shared xDAV resources
Anatoli
me at anatoli.ws
Sat May 26 19:19:14 EDT 2018
Hi Ken,
Thanks for dedicating time to this issue.
The *current problem*: the auto-discovery mechanism for CalDAV/CardDAV
resources in Cyrus doesn't return the /shared/ resources a user has
access to. It does return all resources in the /user folder/
(/dav/calendars/user/<user at domain>/) for all known clients (including iOS).
The clients that I'm aware of that /only/ support auto-discovery
mechanism (i.e. where users can't specify a direct resource URL), is all
iOS (Calendar and Contacts apps), not sure about the same Mac apps. Then
there is a lot of clients that support both methods (e.g. Evolution,
even Thunderbird has a plug-in that enables auto-discovery) and its much
simpler to auto-discover everything just entering the server address and
user/pass than configuring the same for each resource one by one.
For me the most basic functionality would be enough at this time: the
clients that support auto-discovery mechanism should be able to list and
access the shared resources the same way they access now the resources
in the user folder. Once this works, we could deploy shared calendars
and addressbooks in production, gather users feedback and see what could
be improved.
*TL;DR*: I guess it would be enough to just include the shared resource
URLs in the list returned by Cyrus to PROPFIND
/dav/principals/user/<user at domain>/ query.
With respect to *ACLs*, they do work correctly on all resources (shared
and user-owned). Here probably one thing could be improved to not
confuse users. Now if a user tries to introduce changes to a
calendar/addressbook where he has a read-only access (rl ACL), his
client gets 403 Forbidden and it asks the user to enter different
credentials. The ideal would be to return some other code that won't
trigger a credentials request in the client (maybe something like
"operation not supported" or some temporary error). The idea is to
activate this behavior only when the user is properly authenticated and
has a r/o access, but asks for a write operation, i.e. it's not for all
403 Forbidden cases:
if (user.authenticated && user.acl(requested_resource) == r&l &&
requested_operation == w|i|p|k|x|t|e)
return "operation not supported"
else
return "403 Forbidden"
With respect to the *scheduling* support, I can't talk for the entire
community, but at least in my case, we don't use this feature at the
moment not even for user calendars. Our shared calendars use cases now
are to create reminders for public holidays, employees birthdays, etc.
and for meeting rooms reservations. Once the users become familiar with
shared calendars, new use cases would appear probably.
One feature that would be nice to have (but it's workaround-able now
with custom scripts, so it's of low priority) is to be able to create
shared calendars and addressbooks with a web GUI the same way user
calendars and addressbooks could be created now.
With this functionality we would probably have to define the concept of
shared resources /scope/, i.e. global (public) shared resources and
user-owned shared resources, with the main difference being their path
(/dav/calendars/X vs /dav/calendars/user/<user at domain>/X) and a special
permission (probably w, i or k on /dav/calendars/ could work) that would
allow the user to create global (public) shared resources.
Also, the current web GUI for user calendars/contacts could have an
option to add permissions on available resources for other users (e.g. a
mail address field and 2 radio buttons for access type (read|write)), so
its owner could share his/her calendars/contacts directly from the
existing GUI.
Please let me know if I can provide additional details.
Thanks,
Anatoli
*From:* Ken Murchison
*Sent:* Friday, May 25, 2018 10:29
*To:* Cyrus Devel
*Subject:* Re: shared xDAV resources
Hi Anatoli,
I'm guessing that this will be a couple of days work. Bron has told me
to carve out some time to work on this. I have 4 flights and 2 hotel
stays coming up June 4-14, which will give me some time to look at this.
Can you summarize the functionality that you require and what the
current problems are? E.g., Do you need scheduling support on the
shared calendar? Do Apple clients not autodiscover the calendars? Are
ACLs working properly?
On 05/25/2018 12:22 AM, Anatoli wrote:
> Bron, Ken,
>
> I've just created a new issue for this:
> https://github.com/cyrusimap/cyrus-imapd/issues/2373, so it's not lost
> in the mails archive.
>
> Please let us know if the community can sponsor the development.
>
> Thanks,
> Anatoli
>
> *From:* Anatoli
> *Sent:* Monday, April 09, 2018 00:40
> *To:* Cyrus Devel
> *Subject:* Re: shared xDAV resources
>
> Bron, Ken,
>
> Thanks for your explanations.
>
> Do you consider this is something possible to implement for an outside
> developer, i.e. without Cyrus HTTP/DB implementation internals
> understanding, nor solid knowledge of xDAV RFCs? I'd like to
> collaborate, but I believe it only makes sense to start this work if I
> could finish it without too much effort to become fluent with the
> related internals/standards.
>
> On the other hand, if I don't have a reasonable chance to implement it
> myself, could I sponsor the development by your team or help your team
> in other ways (e.g. extensive testing, logs/telemetry, etc.)?
>
> I have the Cyrus xDAV functionality deployed experimentally at one
> organization, everything looks good so far, but the fact that shared
> resources (calendars and addressbooks) can't be accessed from iOS
> devices obstructs its definitive deployment there and at other
> organizations. WebDAV resources work well on all devices with some
> minor issues on macOS (I'm debugging them now, looks like they only
> occur on previous versions of macOS, i.e. El Capitan).
>
>
> > I originally wrote the code to handle public calendars in the
> "shared" namespace, but I focused on user calendars first, and public
> calendar support got tossed on the back burner. It appears that the
> code for public calendars partly works.
>
> Public calendars actually work quite well, if the device can discover
> them. Currently, I've tested them with Thunderbird and haven't found
> any issues.
>
> Remote addressbooks are not supported in Thunderbird, so I use
> /CardBook/ add-on and it works well with shared addressbooks, no
> issues detected. /Evolution/ supports CardDAV natively and also works
> well with shared addressbooks.
>
> Regards,
> Anatoli
>
> *From:* Ken Murchison
> *Sent:* Saturday, April 07, 2018 21:53
> *To:* Bron Gondwana, Cyrus Devel
> *Cc:* Ken Murchison
> *Subject:* Re: shared xDAV resources
>
> I originally wrote the code to handle public calendars in the "shared"
> namespace, but I focused on user calendars first, and public calendar
> support got tossed on the back burner. It appears that the code for
> public calendars partly works.
>
> My first thought to get auto-discovery of public calendars is to add
> /dav/calendars as a second calendar-home-set for users and see what
> the Apple clients do with that. I don't know if they can handle
> multiple home-sets. If that doesn't work, then we could map public
> calendars into the user's home-set via the same subscription mechanism
> that we use for CalDAV sharing.
>
> To answer the original question, calendars are enumerated by
> meth_propfind() and propfind_by_collection() in http_dav.c
>
>
> On 4/7/18 8:25 PM, Bron Gondwana wrote:
>> Ken knows this code best. I bet there's something which is requiring
>> that there's a user on the mboxname because we implement the same
>> behaviour at FastMail by having a separate user on which shared
>> resources are kept. The DAV resources are stored per-user, and
>> without a place to keep them for "shared calendars" that code might
>> just not be accessible. I'm sure it would be possible to create a
>> shared DAV database as well for this case, but it just needs some
>> programming effort.
>>
>> Bron.
>>
>>
>> On Sun, 8 Apr 2018, at 07:30, Anatoli wrote:
>>> Hi All,
>>>
>>> I'm trying to understand the code responsible for enumerating user
>>> calendars (and xDAV resources in general) to try to make the
>>> discovery work for shared resources too (currently there's no way to
>>> access shared resources with Apple xDAV client implementation, yes
>>> with Thunderbird as it doesn't use the discovery mechanism, but
>>> instead should be pointed to the exact URL for each calendar). If I
>>> understand it correctly, the functionality is in imap/http_caldav.c.
>>>
>>> Could you please point me to the place where the enumeration occurs
>>> and briefly mention how the general workflow looks like?
>>>
>>> The client asks for:
>>>
>>> PROPFIND /dav/calendars/user/<user at domain>/
>>>
>>> <A:propfind xmlns:A="DAV:">
>>> ...
>>>
>>> The server responds with:
>>>
>>> HTTP/1.1 207 Multi-Status
>>>
>>> <A:multistatus xmlns:A="DAV:" ...>
>>> <A:response>
>>> <A:href>/dav/calendars/user/<user at domain>/</A:href>
>>> <A:propstat>
>>> ...
>>> </A:response>
>>> <A:response>
>>> <A:href>/dav/calendars/user/<user at domain>/Default/</A:href>
>>> <A:propstat>
>>> <A:prop>
>>> ...
>>>
>>> The idea is to include in the returned lists the shared calendars
>>> too with the discovery logic based on the IMAP shared folders.
