Harmonize user session creation

[julien-nc]

Context

While implementing Oidc support in global scale, we checked how Saml was supported. The GSS master node actually listens to OCP\User\Events\BeforeUserLoggedInEvent. This event is emitted when authenticating via user_saml because the user session is created by user_saml's IApacheBackend user backend. This can be considered as a trick as a user backend should implement IApacheBackend only to deal with authentication during API requests using headers or session variables to get credentials.
The user_oidc app has a different approach to create the user session on login, it manipulates the user session:

$this->userSession->setUser($user);
$this->userSession->completeLogin($user, ['loginName' => $user->getUID(), 'password' => '']);
$this->userSession->createSessionToken($this->request, $user->getUID(), $user->getUID());
$this->userSession->createRememberMeToken($user);

This actually does not dispatch OCP\User\Events\BeforeUserLoggedInEvent so we had to manually dispatch it.

Suggestion

It would be nice to find a way to make sure all the apps implementing a user backend emit the correct events and complete the login process correctly. Event dispatching could be moved somewhere in the IUserSession implementation for example.

The goal would be to prevent breaking apps that took OC_User::loginWithApache as inspiration to implement their login logic when there is a change in the server.

cc @juliusknorr

[juliusknorr]

Thanks for filing. We may also want to consider adapting this more towards the "normal" login steps were @ChristophWurst implemented a command chain:

server/lib/private/Authentication/Login/Chain.php

Lines 76 to 90 in 1202843

	$chain = $this->preLoginHookCommand;
	$chain
	->setNext($this->userDisabledCheckCommand)
	->setNext($this->uidLoginCommand)
	->setNext($this->emailLoginCommand)
	->setNext($this->loggedInCheckCommand)
	->setNext($this->completeLoginCommand)
	->setNext($this->createSessionTokenCommand)
	->setNext($this->clearLostPasswordTokensCommand)
	->setNext($this->updateLastPasswordConfirmCommand)
	->setNext($this->setUserTimezoneCommand)
	->setNext($this->twoFactorCommand)
	->setNext($this->finishRememberedLoginCommand);
	return $chain->process($loginData);

That seems like a nice pattern that could be adapted and where probably a lot of logic can just be reused

[joshtrichards]

Related: #21119