Implement token exchange from OCM by enriquepablo · Pull Request #57234 · nextcloud/server

enriquepablo · 2025-12-23T13:00:54Z

Summary

This PR implements the token exchange flow from OCM, allowing Nextcloud to use bearer auth with short lived tokens. This opens up interoperability with OpenCloud/ownCloud OCIS and the possibility to implement webapp shares in the future, which requires this.

Discussion

This is a preliminary PR for discussion. If this goes through there are some things missing with which we'll be grateful to get some guidance:

docs and tests
keeping retrieved access tokens in the db
removing tokens when removing shares

There is also the question that for access tokens, we are keeping a reference to the corresponding refresh token in the uid field of the access token db record.

github-actions · 2026-01-07T02:12:36Z

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

enriquepablo · 2026-01-29T15:02:46Z

Disclaimer: Some of the code in this PR (mainly regarding the tests) was generated by Claude Opus 4.5. I have provided it with very specific prompts, and thoroughly reviewed the output.

mickenordin · 2026-05-28T12:06:27Z

I have grouped all changes into ~~8 commits~~9 commits that should be easier to review than 82 commits now @susnux @provokateurin

mickenordin · 2026-06-07T09:31:06Z

screencast-2026-06-07T11.18.mp4

Here is a screen cast of a webapp share, using the token exchange and new http signatures

mickenordin · 2026-06-07T09:36:17Z

screencast-2026-06-07T11.33.mp4

Here is a screen cast of the same server sharing to a vanilla nextcloud server, and you can see that the fallback to basic auth works without any token exchange, so backwards compatibility is maintained

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

…ccess tokens Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

… validation Accept both the legacy options.sharedSecret envelope and the new protocol[name].sharedSecret form. Preserve the original cloud ID so the factory can discover capabilities, then reset shareWith to the local username for user lookup. Delegate per-protocol validation to providers via the new IValidationAwareCloudFederationProvider interface, with split exception handling: BadRequestException -> 400, ProviderCouldNotAddShareException -> the exception's own HTTP status (501 fallback). In the notification handler, fall back to looking up the refresh token via OcmTokenMapMapper when the access token cannot identify the federation. Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

…ange Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

… shares Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

Shares using the OCM multi-protocol envelope (name multi, with the secret carried in a sibling protocol entry such as webdav) were rejected with Missing sharedSecret in protocol. Scan every protocol entry for the shared secret during validation, resolve the secret from the matching entry, and let the files provider serve the webdav entry of a multi envelope. Covers the file and folder resource types. Signed-off-by: Micke Nordin <kano@sunet.se>

mickenordin · 2026-06-17T12:41:09Z

@provokateurin @susnux do you think we can get this reviewed and merged now that NC34 is out? It takes a significant amount of work to keep the pr fresh...

CarlSchwan · 2026-06-18T09:26:27Z

+ *
+ * @since 32.0.0


Suggested change

*

* @since 32.0.0

Only needed for ocp apis

welcome · 2026-06-18T09:33:28Z

Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22

nickvergessen · 2026-06-19T07:39:36Z

This PR is missing a version bump and therefore breaks all daily/master based instances

nickvergessen · 2026-06-19T07:43:53Z

+		$db = Server::get(IDBConnection::class);
+		$tokenProvider = Server::get(PublicKeyTokenProvider::class);
+		$userManager = Server::get(IUserManager::class);


Should use DI?

I have opened a (~~#61439~~) #61441 addressing this. I can see you took care of the rest of your comments.

nickvergessen · 2026-06-19T07:44:21Z

+ * Shares created by this fork (32-char tokens) that are somehow missing from
+ * oc_authtoken are silently repaired.
+ */
+class Version1012Date20260306120000 extends SimpleMigrationStep {


Should bump the version of the app since a migration was added

I can see you already addressed this in #61428 . Thanks!

nickvergessen · 2026-06-19T07:45:24Z

+		}
+
+		if (!$table->hasColumn('access_token_expires')) {
+			$table->addColumn('access_token_expires', Types::INTEGER, [


If this is supposed to be a timestamp, the column type is wrong at least on 32bits

Should have lenght 11 or more, or BIGINT or type datetime instead

enriquepablo · 2026-06-19T09:26:54Z

@nickvergessen I will fix these issues and open a new PR and link it here

mickenordin · 2026-06-19T10:01:02Z

@nickvergessen I will fix these issues and open a new PR and link it here

Check what was already fixed here first: #61428 (review) @enriquepablo

enriquepablo requested review from a team and nickvergessen as code owners December 23, 2025 13:00

enriquepablo requested review from come-nc, icewind1991, nfebe and provokateurin and removed request for a team December 23, 2025 13:00

enriquepablo force-pushed the master branch from 39ddd47 to c0ad41d Compare December 23, 2025 15:02

susnux requested a review from ArtificialOwl December 23, 2025 20:19

mickenordin force-pushed the master branch from ca55418 to 0efe763 Compare December 27, 2025 18:58

enriquepablo force-pushed the master branch from 7df2212 to ee0d187 Compare December 30, 2025 11:26

