Implement bearer auth for accessing shares, both incomming and outgoing

[mickenordin]

[mickenordin]

This is something I just tried, but does not work:

diff --git a/apps/files_sharing/lib/External/Storage.php b/apps/files_sharing/lib/External/Storage.php
index a9781b91a6c..509b23f68b4 100644
--- a/apps/files_sharing/lib/External/Storage.php
+++ b/apps/files_sharing/lib/External/Storage.php
@@ -238,6 +238,7 @@ class Storage extends DAV implements ISharedStorage, IDisableEncryptionStorage,
 		try {
 			return $this->testRemoteUrl($this->getRemote() . '/ocm-provider/index.php')
 				   || $this->testRemoteUrl($this->getRemote() . '/ocm-provider/')
+				   || $this->testRemoteUrl($this->getRemote() . '/.well-known/ocm')
 				   || $this->testRemoteUrl($this->getRemote() . '/status.php');
 		} catch (\Exception $e) {
 			return false;
diff --git a/lib/base.php b/lib/base.php
index b890cdb6dd7..626ab3a4ef6 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -1181,6 +1181,9 @@ class OC {
 		if ($userSession->tryBasicAuthLogin($request, Server::get(IThrottler::class))) {
 			return true;
 		}
+		if ($userSession->tryBearerAuthLogin($request, Server::get(IThrottler::class))) {
+			return true;
+		}
 		return false;
 	}
 
diff --git a/lib/private/Federation/CloudFederationProviderManager.php b/lib/private/Federation/CloudFederationProviderManager.php
index 81b5d717a56..51317f6d98c 100644
--- a/lib/private/Federation/CloudFederationProviderManager.php
+++ b/lib/private/Federation/CloudFederationProviderManager.php
@@ -12,6 +12,7 @@ use NCU\Security\Signature\ISignatureManager;
 use OC\AppFramework\Http;
 use OC\OCM\OCMSignatoryManager;
 use OCP\App\IAppManager;
+use OCP\AppFramework\Http\Response as AppResponse;
 use OCP\Federation\Exceptions\ProviderDoesNotExistsException;
 use OCP\Federation\ICloudFederationNotification;
 use OCP\Federation\ICloudFederationProvider;
@@ -185,13 +186,13 @@ class CloudFederationProviderManager implements ICloudFederationProviderManager
 		try {
 			return $this->postOcmPayload($url, '/notifications', json_encode($notification->getMessage()), $client);
 		} catch (\Throwable $e) {
-			$this->logger->error('Error while sending notification to federation server: ' . $e->getMessage(), ['exception' => $e]);
 			try {
 				return $client->getResponseFromThrowable($e);
 			} catch (\Throwable $e) {
-				throw new OCMProviderException($e->getMessage(), $e->getCode(), $e);
+				$this->logger->error('Error while sending notification to federation server: ' . $e->getMessage(), ['exception' => $e]);
 			}
 		}
+		return new AppResponse();
 	}
 
 	/**
diff --git a/lib/private/Files/Storage/DAV.php b/lib/private/Files/Storage/DAV.php
index 2d166b5438d..df288c514aa 100644
--- a/lib/private/Files/Storage/DAV.php
+++ b/lib/private/Files/Storage/DAV.php
@@ -129,12 +129,16 @@ class DAV extends Common {
 		$this->mimeTypeDetector = \OC::$server->getMimeTypeDetector();
 	}
 
+	/**
+	 * Initialize Sabre\DAV client. Try Basic first, then fall back to Bearer ($this->user) on 401/403.
+	 */
 	protected function init(): void {
 		if ($this->ready) {
 			return;
 		}
 		$this->ready = true;
 
+		// Base client settings (Basic by default)
 		$settings = [
 			'baseUri' => $this->createBaseUri(),
 			'userName' => $this->user,
@@ -144,14 +148,17 @@ class DAV extends Common {
 			$settings['authType'] = $this->authType;
 		}
 
+		// Proxy
 		$proxy = Server::get(IConfig::class)->getSystemValueString('proxy', '');
 		if ($proxy !== '') {
 			$settings['proxy'] = $proxy;
 		}
 
+		// Build client
 		$this->client = new Client($settings);
 		$this->client->setThrowExceptions(true);
 
+		// TLS bundle
 		if ($this->secure === true) {
 			$certPath = $this->certManager->getAbsoluteBundlePath();
 			if (file_exists($certPath)) {
@@ -162,6 +169,50 @@ class DAV extends Common {
 			}
 		}
 
+		// Probe auth once. If Basic fails with 401/403, rebuild with Bearer.
+		try {
+			// Cheap request: Depth 0 on root for a single property
+			$this->client->propFind($this->encodePath(''), ['{DAV:}resourcetype'], 0);
+		} catch (ClientHttpException $e) {
+			$status = $e->getHttpStatus();
+			if ($status === 401 || $status === 403) {
+				// Switch to Bearer. Token is in $this->user. Do not leak on redirects.
+				$bearerSettings = [
+					'baseUri' => $this->createBaseUri(),
+					'headers' => [
+						'Authorization' => 'Bearer ' . $this->user,
+						'Accept' => '*/*',
+					],
+					'curlSettings' => [
+						CURLOPT_UNRESTRICTED_AUTH => false,
+					],
+				];
+				if ($proxy !== '') {
+					$bearerSettings['proxy'] = $proxy;
+				}
+
+				$this->client = new Client($bearerSettings);
+				$this->client->setThrowExceptions(true);
+
+				if ($this->secure === true && $this->certPath) {
+					$this->client->addCurlSetting(CURLOPT_CAINFO, $this->certPath);
+				}
+
+				// Optional sanity check; let callers surface other errors later
+				try {
+					$this->client->propFind($this->encodePath(''), ['{DAV:}resourcetype'], 0);
+				} catch (ClientHttpException $e2) {
+					if ($e2->getHttpStatus() === 401 || $e2->getHttpStatus() === 403) {
+						throw $e2;
+					}
+				}
+			} else {
+				// Non-auth errors should be handled by callers later in real requests
+				throw $e;
+			}
+		}
+
+		// Timing/log hooks (kept as in upstream)
 		$lastRequestStart = 0;
 		$this->client->on('beforeRequest', function (RequestInterface $request) use (&$lastRequestStart) {
 			$this->logger->debug('sending dav ' . $request->getMethod() . ' request to external storage: ' . $request->getAbsoluteUrl(), ['app' => 'dav']);
@@ -175,6 +226,7 @@ class DAV extends Common {
 		});
 	}
 
