OAuth 2.0 end-to-end experience #267

michaelstingl · 2019-02-10T11:41:14Z

Screenshot 1	Screenshot 2	Screenshot 3	Screenshot 4

Problem 1

Regular users don't understand why the 2nd screen (see Screenshot 1) after entering the server URL is useful
We could explain this feature, and users should have an option to skip this screen in the future

@felix-schwarz @mneuwert @hosy

Problem 2

Name of the app is different
In the warning message, it says "ownCloud" Wants to Use… (see Screenshot 2)
The OAuth 2.0 login screen says The application "iOS" is requesting… (see Screenshot 3 & Screenshot 4)

@DeepDiver1975 we should rename it in the OAuth 2.0 app to "ownCloud iOS app".

@felix-schwarz Any chance it could say "ownCloud app" or "ownCloud iOs app" in the warning message?

Steps to reproduce

Install OAuth 2.0 master (40fe0ab) on ownCloud server
Add account to the ownCloud iOS app

Client

iOS version:
iOS 12.1.4 (16D57)

ownCloud app version:
ownCloud beta version 1.0 build 105 (https://github.com/owncloud/ios-app/tree/b19e57b2f67234460ae6dec8f9587d62ed34d2f0, built from branch)

Device model:
Model: iPhone XS Max

Server configuration

ownCloud version:
ownCloud server 10.1.0 with master-OAuth 2.0 (40fe0ab) on ownCloud server

/cc @hodyroff

The text was updated successfully, but these errors were encountered:

hosy · 2019-02-21T09:16:33Z

Problem 1

Regular users don't understand why the 2nd screen (see Screenshot 1) after entering the server URL is useful

We could explain this feature, and users should have an option to skip this screen in the future

@felix-schwarz @mneuwert @hosy

This is happening because OAuth2 uses SFAuthenticationSession by default instead of SFSafariViewController. There is unfortunately nothing we can do at the moment to either change or remove these alerts when using SFAuthenticationSession.

michaelstingl · 2019-02-21T09:20:18Z

@hosy Problem 1 ==> Screenshot 1. This isn't about the alert popping up.

hosy · 2019-02-21T09:24:53Z

@hosy Problem 1 ==> Screenshot 1. This isn't about the alert popping up.

Maybe this have something to do with the server certificate. I think @felix-schwarz could have an answer for this step.

hosy · 2019-02-22T10:35:41Z

@michaelstingl a possible solution could look like this examples:

More details for certificate validation
Explanation for the user, why an alert will be shown in the next step

Certificate passed validation	Certificate validation failed

michaelstingl · 2019-02-22T10:58:16Z

@hosy Yeah, I like! 👍 But: color as only differentiator doesn't work for colorblind user.

Suggestions:

Find something better to indicate valid connection or warning
Improve the first text below
Improve the explanation about the next step

I was also thinking about an option to skip this step in the future, but this will clutter too…

hosy · 2019-03-18T16:08:42Z

@michaelstingl here you can see a new draft for this view.

Certificate state is shown in Certificate Details row
Short explanation for the certificate state as footer text
Info panel as footer view to give the user a description for the next oAuth step

Left screenshot has info panel on top
Right screenshot has info panel below

Certificate passed validation	Certificate validation failed

michaelstingl · 2019-03-18T22:24:01Z

Left screenshot has info panel on top

My gut feeling would favorite the left one (info on top)

…nformations for OAuth 2 login - added additional informations for certificate validation as label and text

jesmrec · 2019-03-20T14:23:39Z

Let's go with a bit of QA here

jesmrec · 2019-03-20T14:32:06Z

In the message to clarify the warning, there is a small typo.

"If you 'Continue', you will be prompted to allow the '%@' App to open OAuth 2 login where you can enter your credentials."

"OAuth 2" => "OAuth2"

jesmrec · 2019-03-20T14:44:38Z

If the server is http with OAuth2, there is no intermediate step, so the new warning is displayed at the same time as the alert, because no certificate is required:

Should we include something in the flow to stop the alert before?

jesmrec · 2019-03-20T14:54:51Z

About the OCCertificate color labels, i can reproduce Error, Passed, Warning and Accepted. But Rejected, i do not find steps to get it. Any idea?

hosy · 2019-03-20T15:03:15Z

@jesmrc I don’t know how to force Rejected.
I am not sure how to handle the http step. Maybe we should include an additional step!? @michaelstingl

jesmrec · 2019-03-20T15:08:49Z

about the statuses, i will add more UI tests to cover all options.

hosy · 2019-03-20T20:12:53Z

@jesmrec is there a public OC server with OAuth2 and http for testing?

jesmrec · 2019-03-21T07:34:47Z

no, afaik. But you can create a docker in this way:

Create the container:
docker run -name OAuth2container -p 15000:8080 owncloud/server:10.1
Install and enable OAuth2 inside:
docker exec -ti OAuth2container bash -l
cd apps
git clone https://github.com/owncloud/oauth2.git
../occ app:enable oauth2

Maybe, there are another "scripted" way to do it.

jesmrec · 2019-03-21T12:39:40Z

typo is fixed. i will address the tests in a separate issue. When http issue is done, please ping me to check and move it forward.

michaelstingl · 2019-03-21T12:45:49Z

2. Install and enable OAuth2 inside:
docker exec -ti OAuth2container bash -l

You don't need to exec into the Docker to install apps:
https://github.com/owncloud-docker/base#available-environment-variables

michaelstingl · 2019-03-21T12:46:54Z

I am not sure how to handle the http step. Maybe we should include an additional step!? @michaelstingl

Missing SSL should also trigger a cert warning 😱 /cc @felix-schwarz

jesmrec · 2019-03-21T13:57:28Z

You don't need to exec into the Docker to install apps:
https://github.com/owncloud-docker/base#available-environment-variables

thanks for the tip!!

felix-schwarz · 2019-03-21T20:09:39Z

I am not sure how to handle the http step. Maybe we should include an additional step!? @michaelstingl

Missing SSL should also trigger a cert warning 😱 /cc @felix-schwarz

Unless the user enters a URL starting with http://, the SDK will pre-pend https://, so it takes extra effort on behalf of the user to enter http://. That's why it currently doesn't respond to it with an issue.

I think we have several options here:

handle the http://-case fully inside the app (which would then bring up an alert on its own)
handle the http://-case inside the SDK, which should require little to no changes in the app.

If we pick the SDK-option, I'd also like to add an OCClassSettings/MDM option HTTPURLPolicy with these possible options:

allow (would be present state: no warning)
warn (would turn a http-URL into a warning as proposed)
forbidden (would turn a http-URL into an error, so no bookmark can be created for it)

hosy · 2019-03-21T21:14:44Z

@felix-schwarz I like the SDK-option, because it is fixed inside the SDK and cannot be removed. It is more secure by default.
I also like to implement your suggestion with the possible options. But we should show always an warning, if a http:// server is entered. Maybe allow should also the same like warn.

felix-schwarz · 2019-03-22T08:23:08Z

@hosy I agree. warn should be the default. But allow as a distinct option is useful for keeping unit tests / testing simple. Some tests would otherwise have to choose between supplying their own certificate - or handling the warning.

felix-schwarz · 2019-03-22T21:35:05Z

@hosy Just pushed the SDK-implementation and some necessary app-changes in owncloud/ios-sdk@89f5b7b and #328 respectively. Chances are some UI tests need to be adapted (I didn't check, yet).

hosy · 2019-03-23T21:45:44Z

@jesmrec for http I added an additional step to show the OAuth info text, before the OAuth authentication process is performed. There is now one step more for http connections, but this should be rare, because https should be the standard.
I also linked against the newest SDK version
owncloud/ios-sdk@89f5b7b

