folder message' when re-auth is required.
Authorization Flow
Successful Authorization Request without any session open in the browser	Login form with an additional informative note about the application requesting access to ownCloud is displayed	⚙️
Successful Authorization Request with a valid session in the browser	The "Authorize" screen is displayed	⚙️
Successful Authorization Request in a browser with a different user logged in	The "Switch User" screen is displayed, allowing to modify the current session	⚙️	See use of the additional user parameter in: #67
Failed attempt in the authorization login form	The query parameters for the Authorization Request are preserved in next attempts	⚙️	See original issue in: owncloud/core#28129
Relevant Smoke Tests
Unauthenticated Actions: Public File Drop	Files get uploaded normally	🚧	See #100

openidconnect app Test Plan

TODO

[jnweiger]

Test setup for running an oauth release candidate version together with openidconnect:

git clone https://github.com/owncloud-docker/compose-playground
cd compose-playground
mkdir apps
cd apps
curl -L https://github.com/owncloud/oauth2/releases/download/v0.4.4RC1/oauth2-0.4.4RC1.tar.gz | tar xzf -
cd ..

export KOPANO_KONNECT_DOMAIN=konnect.docker-playground.local
export OWNCLOUD_DOMAIN=owncloud.docker-playground.local
export OWNCLOUD_HTTP_PORT=9680
export OWNCLOUD_APPS_ENABLE="openidconnect,oauth2"

docker-compose \
    -f owncloud-base.yml \
    -f owncloud-official.yml \
    -f owncloud-exported-ports.yml \
    -f owncloud-mount-apps.yml \
    -f cache/redis.yml \
    -f database/mariadb.yml \
    -f ldap/openldap.yml \
    -f ldap/openldap-mount-ldif.yml \
    -f ldap/openldap-autoconfig-base.yml \
    -f kopano/konnect/docker-compose.yml \
    up

Issues with this setup:

• Some issues in kopano-konnect set up owncloud-docker/compose-playground#6
• Update README.md owncloud-docker/compose-playground#15

[jnweiger]

The login screen should offer kopano as an Alternative login, as e.g. seen on
https://oidc-workshop.owncloud-demo.com/oc10/login

[jnweiger]

Structure visualization from the above compose

[davitol]

The login screen should offer kopano as an Alternative login, as e.g. seen on
https://oidc-workshop.owncloud-demo.com/oc10/login

I guess this configuration should be done in config.php file in the line:

https://github.com/owncloud/core/blob/master/config/config.sample.php#L247

[davitol]

Having a oC 10.4.1 server, trying to test oauth2 0.4.4 and openideconnect having both enable using https://owncloud.github.io/ocis/bridge/#how-to-do-it.

When I run this step: https://owncloud.github.io/ocis/bridge/#check-it-is-up-and-running

ldapsearch -x -H ldap://XXXXXX:9125 -b dc=example,dc=com -D "cn=admin,dc=example,dc=com" -W '(objectclass=posixaccount)'
Enter LDAP Password:
ldap_bind: Invalid credentials (49)

the credentials i am trying are the ones from the oC user admin/admin

glauth is configured to use owncloud as a backend. It was launched like this:

bin/ocis-glauth --log-level debug server --backend-server https://myowncloudserver.com --backend-basedn dc=example,dc=com

graphapi: 0.0.1 app is installed and enabled

curl https://cloud.example.com/apps/graphapi/v1.0/users/admin -u admin:admin -v works and returns 200 OK .

[davitol]

This comment #262 (comment) was solved in owncloud/ocis#248