lib/private/User/Session.php
/**
	 * Tries to log in a client
	 *
	 * Checks token auth enforced
	 * Checks 2FA enabled
	 *
	 * @param string $user
	 * @param string $password
	 * @param IRequest $request
	 * @param OC\Security\Bruteforce\Throttler $throttler
	 * @throws LoginException
	 * @throws PasswordLoginForbiddenException
	 * @return boolean
	 */
Tries to log in a client
Checks token auth enforced
Checks 2FA enabled


Tries to log in a client Checks token auth enforced Checks 2FA enabled
public function logClientIn($user,
								$password,
								IRequest $request,
								OC\Security\Bruteforce\Throttler $throttler) {
		$currentDelay = $throttler->sleepDelay($request->getRemoteAddress(), 'login');
		if ($this->manager instanceof PublicEmitter) {
			$this->manager->emit('\OC\User', 'preLogin', array($user, $password));
		}
		$isTokenPassword = $this->isTokenPassword($password);
		if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
			throw new PasswordLoginForbiddenException();
		}
		if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
			throw new PasswordLoginForbiddenException();
		}
		if (!$this->login($user, $password) ) {
			$users = $this->manager->getByEmail($user);
			if (count($users) === 1) {
				return $this->login($users[0]->getUID(), $password);
			}
			$throttler->registerAttempt('login', $request->getRemoteAddress(), ['uid' => $user]);
			if($currentDelay === 0) {
				$throttler->sleepDelay($request->getRemoteAddress(), 'login');
			}
			return false;
		}
		if ($isTokenPassword) {
			$this->session->set('app_password', $password);
		} else if($this->supportsCookies($request)) {
			$this->createSessionToken($request, $this->getUser()->getUID(), $user, $password);
		}
		return true;
	}
public function logClientIn ( $ user , $ password , IRequest $ request , OC \ Security \ Bruteforce \ Throttler $ throttler ) { $ currentDelay = $ throttler -> sleepDelay ( $ request -> getRemoteAddress ( ) , 'login' ) ; if ( $ this -> manager instanceof PublicEmitter ) { $ this -> manager -> emit ( '\OC\User' , 'preLogin' , array ( $ user , $ password ) ) ; } $ isTokenPassword = $ this -> isTokenPassword ( $ password ) ; if ( ! $ isTokenPassword && $ this -> isTokenAuthEnforced ( ) ) { throw new PasswordLoginForbiddenException ( ) ; } if ( ! $ isTokenPassword && $ this -> isTwoFactorEnforced ( $ user ) ) { throw new PasswordLoginForbiddenException ( ) ; } if ( ! $ this -> login ( $ user , $ password ) ) { $ users = $ this -> manager -> getByEmail ( $ user ) ; if ( count ( $ users ) === 1 ) { return $ this -> login ( $ users [ 0 ] -> getUID ( ) , $ password ) ; } $ throttler -> registerAttempt ( 'login' , $ request -> getRemoteAddress ( ) , [ 'uid' => $ user ] ) ; if ( $ currentDelay === 0 ) { $ throttler -> sleepDelay ( $ request -> getRemoteAddress ( ) , 'login' ) ; } return false ; } if ( $ isTokenPassword ) { $ this -> session -> set ( 'app_password' , $ password ) ; } else if ( $ this -> supportsCookies ( $ request ) ) { $ this -> createSessionToken ( $ request , $ this -> getUser ( ) -> getUID ( ) , $ user , $ password ) ; } return true ; }
Tries to log in a client
 Checks token auth enforced
 Checks 2FA enabled
Tries to log in a client Checks token auth enforced Checks 2FA enabled
// Password login, but cookies supported -> create (browser) session token