Lock-out unbranded ownCloud clients with OAuth
CC Attribution - ShareAlike 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Melius, Hauke
Demo how to prevent that unbranded ownCloud Clients (Desktop/iOS/Android) are able to log in to your ownCloud instance - thanks to OAuth. This session will showcase how OAuth can be used to lock out unbranded clients in order to make sure, that your users can only use the clients that you provide to them.
 All right, so today I'm going to talk about how you can lock out unbranded on cloud clients from your own cloud instance and make sure that people only use the on cloud clients that you provide to them. And yeah, some words about myself. So my name is Hauke Melius. I'm a senior presets engineer at on cloud. And in that role, I'm supporting our customers in a technical way during the sales cycle. All right. Okay, so what are we trying to achieve? So if you have a normal on cloud setup, so if you set up your own cloud as you normally do so you can use all the on cloud clients that you can find on the iOS app store or you can download on our website and so on. So there's no restriction by that. So but as this talk is about how to restrict that, we can do that. So why you might want to restrict your users to only use the clients that you provide to them. One reason could be that you only want them to use your clients because they have a specific kind of configuration. So for example, you have the URL already built into your client. You have some other things already configured through our tool that we call the own brander where we build these customized apps. Or maybe some some special security settings. So for example, for the iOS app, you can force a user to use the touch ID every time he opens up the app. And this might be important for you as a company. You want to make sure that people only use an app that forces a user to authenticate every time you opens up the app. So for example, if he loses his app on the airport and it's unlocked so people cannot access the data, and you also might want to prevent that people use or put the data that stored in your own cloud on their private devices so that they use their private laptop and download the clients and access the data. That's also possible because you want only that. So if you distribute the apps with your mobile device management, for example, or if you use your other automation tools to roll out the desktop client, you can prevent that with this setup. All right. So some basic words about how OAuth works and how we can basically do what I'm talking about the last couple of minutes. So we can make all of our clients support using OAuth for the authorization. And in order to be able to do that, we need to install the OAuth app on our server and after that the server will only accept OAuth requests. So what's happening there? So at first the client is sending out an authorization request. But this authorization request has a client ID and a specific client secret with it. All right. And then some magic happens on the on-cloud server and they create an authorization code and they send it back. And at the end, the client receives an OAuth access token that he can use to access the data on that account, basically. All right. And what we can do in order to lock out these public available clients, we need to create unique client IDs and unique secrets and put them into our clients in order to make sure that on-cloud only accepts these requests. All right. So I will do a quick demo afterwards. So just some overview steps that we're about to see. So what do you need to do? So I put that on that slide. If people, I think we will distribute the slides afterwards. You can see what the things are that you need to do if you want to have that. So of course you need to install the OAuth app on your server. Then you will need to delete the existing OAuth client IDs and secrets. So we will see that in a second and create custom IDs and secrets for your clients. And these client IDs and secrets then need to be used, need to be added to your configuration and the own branded tool. And then you can brand your client or build your client. This will take up to, I think, 24 hours or so. And then you can use it. All right. Okay. So yeah, some slides where I show what we're about to see in live. So if you want to have a look at that later on, so you can download the slides that, but I would like to go to the live demo now. All right. So I only have one hand to type. So let's see. Okay. So I have an own cloud running here on my laptop based on Docker containers. So if I want to have a look at the OAuth configuration, I need to go to the settings page and to the user authentication stuff. And here we can see, in this case, we can see four different configurations. So the first three are the ones that basically describe the publicly available client. So this is, for example, if you look at the desktop client, this is the client identifier and the secret of the desktop client that you download on our website from oncloud.com slash download or.org slash download. So that's the identifier and the secret that they use. So just as a quick test. So if I just remove that here. So yes, I'm pretty sure. So I just removed the client configuration from the public client and I will just try to connect to that instance here. So I will try to add a new account. So the client I've opened now is just the basic client that I downloaded from our website, so nothing special here. So I clicked at new configuration. So I type in the address type. All right. And then the usual behavior will happen. So he will then redirect me to the oncloud and I need to authenticate here now. So, but that's all right. Now I authenticated myself and then he checked that he, I cannot access that account with that oncloud client because the client ID and secret are not listed in my