Microsoft Access 2019 - start Nextcloud: pass user and password as arguments

💻 Development
1

I am trying to open my website with Nextcloud using Access VBA, which works

https://www.mydomain.de/nextcloud/index.php/login

But I can’t find a way to add this URL an username and password.
thx

2

This is because there IS NO WAY. For security reasons there is no way to pass the password via the URL. And even passing it via POST is blocked. At least you can pass the username: https://cloud.yourdomain.com/login?user=yourusername

3

Why are you trying to do this? Do you want to show the user the NC web interface? Or do you want to extract data from the NC to use in VBA further?

4

I have an Access application with login - password is SHA256 protected. The user who is logged in should be allowed to see via browser a specific folder/files in Nextcloud. Only users who have the access application installed will have the right to enter Nextcloud.

My idea: as the application handles the login there is no need to ask the user for a (second) Nextcloud login - just for user comfort. :slightly_smiling_face:

5

This is not a good idea to just pass the user and password to an arbitrary browser. You want interactive user sessions but logged in by a script. There are different security measures in place to protect the user’s data by different means depending on the way of login:

  • API login can be done with a classic login flow. You will get an app password as a result and must provide this token with every request. This is classic API access.
  • Interactive session requires a session cookie and a way to protect against XSS attacks (see CSRF).

You would have to make something between these two. The problem is that this distinguishing has a reason why it is implemented like this.

What I could think of would be to provide a link to the files (direct link for internal usage) in the VBA app and let the user be/keep logged in in the browser.
Alternatively, you could register a VBA app to the NC core (login via API flow above) and provide a GUI for interacting with the files as you like. This means, you have to do the complete GUI and not use the Web interface at all.

6

hey christianlupus,
thanks for your advice. About the API option working with a token I read something in the NC docs but there are no real code examples for VBA developers. I remember the NC script creates the token but how to get connected to VBA?
If it’s to complicated I will let the NC users enter their user and pssw. As written above the idea was to present the user directly the folder with the documents, just for convenience. :smiley:

7

Honestly, i am not able to program in VBA. I know only other languages. But I highly suspect, you can either natively or with a library open https connections to arbitrary servers and set the headers and the data to be send while reading the answers. Then, you have everything in place to talk with the nextcloud server.

Before writing dozens of lines of code, you can use e.g. curl to manually test the interface and see if it works for you.

As long as the users are logged in, the link to the appropriate folder will open in the browser directly.

Unfortunately, security and simplicity are usually antagonists. That’s a sad truth.

8

They did some time ago an implementation within python (GitHub - owncloud/pyocclient: ownCloud client library for Python). If it is just based on webdav, there is perhaps something in VBA for webdav as well, and you can extend it to use other stuff of the API (sharing, etc.).

Just looking around REST-like APIs: