Does not work with user-key encryption

[PVince81]

OAuth2 should use the oc_authtoken API and pass access token instead of app password.

This would make it possible for the encryption code to decrypt the user's password to access the user's private key.

And whenever the access token is changed through refresh token, need to decrypt user password from oc_authtoken, delete the old entry, then add a new entry with the new access token.

I expect all this to be possible using the core's DefaultTokenProvider.

@DeepDiver1975 @pmaier1 @SamuAlfageme

[ogoffart]

This also means that the access token should not be stored plain text in the database. One can simply store a hash of the access token instead.

In order to be able to re-encrypt the password with a new access token, the password also need to be encrypted using the refresh token. Which means that the refresh token also can't be stored plain text and need to be hashed.

[thommierother]

still open for 10.0.7.RC2

[PVince81]

this will likely require changes in the oauth2 app

[PVince81]

I've now added an entry to the limitations of user-key encryption that need to be documented: https://github.com/owncloud/documentation/issues/4179#issuecomment-409189593