search

nextcloud / user_external

👥 External user authentication methods like IMAP, SMB and FTP
https://apps.nextcloud.com/apps/user_external
108 stars 64 forks source link

External password to prevail and re/set local password #253

Open narcisgarcia opened 4 months ago

narcisgarcia commented 4 months ago

On this scenario from same Internet origin:

  1. External (DAV) login is made authenticating with IMAP account. Account is automatically created.
  2. User signs in web interface later. Changes its Nextcloud password.
  3. External (DAV) login is made later authenticating with IMAP. After some tries sign in is accepted (this takes a while).
  4. Web login page says "We have detected multiple invalid login attempts from your IP. Therefore your next login is throttled up to 30 seconds."

"External user authentication" is enabled by site administrator to trust external accounts as master directory of this sort of users. This necessarily implies external password (when verified) prevails over any local one. Then on any difference between user's specified password (when verified) and Nextcloud stored password, external verified one should prevail as the master/trusted one, and this should imply to re/set local (Nextcloud) password with this authenticated one.

In the meanwhile, DAV clients become slow to synchronize because need to retry several times the login.

narcisgarcia commented 4 months ago

Now I've realized a simpler scenario where Nextcloud could log authentication failures and require DAV client to retry: When external user changes password on external directory (eg. IMAP server), and later configures a new DAV client.

As some DAV client can have old password stored, I understand that if local authentication succeeds, then no external authentication must be checked. Only when local one fails external user could apply new password.