External storage - RFE : accept $loginname as parameter

[didierm]

Steps to reproduce

1. configure External storage (e.g. SMB / CIFS)
2. use "$user" parameter
3. use "$loginname" parameter

Expected behaviour

• $user is replaced by the internal username
• $loginname is replaced by the session login name

Actual behaviour

• $user is replaced by the internal username (as expected)
• $loginname is literally quoted as "$loginname"

Rationale for RFE

• We use LDAP as backend auth, and use Federated Cloud to share data.
• The default Federated Cloud ID refers to the internal username, which is by default generated from from a random uuid.
• To prevent non-intuitive share references (see issue Use LDAP user name instead of UUID for federated cloud id #5406), we map the UUID Users Attribute to an LDAP attribute :
  • not uid, as this may either be a non-descriptive random string (e.g. "user0356") or an invitation for remote brute-force attacks (e.g. "johnd") ;
  • but cn (i.e. "John.Doe"), as this is descriptive and does not reveal the loginname credentials (= best practices).
• For standard CIFS/SFTP/etc. configurations, the home directory (e.g. "/home/johnd/") or CIFS share (e.g. "\\server\johnd") refers to the uid, and not the cn. This conflicts with the abovementioned scenario.

This issue can be mitigated by either generating symbolic links at the file server level (e.g. "ln -s johnd/ John.Doe", or by extending username maps at the CIFS server level (e.g. /etc/samba/username.map : "johnd = John.Doe"), but this is cumbersome and requires elevated privileges on the file server.

A better approach would be to propagate the session loginname as a variable.

Proposal

Add a line of code at https://github.com/nextcloud/server/blob/master/apps/files_external/lib/config.php#L207

$value = str_replace('$loginname', $loginname, $value);

and at https://github.com/nextcloud/server/blob/master/apps/files_external/lib/config.php#L212

$input = str_replace('$loginname', $loginname, $input);

where $loginname refers to ->session->get('loginname')

This would allow to use the loginname credentials in these scenarios.

Server configuration

Operating system: Linux

Web server: Apache

Database: PostgreSQL

PHP version: 7.2

Nextcloud version: (see Nextcloud admin page) 14.0.2

Updated from an older Nextcloud/ownCloud or fresh install: fresh

Where did you install Nextcloud from:

Are you using external storage, if yes which one: smb

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP

[nextcloud-bot]

GitMate.io thinks possibly related issues are #3789 (External storage), #4730 (Storage), #4348 (External storage quota), #6529 (External storage issue), and #11755 (external storage naming).

[didierm]

@nextcloud-bot This is not a bug, but a feature request.

[didierm]

@nextcloud-bot FYI : possibly related issues -> not related

[kesselb]

FYI #14174

Adding placeholder for external storage is easier since this pull request.

cc @nextcloud/ldap

[blizzz]

@didierm mind that login names are possibly case insensitive, i.e. can come in in various upper- and lowercase combinations. Also, you would not be able to allow other ways of logging in (e.g. email, or switching to SAML). You can already use $home with the LDAP backend (in hindsight I don't like that naming, but now it is there). If you specify "cn" as attribute you'd have a reliable source.

[szaimen]

As this sounds like a nice feature, the requests for this are quite low. Currently there are no plans to implement such a feature. Thus I will close this ticket for now. This does not mean we don't want this feature, but it is simply not on our roadmap for the near future. If somebody wants to implement this feature nevertheless we are happy to assist and help out.If you wish to have this feature implemented by the Nextcloud GmbH there is the option for consulting work on top of your Nextcloud Enterprise subscription to get your features implemented.