Electronically sign documents via eIDEasy

[vmiklos]

Is your feature request related to a problem? Please describe.

This is related to #4123, which was about digital signing via software certificates.

Describe the solution you'd like

Collabora Online has support to use eIDEasy to sign PDF files without sending the actual PDF file to an external service, see https://docs.eideasy.com/electronic-signatures/api-flow-with-file-hashes-pdf.html for the details. The request here is to add the related settings (API URL, client id, secret) to the richdocuments admin settings, so Nextcloud users can use this feature.

Then these should be sent to COOL via the WOPI CheckFileInfo, so COOL can use the eIDEasy API as required.

In the future, perhaps it should be possible to restrict the eIDEasy usage to a specific group -- but it's just a possibility, nobody requested that so far.

Describe alternatives you've considered

There is already a dedicated Nextcloud app, which can also work with eIDEasy, see https://github.com/eideasy/nextcloud-electronic-signatures-plugin. One benefit of the request approach is that that when SecureView is enabled, then you can sign PDF files without giving the PDF to the user. Another benefit is that hash-based signing is possible with the Nextcloud all-in-one docker image, while the mentioned app would require a separate docker image for hash-based signing. (Previously it seemed hash-based signing is not possible at all with that app, but this is not true, it just requires a separate docker container to handle the PDF manipulation that is built into Collabora Online already.)

Additional context

CollaboraOnline/online#10630 is the Collabora Online side of this, there you can find some test API URL / client id / secret to try out this feature.

The Collabora Online side still has a few rough edges (e.g. the signing popup is not yet localized), but it's probably at a level where it makes sense to expose this feature on the settings UI.

I intend to work on this, just creating the issue to track the richdocuments progress at a single place.

[juliusknorr]

I intend to work on this, just creating the issue to track the richdocuments progress at a single place.

Let us know if you need anything from our side.

[vmiklos]

The above PR adds this section to the admin settings (these are just test tokens, nothing sensitive):

CI has some failures, but seems that's unrelated (3 checks are broken on the baseline already, and the static analysis finds 2 places, but those lines are not touched in the PR), it seems to me.