configuration. All right. And also I already created a feature request for, for having a more precise, a more precise error message here. Okay. So, yeah, if you want to, to have a custom configuration, so if you want to have something like, like Haukes desktop client, we can just like edit here. So I just put in here new, new client, for example, reuse the, the URI here and click on add. And then he, then we have a, we have a new identifier and a new secret. And then I need to, to copy and paste that stuff to, to the own brand up. So the own brand is based and under, under customer.oncloud.com. So if we look at that, if we go to the own brand for the desktop client, we will find, we will find it here. So basically that's what you have to do. So you have to, to copy and paste the, the client ID and the client secret to, to your own brand or configuration. And as you can see, so it's starting with, with 3D and this is basically the configuration I used for, for Haukes desktop client. So I already created that client because it takes a while in order to, to be, to be created. And yeah, after that, we just have to, to click on, on, on the generate desktop client thing. And then it runs for like 24 hours or so. And then you can download your client. I've already done that. So we've seen that we, we cannot use the, the public available client anymore because I deleted the configuration for that. And now I will have to open my customized client. That's called the Hauke client or Hauke cloud client, whatever. So, and again, I will try the same thing again as before. And of course I don't have a valid certificate. And yeah, he recognized that I'm already locked in. In this case, now he, this client is allowed to, to lock into that, to that server. All right. So I click on, so I click on authorize and then I should be, yeah, I can go back to the, I will be redirected back to the, to the configuration. I click on connect. And now I can, yeah, I can use that client and, and the same example again. So if I go here now and delete that configuration, he should immediately, it should immediately drop me off that, that connection here. So I'll try to force a zoom. Yeah. He will, he dropped me out and I will get that error again. All right. Yeah. That's basically what I wanted to show today. Um, yeah. Any questions so far? No one? Yes, please. Okay. And now let's briefly add that to the conversion and the end ingredient, now create a sort of bet. Um, that's kind of henna, I don't know what to do? then that has problem for the other case where we can then enter this into show. You can't go away, it's a little, I mean, I don't know. Yes, please. We have a lot of customers who use Google's. And they try to use the lines that slide out. And well, some people use Google's. And they ship the ancient. You get a lot of problems. And I don't want to talk about security. So I can force my users to use the lines that I applied. I don't see the appeal. Yeah, so as I said before, so it's in, we had one customer, we have one customer that is really using it for security reasons. So as I said, for the iOS app, you can force, if you have your branded app, you can force people to use Touch ID or enter a four digit code in order to access the app. And that's not the case with the app that you download from the iOS store. And in that case, you can make sure that they only use that app that has this kind of security features that you want them to use. And of course, this error message that we have here now, it should be more precise telling the user that the client that he uses at the moment is not supported by the server or something like that. I think I already created a request, feature request for that. Not sure. So I think you can, hopefully, you can add a page in the form to access the client in the future. Yeah. So I always talk about this integration for the app. Yeah. I need to know all of the tests, but you... No, you just do it once. So let's say you want to distribute a desktop client to your users. You just create that configuration once, you brand that client once, and then you distribute it to all of the users. And then you don't have to do it for every single user. It's built in the client. It's not user specific. It's client specific, so to say. Yeah. And it's stored in the own brander. And you recreate your client then. It's automatically in there again. So it's, actually, it's pretty easy to maintain that. All right. Any other questions? Yes, please. Yeah. Yeah. I think this would be the only solution. I'm not sure if there are other workarounds to prevent that. I don't know, to be honest. Yes. So as said, so the open source client so that you can download freely on the Internet also uses a client ID and a secret. And if you're good in building your own clients, I'm pretty sure you can also build that in there somewhere somehow. But that's, you need to ask the people that create the clients. But we provide that to our customers as a self-service tool. That's what I just showed through the own brander where they can, like, change some values and the appearance of the client. And yeah, it's an automated tool, basically. But it should be possible to do it somehow with this stuff. So the last part? It does. It's using the default ones that I just showed somewhere. Yeah, so I deleted that before. So maybe the example is the same for the iOS app. So the iOS app that you download from the iOS app store is using that client identifier and that client secret during the authorization flow. And this is also the same for the desktop client that you download. So there is a client at the end of client secret. And this is known to own clients. And this is known to own cloud if you install the app. So then it will be configured into that app. OK. Any other questions? Doesn't seem to be the case. All right, then I'm done. Thanks for your attention. Thank you.