* #267 - added a info view as tableview header for showing additional informations for OAuth 2 login - added additional informations for certificate validation as label and text * better value handling * changed function name to better reflect, what it does * now using theme colors * fixed typo * Fix for http connections and OAuth authentication - new sdk is used, which supports warnings for https connections - for http connections, continue only, if OAuthInfoHeader was shown to the user, before OAuth authentication is performed * fixed ui test for OAuth http test, added additional Continue step * - correct handling of OAuth Header in edit mode - remove certificate description, if certificate was removed from bookmark - added new helper methods for updating header / footer title in TableView Section without loosing text field focus * - fixed wrong table header view height, if it was not set - fixed additional continue step in edit mode for http token based connections * fixed ui test, because password field is not visible on iPhone 8 (used test device)

michaelstingl added Design Login p2-high Escalation, on top of current planning, release blocker labels Feb 10, 2019

michaelstingl added this to the 1.0.0-Current milestone Mar 11, 2019

michaelstingl assigned hosy Mar 11, 2019

michaelstingl added the Estimation - 3 (M) 3 points label Mar 11, 2019

hosy added a commit that referenced this issue Mar 19, 2019

#267 - added a info view as tableview header for showing additional i…

8afe831

…nformations for OAuth 2 login - added additional informations for certificate validation as label and text

hosy mentioned this issue Mar 19, 2019

Added Additional OAuth and Certificate Infos #325

Merged

12 tasks

felix-schwarz mentioned this issue Mar 22, 2019

[feature/http-warning] Warn of plain HTTP URLs during setup #328

Closed

3 tasks

hosy closed this as completed Mar 26, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OAuth 2.0 end-to-end experience #267

OAuth 2.0 end-to-end experience #267

michaelstingl commented Feb 10, 2019

hosy commented Feb 21, 2019

Problem 1

michaelstingl commented Feb 21, 2019

hosy commented Feb 21, 2019

hosy commented Feb 22, 2019 •

edited

Loading

michaelstingl commented Feb 22, 2019 •

edited

Loading

hosy commented Mar 18, 2019 •

edited

Loading

michaelstingl commented Mar 18, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

hosy commented Mar 20, 2019

jesmrec commented Mar 20, 2019

hosy commented Mar 20, 2019

jesmrec commented Mar 21, 2019

jesmrec commented Mar 21, 2019

michaelstingl commented Mar 21, 2019

michaelstingl commented Mar 21, 2019

jesmrec commented Mar 21, 2019

felix-schwarz commented Mar 21, 2019

hosy commented Mar 21, 2019

felix-schwarz commented Mar 22, 2019

felix-schwarz commented Mar 22, 2019 •

edited

Loading

hosy commented Mar 23, 2019

OAuth 2.0 end-to-end experience #267

OAuth 2.0 end-to-end experience #267

Comments

michaelstingl commented Feb 10, 2019

Problem 1

Problem 2

Steps to reproduce

Client

Server configuration

hosy commented Feb 21, 2019

Problem 1

michaelstingl commented Feb 21, 2019

hosy commented Feb 21, 2019

hosy commented Feb 22, 2019 • edited Loading

michaelstingl commented Feb 22, 2019 • edited Loading

hosy commented Mar 18, 2019 • edited Loading

michaelstingl commented Mar 18, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

jesmrec commented Mar 20, 2019

hosy commented Mar 20, 2019

jesmrec commented Mar 20, 2019

hosy commented Mar 20, 2019

jesmrec commented Mar 21, 2019

jesmrec commented Mar 21, 2019

michaelstingl commented Mar 21, 2019

michaelstingl commented Mar 21, 2019

jesmrec commented Mar 21, 2019

felix-schwarz commented Mar 21, 2019

hosy commented Mar 21, 2019

felix-schwarz commented Mar 22, 2019

felix-schwarz commented Mar 22, 2019 • edited Loading

hosy commented Mar 23, 2019

hosy commented Feb 22, 2019 •

edited

Loading

michaelstingl commented Feb 22, 2019 •

edited

Loading

hosy commented Mar 18, 2019 •

edited

Loading

felix-schwarz commented Mar 22, 2019 •

edited

Loading