mirrors/nextcloud-documentation
3
0
Fork 0
mirror of https://github.com/nextcloud/documentation.git synced 2025-10-26 11:18:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add documentation for the new login flow

Browse Source 
Fixes #620

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2018-01-07 10:42:38 +01:00 committed by Morris Jobke
parent d54b58d949
commit 4e29852378
No known key found for this signature in database
GPG Key ID: FE03C3A163FEDE68
2 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
developer_manual/client_apis/LoginFlow/index.rst Normal file
View File

@ -0,0 +1,51 @@
.. _loginflowindex:
==========
Login Flow
==========
This document provides a quick overview of the new login flow that should be used by clients to obtain
login credentials. This will assure that each client gets it own set of credentials. This has several advantages:
1. The client never stores the password of the user
2. The user can revoke on a per client basis from the web
Opening the webview
-------------------
The client should open a webview to :code:`<server>/index.php/login/flow`. Be sure to set the :code:`OCS-APIREQUEST`
header to :code:`true`.
The client will register an URL handler to catch urls of the :code:`nc` protocol. This is required the obtain the
credentials in the final stage.
This should be a one time webview. Which means:
* There should be no cookies set when creating the webview
* Passwords should not be stored
* No state should be preserved after the webview has terminated
To have a good user experince please to considet he following things:
* set the proper :code:`ACCEPT_LANGUAGE` header
* set a proper :code:`USER_AGENT` header
Login in the user
-----------------
The user will now see a webpage telling them they will grant access to :code:`USER_AGENT`. When they follow the setps
they will be asked to login. If they have two factor authentication enabled they will require this to login. But since
this is all in the webview itself the client does not need to care about this.
Obtaining the login credentials
-------------------------------
On the final login the server will do a redirect to a url of the following format:
.. code::
nc://login/server:<server>&user:<username>&password:<password>
This information will be used by the client to create a new account.
After this the webview is destroyed including all the state the webview holds.

7
developer_manual/client_apis/index.rst
View File

@ -26,10 +26,17 @@ Other OCS API documentations:
* `Notifications API - Register a device for push notifications <https://github.com/nextcloud/notifications/blob/5a2d3607952bad675e4057620a9c7de8a7f84f0b/docs/push-v3.md>`_
Login Flow
----------
Clients can obtain an apptoken via the login flow. See :doc:`LoginFlow/index`
.. toctree::
:maxdepth: 2
:hidden:
WebDAV/index
OCS/index
LoginFlow/index