 All right, so today I'm going to talk about how you can lock out unbranded on cloud clients  from your own cloud instance and make sure that people only use the on cloud clients  that you provide to them.  And yeah, some words about myself.  So my name is Hauke Melius.  I'm a senior presets engineer at on cloud.  And in that role, I'm supporting our customers in a technical way during the sales cycle.  All right.  Okay, so what are we trying to achieve?  So if you have a normal on cloud setup, so if you set up your own cloud as you normally  do so you can use all the on cloud clients that you can find on the iOS app store or  you can download on our website and so on.  So there's no restriction by that.  So but as this talk is about how to restrict that, we can do that.  So why you might want to restrict your users to only use the clients that you provide to  them.  One reason could be that you only want them to use your clients because they have a specific  kind of configuration.  So for example, you have the URL already built into your client.  You have some other things already configured through our tool that we call the own brander  where we build these customized apps.  Or maybe some some special security settings.  So for example, for the iOS app, you can force a user to use the touch ID every time he opens  up the app.  And this might be important for you as a company.  You want to make sure that people only use an app that forces a user to authenticate  every time you opens up the app.  So for example, if he loses his app on the airport and it's unlocked so people cannot  access the data, and you also might want to prevent that people use or put the data that  stored in your own cloud on their private devices so that they use their private laptop  and download the clients and access the data.  That's also possible because you want only that.  So if you distribute the apps with your mobile device management, for example, or if you  use your other automation tools to roll out the desktop client, you can prevent that with  this setup.  All right.  So some basic words about how OAuth works and how we can basically do what I'm talking  about the last couple of minutes.  So we can make all of our clients support using OAuth for the authorization.  And in order to be able to do that, we need to install the OAuth app on our server and  after that the server will only accept OAuth requests.  So what's happening there?  So at first the client is sending out an authorization request.  But this authorization request has a client ID and a specific client secret with it.  All right.  And then some magic happens on the on-cloud server and they create an authorization code  and they send it back.  And at the end, the client receives an OAuth access token that he can use to access the  data on that account, basically.  All right.  And what we can do in order to lock out these public available clients, we need to create  unique client IDs and unique secrets and put them into our clients in order to make sure  that on-cloud only accepts these requests.  All right.  So I will do a quick demo afterwards.  So just some overview steps that we're about to see.  So what do you need to do?  So I put that on that slide.  If people, I think we will distribute the slides afterwards.  You can see what the things are that you need to do if you want to have that.  So of course you need to install the OAuth app on your server.  Then you will need to delete the existing OAuth client IDs and secrets.  So we will see that in a second and create custom IDs and secrets for your clients.  And these client IDs and secrets then need to be used, need to be added to your configuration  and the own branded tool.  And then you can brand your client or build your client.  This will take up to, I think, 24 hours or so.  And then you can use it.  All right.  Okay.  So yeah, some slides where I show what we're about to see in live.  So if you want to have a look at that later on, so you can download the slides that, but  I would like to go to the live demo now.  All right.  So I only have one hand to type.  So let's see.  Okay.  So I have an own cloud running here on my laptop based on Docker containers.  So if I want to have a look at the OAuth configuration, I need to go to the settings  page and to the user authentication stuff.  And here we can see, in this case, we can see four different configurations.  So the first three are the ones that basically describe the publicly available client.  So this is, for example, if you look at the desktop client, this is the client identifier  and the secret of the desktop client that you download on our website from oncloud.com  slash download or.org slash download.  So that's the identifier and the secret that they use.  So just as a quick test.  So if I just remove that here.  So yes, I'm pretty sure.  So I just removed the client configuration from the public client and I will just try  to connect to that instance here.  So I will try to add a new account.  So the client I've opened now is just the basic client that I downloaded from our website,  so nothing special here.  So I clicked at new configuration.  So I type in the address type.  All right.  And then the usual behavior will happen.  So he will then redirect me to the oncloud and I need to authenticate here now.  So, but that's all right.  Now I authenticated myself and then he checked that he, I cannot access that account with  that oncloud client because the client ID and secret are not listed in my configuration.  All right.  And also I already created a feature request for, for having a more precise, a more precise  error message here.  Okay.  So, yeah, if you want to, to have a custom configuration, so if you want to have something  like, like Haukes desktop client, we can just like edit here.  So I just put in here new, new client, for example, reuse the, the URI here and click  on add.  And then he, then we have a, we have a new identifier and a new secret.  And then I need to, to copy and paste that stuff to, to the own brand up.  So the own brand is based and under, under customer.oncloud.com.  So if we look at that, if we go to the own brand for the desktop client, we will find,  we will find it here.  So basically that's what you have to do.  So you have to, to copy and paste the, the client ID and the client secret to, to your  own brand or configuration.  And as you can see, so it's starting with, with 3D and this is basically the configuration  I used for, for Haukes desktop client.  