Repository navigation
[Feature Request] define groups for excluding mounts/folder from beeing synced (by client) #25873
Description
This is a solution proposal for Feature Request: ability to exclude external storage mounts from being synced by sync client #7234 and External Storage - 'All Files' and client sync hide #24970
In the current situation we can create groups, assign this groups to users and assign these groups to mounts/folders to share repectively give them access to.
Feature
This FR is about to be able to create groups which can be treated (slightly) differently that the default procedure and therefor used to exclude mounts/folders from beeing synced.
S...standard, N...new
- (S) create group(s) via the standard process
- (N) assign these group(s) to be "special" (however we call that, @ admin page or @ user page)
- (S) assign the group to a mount point
- (N) at folder sharing, create a new entry called exclude sync and only use the special groups
- (N) @ user administration: define default group(s) to be assigned when user is beeing setup
- (N) occ command for group management (./occ user:group [--listgroups] [--listdefault] [--add / --remove] [user:name(s) / --all / --group:name(s)] [--verbose]
Process
Whenever a DAV client accesses the instance, we check if the DAV client is the ownCloud sync client (eg checking if mirall/ is in the header, see log examples below).
- If no, proceed as usual
- If yes, additionally check if a special group exists for the accessing user. This is just an extension of the current procedure as it must check that anyway. But in case a special group exists, it overrides any access given and returns the the calling procedure like you have no access (this is like no sharing and therefore no change is needed in the sync client)
Bonus
- Admin driven (!!!)
- No changes needed in the ownCloud sync client
- Other DAV clients can see and process data as usual - this is explicitly wanted !
- Easy extension of existing methods
- Exclusion can be made everywhere in the shared tree, the first one triggers
- Works with all user backends
ownCloud Sync Client
ww.xx.yy.zz - user_x [19/Aug/2016:10:25:23 +0200] "GET /ocs/v2.php/apps/notifications/api/v1/notifications?format=json HTTP/1.1" 200 85 "-" "Mozilla/5.0 (Windows) mirall/2.2.3 (build 6307)"
ww.xx.yy.zz - user_x [19/Aug/2016:10:25:28 +0200] "PROPFIND /remote.php/webdav/ HTTP/1.1" 207 432 "-" "Mozilla/5.0 (Windows) mirall/2.2.3 (build 6307)"
ww.xx.yy.zz - user_x [19/Aug/2016:10:25:29 +0200] "PROPFIND /remote.php/webdav/ HTTP/1.1" 207 386 "-" "Mozilla/5.0 (Windows) mirall/2.2.3 (build 6307)"
A DAV client (CarotDAV)
ww.xx.yy.zz - - [19/Aug/2016:10:25:59 +0200] "PROPFIND /remote.php/webdav HTTP/1.1" 401 318 "-" "Rei.Fs.WebDAV/1.13.0"
ww.xx.yy.zz - user_x [19/Aug/2016:10:25:59 +0200] "PROPFIND /remote.php/webdav HTTP/1.1" 207 2549 "-" "Rei.Fs.WebDAV/1.13.0"
ww.xx.yy.zz - user_x [19/Aug/2016:10:26:00 +0200] "GET /remote.php/webdav/favicon.ico HTTP/1.1" 404 6409 "-" "Rei.Fs.WebDAV/1.13.0"
ww.xx.yy.zz - - [19/Aug/2016:10:26:00 +0200] "GET /favicon.ico HTTP/1.1" 404 6409 "-" "Rei.Fs.WebDAV/1.13.0"
ww.xx.yy.zz - user_x [19/Aug/2016:10:27:15 +0200] "PROPFIND /remote.php/webdav/Documents/ HTTP/1.1" 207 1111 "-" "Rei.Fs.WebDAV/1.13.0"
Activity
PVince81 commentedon Aug 22, 2016
@dragotin
mmattel commentedon Sep 2, 2016
@dragotin any comment on that?
mmattel commentedon Sep 12, 2016
All, any comment on the proposal?
PVince81 commentedon Sep 12, 2016
Hmmm... it seems all solutions for excluding are based on different criteria. The linked ticket is for excluding external storages and this one based on groups.
I have another idea for a much simpler idea: use system tags. Whichever folder is tagged as "exclude from sync" will not be synced at all. Then the admin can decide to set a tag on whichever folders must be excluded.
Then in the admin page, make it possible to select "exclude folders with the following tags from syncing".
Each solution has drawbacks as it defines a different scope. Not sure which one is the best and simplest to use and understand.
PVince81 commentedon Sep 12, 2016
I'd rather not add special handling in the server. This will also break with branding I believe where branded clients would send their own user agent.
Also, I don't think it's good to conditionally return different permissions or PROPFIND results based on the user-agent. I'd rather have a new Webdav property "oc:syncmode" with value "none" or so that the client can retrieve. It does require changing the clients, but I think it's up to clients to decide whether to respect this or not.
Also, this reminds me of the "firewall" app from the enterprise OC which can conditionally block access to specific folders based on user agent. It might be possible to do this already with that app.
mmattel commentedon Sep 12, 2016
Clarification: the request is coming from the need to exclude folders and/or mounts from beeing synced. Someone wants to provide a mount to be accessible via browser or DAV but not beeing syncable by the client, and someone else just wants a particular folder inside a mount from beeing excluded from syncing but accessible via browser or DAV.
In general it is to be decided if this is a task only on the server or a combination of server and client.
I have to confess to have overseen the possibility of branded clients, this needs a config parameter to be freely configurable for the admin (sync_user_agent = array...). My intention was to eliminate the need of changes in the client.
Some thoughts:
mmattel commentedon Sep 25, 2016
@PVince81 any ideas / comments from your side?
cdamken commentedon Sep 30, 2016
My idea would be to add a new permission for the external storage:
https://doc.owncloud.com/desktop/2.1/architecture.html#server-side-permissions
Where the client knows that come from external storage.
The sync-client by default has disabled external storage sync and could be marked as enabled if it needed and appear the selective sync what wants to be downloaded.
M File or Folder is mounted (like on DropBox, Samba, etc.)
PVince81 commentedon Oct 4, 2016
I prefer a more flexible variant where the Webdav response includes a "please-do-not-sync" attribute for folders. How/when these attributes are returned can be decided by the server, whether based on groups, ext storages, or anything else. It would even make it possible for third party devs to develop apps that makes it possible to select more complex exclusion structures without affecting the protocol.
Then the client should simply respect that attribute.
PVince81 commentedon Oct 4, 2016
yeah, the "please-do-not-sync" could be called a "special permission".
PVince81 commentedon Oct 7, 2016
Add webdav property to tell sync client to not sync an entry: #26311
ownclouders commentedon Dec 21, 2017
Hey, this issue has been closed because the label
status/STALEis set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.(This is an automated comment from GitMate.io.