Issue #603 - Add support for TLS client certificates

app/build.gradle

@@ -240,7 +240,10 @@ android {
 dependencies {
     // dependencies for app building
     implementation 'androidx.multidex:multidex:2.0.1'
-    implementation("com.github.nextcloud:android-library:$androidLibraryVersion") {
+//    implementation("com.github.nextcloud:android-library:$androidLibraryVersion") {
+    // temporarily using my own version of the nextcloud android-library so automated compile and unit tests
+    // are able to build the app. should be removed before merging.
+    implementation("com.github.elv1zz:nextcloud-android-library:$androidLibraryVersion") {
         exclude group: 'org.ogce', module: 'xpp3' // unused in Android and brings wrong Junit version
     }
 

app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java

@@ -470,6 +470,7 @@ public void onPageFinished(WebView view, String url) {
                 }
             }
 
+            @Override
             public void onReceivedError(WebView view, int errorCode, String description, String failingUrl) {
                 accountSetupWebviewBinding.loginWebviewProgressBar.setVisibility(View.GONE);
                 accountSetupWebviewBinding.loginWebview.setVisibility(View.VISIBLE);

app/src/main/java/com/owncloud/android/ui/NextcloudWebViewClient.kt

@@ -3,14 +3,19 @@ package com.owncloud.android.ui
 import android.annotation.SuppressLint
 import android.net.http.SslCertificate
 import android.net.http.SslError
+import android.webkit.ClientCertRequest
 import android.webkit.SslErrorHandler
+import android.webkit.WebResourceRequest
+import android.webkit.WebResourceResponse
 import android.webkit.WebView
 import android.webkit.WebViewClient
 import androidx.fragment.app.FragmentManager
 import com.owncloud.android.authentication.AuthenticatorActivity
+import com.owncloud.android.lib.common.network.AdvancedX509KeyManager
 import com.owncloud.android.lib.common.network.NetworkUtils
 import com.owncloud.android.lib.common.utils.Log_OC
 import com.owncloud.android.ui.dialog.SslUntrustedCertDialog
+import org.apache.commons.httpclient.HttpStatus
 import java.io.ByteArrayInputStream
 import java.security.cert.CertificateException
 import java.security.cert.CertificateFactory
@@ -78,4 +83,39 @@ open class NextcloudWebViewClient(val supportFragmentManager: FragmentManager) :
         ft.addToBackStack(null)
         dialog.show(ft, AuthenticatorActivity.UNTRUSTED_CERT_DIALOG_TAG)
     }
+
+    /**
+     * Handle request for a TLS client certificate.
+     */
+    override fun onReceivedClientCertRequest(view: WebView?, request: ClientCertRequest?) {
+        if (view == null || request == null) {
+            return
+        }
+        AdvancedX509KeyManager(view.context).handleWebViewClientCertRequest(request)
+    }
+
+    /**
+     * Handle HTTP errors.
+     *
+     * We might receive an HTTP status code 400 (bad request), which probably tells us that our certificate
+     * is not valid (anymore), e.g. because it expired. In that case we forget the selected client certificate,
+     * so it can be re-selected.
+     */
+    override fun onReceivedHttpError(
+        view: WebView?,
+        request: WebResourceRequest?,
+        errorResponse: WebResourceResponse?
+    ) {
+        val errorCode = errorResponse?.statusCode ?: return
+        if (errorCode == HttpStatus.SC_BAD_REQUEST) {
+            // chosen client certificate alias does not seem to work -> discard it
+            val failingUrl = request?.url
+            val context = view?.context
+            if (failingUrl == null || context == null) {
+                return
+            }
+            Log_OC.w(tag, "WebView failed with error code $errorCode; remove key chain aliases")
+            AdvancedX509KeyManager(context).removeKeys(failingUrl)
+        }
+    }
 }

build.gradle

@@ -1,6 +1,6 @@
 buildscript {
     ext {
-        androidPluginVersion = '8.2.0'
+        androidPluginVersion = '8.2.1'
         appCompatVersion = '1.6.1'
         jacoco_version = '0.8.10'
         kotlin_version = '1.8.22'