So I already created that client because it takes a while in order to, to be, to be created.  And yeah, after that, we just have to, to click on, on, on the generate desktop client  thing.  And then it runs for like 24 hours or so.  And then you can download your client.  I've already done that.  So we've seen that we, we cannot use the, the public available client anymore because  I deleted the configuration for that.  And now I will have to open my customized client.  That's called the Hauke client or Hauke cloud client, whatever.  So, and again, I will try the same thing again as before.  And of course I don't have a valid certificate.  And yeah, he recognized that I'm already locked in.  In this case, now he, this client is allowed to, to lock into that, to that server.  All right.  So I click on, so I click on authorize and then I should be, yeah, I can go back to the,  I will be redirected back to the, to the configuration.  I click on connect.  And now I can, yeah, I can use that client and, and the same example again.  So if I go here now and delete that configuration, he should immediately, it should immediately  drop me off that, that connection here.  So I'll try to force a zoom.  Yeah.  He will, he dropped me out and I will get that error again.  All right.  Yeah.  That's basically what I wanted to show today.  Um, yeah.  Any questions so far?  No one?  Yes, please.  Okay.  And now let's briefly add that to the conversion and the end ingredient, now create a sort  of bet.  Um, that's kind of henna, I don't know what to do?  then that has problem for the other case where we can then  enter this into show.  You can't go away, it's a little, I mean, I don't know.  Yes, please.  We have a lot of customers who use Google's.  And they try to use the lines that slide out.  And well, some people use Google's.  And they ship the ancient.  You get a lot of problems.  And I don't want to talk about security.  So I can force my users to use the lines that I applied.  I don't see the appeal.  Yeah, so as I said before, so it's in, we had one customer,  we have one customer that is really using it for security reasons.  So as I said, for the iOS app, you can force,  if you have your branded app, you can force people to use Touch ID  or enter a four digit code in order to access the app.  And that's not the case with the app that you download from the iOS  store.  And in that case, you can make sure that they only use that app  that has this kind of security features that you want them to use.  And of course, this error message that we have here now,  it should be more precise telling the user that the client  that he uses at the moment is not supported by the server or  something like that.  I think I already created a request, feature request for that.  Not sure.  So I think you can, hopefully, you can add a page in the form to access  the client in the future.  Yeah.  So I always talk about this integration for the app.  Yeah.  I need to know all of the tests, but you...  No, you just do it once.  So let's say you want to distribute a desktop client to your  users.  You just create that configuration once, you brand that client once,  and then you distribute it to all of the users.  And then you don't have to do it for every single user.  It's built in the client.  It's not user specific.  It's client specific, so to say.  Yeah.  And it's stored in the own brander.  And you recreate your client then.  It's automatically in there again.  So it's, actually, it's pretty easy to maintain that.  All right.  Any other questions?  Yes, please.  Yeah.  Yeah.  I think this would be the only solution.  I'm not sure if there are other workarounds to prevent that.  I don't know, to be honest.  Yes.  So as said, so the open source client so that you can download  freely on the Internet also uses a client ID and a secret.  And if you're good in building your own clients, I'm pretty sure you can  also build that in there somewhere somehow.  But that's, you need to ask the people that create the clients.  But we provide that to our customers as a self-service tool.  That's what I just showed through the own brander where they can,  like, change some values and the appearance of the client.  And yeah, it's an automated tool, basically.  But it should be possible to do it somehow with this stuff.  So the last part?  It does.  It's using the default ones that I just showed somewhere.  Yeah, so I deleted that before.  So maybe the example is the same for the iOS app.  So the iOS app that you download from the iOS app store is using  that client identifier and that client secret during the authorization  flow.  And this is also the same for the desktop client that you download.  So there is a client at the end of client secret.  And this is known to own clients.  And this is known to own cloud if you install the app.  So then it will be configured into that app.  OK.  Any other questions?  Doesn't seem to be the case.  All right, then I'm done.  Thanks for your attention.  Thank you.
ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_0_203.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_204_635.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_636_3599.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_3600_4055.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_4056_8399.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_8400_14051.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_14052_14927.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_14928_15839.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_15840_16571.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_16572_16643.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_16644_16715.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_16716_17303.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_17304_18419.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_18420_18515.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_18516_18935.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_18936_18983.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_18984_19535.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_19536_19607.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_19608_19703.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_19704_19859.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_19860_20627.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_20628_22547.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_22548_22991.png ownCloud_conference_2018_Lock-out_unbranded_ownCloud_clients_with_OAuth_yZKDMtISl5Y_22992_25871.png