Initialize lastCheck when creating session token

[fredreichbier]

Hello there!

Description

With this change applied, DefaultTokenProvider initially sets the lastCheck timestamp to the current time when generating new tokens.

Related Issue

#28467

Motivation and Context

On ownCloud master, each user login via the user_ldap app sends two bind requests to the LDAP backend. This breaks 2FA (because one-time passwords are reused). See #28467 and #26065 for more details.

The second LDAP bind request is triggered by an initial user session validation right after a successful login. This checks the user password (i.e. sends a bind request). If we set lastCheck of new tokens to the current time, this initial check is skipped. As a result, a user login only sends one LDAP Bind Request, which (1) improves performance and (2) makes it possible to implement 2FA in the LDAP backend.

This change fixes #28467, but I don't know enough about the ownCloud internals to evaluate whether this change is sensible. Does setting the lastCheck time like this have any security implications?

How Has This Been Tested?

Manually checked that a user login only sends one LDAP bind request.

Please note that in order to test this on the current master, #28450 needs to be applied first! Otherwise, login via user_ldap fails generally.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

Thanks!

[PVince81]

👍

[PVince81]

@fredreichbier please backport to stable10 (submit a PR to that branch with the same changes)

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.