>>>
>>> Below goes the initial exchange between the calendar app on iOS
>>> 10.2.6 and Cyrus 3.0.5 when the exact URL (/dav/calendars/shared/)
>>> for the shared calendar is provided in the advanced settings of the
>>> app (the URL finally resets to the user principals folder
>>> (/dav/principals/user/t3 at domain.com/) as iOS is pointed to it by
>>> Cyrus). In the attached file goes the telemetry for the rest of the
>>> communication.
>>>
>>> Thanks,
>>> Anatoli
>>>
>>> ---------- t3 at domain.com <mailto:t3 at domain.com> Sun Mar 25 06:05:36 2018
>>>
>>> <1521968736<*PROPFIND* */dav/calendars/shared/* HTTP/1.1
>>> Accept: */*
>>> Content-type: text/xml
>>> Connection: keep-alive
>>> Content-length: 181
>>> Host: mail.domain.com
>>> User-agent: iOS/11.2.6 (15D100) accountsd/1.0
>>> Prefer: return=minimal
>>> Depth: 0
>>> Brief: t
>>> Accept-language: en-us
>>> Authorization: Basic ...
>>> Accept-encoding: br, gzip, deflate
>>>
>>> <1521968736<<?xml version="1.0" encoding="UTF-8"?>
>>> <A:propfind xmlns:A="DAV:">
>>> <A:prop>
>>> <A:current-user-principal/>
>>> <A:principal-URL/>
>>> <A:resourcetype/>
>>> </A:prop>
>>> </A:propfind>
>>>
>>>
>>> >1521968736>HTTP/1.1 207 Multi-Status
>>> Date: Sun, 25 Mar 2018 09:05:36 GMT
>>> Strict-Transport-Security: max-age=600
>>> Vary: Accept-Encoding, Brief, Prefer
>>> Preference-Applied: return=minimal
>>> Content-Type: application/xml; charset=utf-8
>>> Content-Length: 546
>>>
>>> <?xml version="1.0" encoding="utf-8"?>
>>> <A:multistatus xmlns:A="DAV:" xmlns:C="urn:ietf:params:xml:ns:caldav">
>>> <A:response>
>>> <A:href>*/dav/calendars/shared/*</A:href>
>>> <A:propstat>
>>> <A:prop>
>>> <A:current-user-principal>
>>> <A:href>*/dav/principals/user/t3 at domain.com/*</A:href>
>>> </A:current-user-principal>
>>> <A:resourcetype>
>>> <A:collection/>
>>> <C:calendar/>
>>> </A:resourcetype>
>>> </A:prop>
>>> <A:status>HTTP/1.1 200 OK</A:status>
>>> </A:propstat>
>>> </A:response>
>>> </A:multistatus>
>>>
>>> <1521968736<OPTIONS /dav/principals/user/t3%40domain.com/ HTTP/1.1
>>> Host: mail.domain.com
>>> Connection: keep-alive
>>> Accept: */*
>>> User-Agent: iOS/11.2.6 (15D100) accountsd/1.0
>>> Accept-Language: en-us
>>> Content-Length: 0
>>> Accept-Encoding: br, gzip, deflate
>>>
>>> >1521968736>HTTP/1.1 200 OK
>>> Date: Sun, 25 Mar 2018 09:05:36 GMT
>>> Strict-Transport-Security: max-age=600
>>> Cache-Control: no-cache
>>> Link: </dav/principals/.server-info>; rel="server-info";
>>> token="80769c2c66d340ecd178710db26d56b9c4699e3e"
>>> DAV: 1, 2, 3, access-control, extended-mkcol, resource-sharing
>>> DAV: calendar-access, calendar-auto-schedule
>>> DAV: calendar-query-extended, calendar-availability,
>>> calendar-managed-attachments
>>> DAV: calendarserver-sharing, inbox-availability
>>> DAV: addressbook
>>> Allow: OPTIONS, GET, HEAD
>>> Allow: PROPFIND, REPORT, COPY
>>> Content-Length: 0
>>>
>>> Email had 1 attachment:
>>>
>>> *
>>> |telemetry.log|
>>> 36k (text/x-log)
>>>
>>
>> --
>> Bron Gondwana, CEO, FastMail Pty Ltd
>> brong at fastmailteam.com
>>
>>
>
>
> --
> Kenneth Murchison
> Cyrus Development Team
> FastMail Pty Ltd
>
>
--
Ken Murchison
Cyrus Development Team
FastMail US LLC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.andrew.cmu.edu/pipermail/cyrus-devel/attachments/20180526/30f4a40f/attachment-0001.html>
More information about the Cyrus-devel
mailing list