+
 	/**
 	 * Clear the stat cache
 	 */
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index e7bfcf56407..ac7dc771d74 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -568,6 +568,47 @@ class Session implements IUserSession, Emitter {
 		return false;
 	}
 
+	/**
+	 * Tries to login the user with HTTP Bearer Authentication
+	 *
+	 * @todo do not allow bearer auth if the user is 2FA enforced
+	 * @param IRequest $request
+	 * @param IThrottler $throttler
+	 * @return boolean if the login was successful
+	 */
+	public function tryBearerAuthLogin(IRequest $request,
+		IThrottler $throttler) {
+		$auth_header = $request->getHeader('AUTHORIZATION');
+		$header_arr = explode(' ', $auth_header);
+		if (count($header_arr) == 2 && $header_arr[0] === 'Bearer') {
+			$token = $header_arr[1];
+			try {
+				// Note: This is correct, for OCM the Bearer token is the user and the password is empty
+				if ($this->logClientIn($token, '', $request, $throttler)) {
+					/**
+					 * Add DAV authenticated. This should in an ideal world not be
+					 * necessary but the iOS App reads cookies from anywhere instead
+					 * only the DAV endpoint.
+					 * This makes sure that the cookies will be valid for the whole scope
+					 * @see https://github.com/owncloud/core/issues/22893
+					 */
+					$this->session->set(
+						Auth::DAV_AUTHENTICATED, $this->getUser()->getUID()
+					);
+
+					// Set the last-password-confirm session to make the sudo mode work
+					$this->session->set('last-password-confirm', $this->timeFactory->getTime());
+
+					return true;
+				}
+				// If credentials were provided, they need to be valid, otherwise we do boom
+				throw new LoginException();
+			} catch (PasswordLoginForbiddenException $ex) {
+				// Nothing to do
+			}
+		}
+		return false;
+	}
 	/**
 	 * Log an user in via login name and password
 	 *

+               // Timing/log hooks (kept as in upstream)
                $lastRequestStart = 0;
                $this->client->on('beforeRequest', function (RequestInterface $request) use (&$lastRequestStart) {
                        $this->logger->debug('sending dav ' . $request->getMethod() . ' request to external storage: ' . $request->getAbsoluteUrl(), ['app' => 'dav']);
@@ -175,6 +226,7 @@ class DAV extends Common {
                });
        }
 
+
        /**
         * Clear the stat cache
         */
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index e7bfcf56407..ac7dc771d74 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -568,6 +568,47 @@ class Session implements IUserSession, Emitter {
                return false;
        }
 
+       /**
+        * Tries to login the user with HTTP Bearer Authentication
+        *
+        * @todo do not allow bearer auth if the user is 2FA enforced
+        * @param IRequest $request
+        * @param IThrottler $throttler
+        * @return boolean if the login was successful
+        */
+       public function tryBearerAuthLogin(IRequest $request,
+               IThrottler $throttler) {
+               $auth_header = $request->getHeader('AUTHORIZATION');
+               $header_arr = explode(' ', $auth_header);
+               if (count($header_arr) == 2 && $header_arr[0] === 'Bearer') {
+                       $token = $header_arr[1];
+                       try {
+                               // Note: This is correct, for OCM the Bearer token is the user and the password is empty
+                               if ($this->logClientIn($token, '', $request, $throttler)) {
+                                       /**
+                                        * Add DAV authenticated. This should in an ideal world not be
+                                        * necessary but the iOS App reads cookies from anywhere instead
+                                        * only the DAV endpoint.
+                                        * This makes sure that the cookies will be valid for the whole scope
+                                        * @see https://github.com/owncloud/core/issues/22893
+                                        */
+                                       $this->session->set(
+                                               Auth::DAV_AUTHENTICATED, $this->getUser()->getUID()
+                                       );
+
+                                       // Set the last-password-confirm session to make the sudo mode work
+                                       $this->session->set('last-password-confirm', $this->timeFactory->getTime());
+
+                                       return true;
+                               }
+                               // If credentials were provided, they need to be valid, otherwise we do boom
+                               throw new LoginException();
+                       } catch (PasswordLoginForbiddenException $ex) {
+                               // Nothing to do
+                       }
+               }
+               return false;
+       }
        /**
         * Log an user in via login name and password
         *

[mickenordin]

I suppose this is what we ought to use: https://github.com/sabre-io/dav/blob/master/lib/DAV/Auth/Backend/AbstractBearer.php

[enriquepablo]

nextcloud/server#57234 should solve this