This was referenced Jan 2, 2026

Implement bearer auth for accessing shares, both incomming and outgoing cs3org/OCM-STA#29

Open

Implement refresh of tokens and code capability cs3org/OCM-STA#30

Closed

github-actions Bot added the feedback-requested label Jan 7, 2026

enriquepablo force-pushed the master branch from ee0d187 to be75274 Compare January 8, 2026 11:27

AndyScherzinger requested a review from sorbaugh January 18, 2026 20:51

enriquepablo force-pushed the master branch from 26ce4e5 to 47d018f Compare January 19, 2026 16:12

mickenordin force-pushed the master branch from 47d018f to decff66 Compare January 19, 2026 16:48

enriquepablo force-pushed the master branch 2 times, most recently from 869318e to fa85a7c Compare January 29, 2026 10:53

mickenordin force-pushed the master branch from b370f49 to 25932cb Compare January 29, 2026 13:01

mickenordin force-pushed the master branch from 3f61c50 to c922943 Compare February 1, 2026 19:37

enriquepablo force-pushed the master branch 2 times, most recently from af0f4f2 to 736b3ff Compare February 2, 2026 16:40

mickenordin force-pushed the master branch 2 times, most recently from 6e14936 to 84713bc Compare February 3, 2026 20:43

enriquepablo force-pushed the master branch from 84713bc to 97f8cbe Compare February 4, 2026 16:06

nextcloud-bot mentioned this pull request May 27, 2026

[stable34] 34.0.0 RC3 #60771

Merged

nextcloud-bot mentioned this pull request Jun 4, 2026

[stable34] 34.0.0rc4 #60979

Closed

skjnldsv mentioned this pull request Jun 4, 2026

[stable34] build(hub): 34.0.0rc4 #60980

Merged

nextcloud-bot mentioned this pull request Jun 5, 2026

[stable34] 34.0.0 RC5 #61000

Merged

nextcloud-bot mentioned this pull request Jun 8, 2026

[stable34] 34.0.0 #61060

Merged

enriquepablo and others added 9 commits June 17, 2026 10:44

feat(auth): support permanent OCM refresh tokens and bearer login

ac2f981

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

feat(dav): accept bearer access tokens on webdav endpoints

2c54011

Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

feat(cloud_federation_api): add token exchange endpoint issuing JWT a…

789ff6a

…ccess tokens Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

feat(ocm): advertise exchange-token capability and token endpoint

4d56c74

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

feat(federatedfilesharing): create refresh tokens and sign token exch…

fc31f97

…ange Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

feat(files_sharing): store and refresh OCM access tokens for external…

3616212

… shares Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

chore: regenerate autoloaders and update psalm baseline

3d3b49c

Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>

AndyScherzinger approved these changes Jun 18, 2026

View reviewed changes

CarlSchwan reviewed Jun 18, 2026

View reviewed changes

CarlSchwan approved these changes Jun 18, 2026

View reviewed changes

mickenordin mentioned this pull request Jun 18, 2026

fix(OCM): Remove comment meant only for OCP APIs #61399

Merged

nickvergessen reviewed Jun 19, 2026

View reviewed changes

nickvergessen mentioned this pull request Jun 19, 2026

fix(migrations): Trigger recently added migrations #61428

Merged

7 tasks

This was referenced Jun 19, 2026

fix(federatedfilesharing): use DI in migration #61439

Closed

fix(federatedfilesharing): use DI in migration #61441

Open

Uh oh!

Conversation

enriquepablo commented Dec 23, 2025 • edited by mickenordin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Discussion

Uh oh!

github-actions Bot commented Jan 7, 2026

Uh oh!

enriquepablo commented Jan 29, 2026

Uh oh!

mickenordin commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mickenordin commented Jun 7, 2026

Uh oh!

mickenordin commented Jun 7, 2026

Uh oh!

mickenordin commented Jun 17, 2026

Uh oh!

CarlSchwan Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

welcome Bot commented Jun 18, 2026

Uh oh!

nickvergessen commented Jun 19, 2026

Uh oh!

nickvergessen Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

enriquepablo Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nickvergessen Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

enriquepablo Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

nickvergessen Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

enriquepablo commented Jun 19, 2026

Uh oh!

mickenordin commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

enriquepablo commented Dec 23, 2025 •

edited by mickenordin

Loading

mickenordin commented May 28, 2026 •

edited

Loading

enriquepablo Jun 19, 2026 •

edited

Loading