March 2008 - calendarserver-users - lists.macosforge.org

Kerberos Issue / Principals / Authentication
by Doug O'Connor 17 Jul '08

17 Jul '08

Hello, I'm having trouble getting Kerberos to run, it breaks when I do the ./ run script (could not start kerberos). All the directories under the XML service seem to set up okay, but access is denied even to admin/ admin logons from iCal 3.0 and anything else, and I suspect the Kerberos failure to be the issue. Please advise? BTW, logging in using Firefox to browse the directories works fine, it accepts the account uid/pwds from the accounts.xml file (which I've configured for use in the caldavd-dev.plist) in a pull-down dialogue box. It's using WebDAV/CalDAV clients that won't work for authentication. I get any mode of access denied or error 403 messages. When I check the server log output, it can't find principals for even "admin." After "No principal found for admin" it attempts to clone the __uids__/admin of resource <DirectoryPrincipalUIDPrivisioningResources....>. I tried manually building PyKerberos, and it referred me to do things in the kerberos.app that didn't work for me. The Edit-->Edit Realms didn't do anything, which means that Kerberos app isn't running right either. I could be wildly confused on this whole thing, so I apologize if I'm missing anything obvious here. The important thing is that I can't get anybody to authenticate when using a WebDAV/CalDAV client. Thanks, Doug O'Connor 111 East Avenue, Apt. 331 Rochester, NY 14604 301.437.8715 music(a)dougoconnor.com http://www.dougoconnor.com

4 7

vCard / CardDAV support in DCS
by Ernersto Revilla 09 Apr '08

09 Apr '08

Hi. I know that CardDAV is still not a standard, but Chandler/Cosmo already implements some parts. How difficult would it be to implement this in DCS? (estimates in month/person). I think the most important efforts are already done, i.e. vobject parses vCards (in some degree) and there are also REPORT implementation in the caldav part. Are there already any future plans? Best regards. Erny Spain

4 3

Re: [CalendarServer-users] delegation help?
by Joe Auty 06 Apr '08

06 Apr '08

Makes perfect sense, thanks! My only questions are what does the auto-schedule flag do, and how did you discover this? Is there a source of documentation I was not aware of? On Nov 9, 2007, at 5:34 AM, Damion Theobald wrote: > Hi, > > I have setup some delegation with my setup. I edited the account.xml > file > and have added the entry like this > > <location> > <uid>1stdelegate</uid> > <password>password</password> > <name>1stdelegate</name> > <auto-schedule/> > <proxies> > <member type="users">uid1</member> > <member type="users">uid2</member> > <member type="users">uid3</member> > </proxies> > </location> > <location> > <uid>2nddelegate</uid> > <password>password</password> > <name>2nddelegate</name> > <auto-schedule/> > <proxies> > <member type="users">uid1</member> > <member type="users">uid2</member> > <member type="users">uid3</member> > <member type="users">uid4</member> > </proxies> > </location> > > In this instance uid1, uid2, uid3, would be able to delegate to, > '1stdelegate', and '2nddelegate', but uid4 would only be able to > delegate to > '2nddelegate' > > > >> -----Original Message----- >> From: calendarserver-users-bounces(a)lists.macosforge.org >> [mailto:calendarserver-users-bounces@lists.macosforge.org] On >> Behalf Of >> Joe Auty >> Sent: 09 November 2007 06:29 >> To: calendarserver-users(a)lists.macosforge.org >> Subject: [CalendarServer-users] delegation help? >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Hello, >> >> I've setup the Darwin Calendar Server and it appears to be working >> fine in terms of reading and writing to user calendars. I would like >> to setup delegation, but I'm a little bit confused as to how this >> works. Would setting up the sudoers.plist file be required? If so, >> could somebody kindly explain how this would work? I tried adding my >> user/pass to this file, this produced error messages such as the >> following: >> >> Cannot authenticate proxy user without X-Authorize-As header >> >> I'm not using Kerberos or Open Directory right now, just the XML >> files >> for the time being... What does happen in iCal when I go to Manage >> Access to my Account and I enter a username for another user defined >> in the accounts-test.xml file is a "cannot find user" error dialog. >> >> Is there any place I can find a quick tutorial on delegate control, >> or >> am I already very close? >> >> >> >> >> >> >> >> - ----------- >> Joe Auty >> NetMusician: web publishing software for musicians >> http://www.netmusician.org >> joe(a)netmusician.org >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v1.4.7 (Darwin) >> >> iD8DBQFHM/4+CgdfeCwsL5ERAjxtAJ46jeozGVgpfxnVInI0Eqch6QTQFACggOL2 >> D2agCRLRUXEwoqCgyzb60p4= >> =PeoF >> -----END PGP SIGNATURE----- >> _______________________________________________ >> calendarserver-users mailing list >> calendarserver-users(a)lists.macosforge.org >> http://lists.macosforge.org/mailman/listinfo/calendarserver-users > >

7 21

Client library and admin tool
by Cyrus Daboo 05 Apr '08

05 Apr '08

Hi folks, The CalDAV client library and admin tool I have mentioned before is now available on the open source site. <http://trac.macosforge.org/projects/calendarserver/wiki/CalDAVClientLibrary> This will help people do basic command line management of XML directory files, as well as proxy/delegation setup. It can also form the basis of more sophisticated admin tools that people might need. If you have questions or comments please post to this list and I can work on expanding the wiki with an FAQ as issues come up. -- Cyrus Daboo

3 20

Support for not sharing/delegating ToDo's?
by Jakob Peterhänsel 31 Mar '08

31 Mar '08

Hi All, Is support for Not delegating ToDo's (and alarms) via iCal Server in place? iCal 3 does not seems to provide a way to specify this, and before hitting Apple with a huge hammer for not doing this on a server-grade implementation (that is already there for Publish function...!) I would just like to ask here... ;-) Jakob Peterhänsel "Be a part of the Love Generation - carry a smile, not a gun." - JP, May 2006 Email: jakob(a)hjemme.dk AIM: Marook Phone: +45 30787715

2 5

Re: [CalendarServer-users] Digest authentication
by Kervin L. Pierre 31 Mar '08

31 Mar '08

Hello Cyrus, You're correct. The mistake is actually with my configuration. I had the "auth, auth-int" value in caldavd-dev.plist, though caldavd.plist and caldavd-test.plist were empty. So it picked that up from there. I've had this issue reported by a few testers and I am wondering, is that the "official" fix for now? ie. "Make sure Qop string value is empty in *.plist" Or is this a temporary workaround? Best regards, Kervin ----- Original Message ---- > From: Kervin L. Pierre <kervin(a)adevsoft.com> > To: Cyrus Daboo <cdaboo(a)apple.com>; calendarserver-users(a)lists.macosforge.org > Sent: Monday, March 31, 2008 12:19:19 PM > Subject: Re: [CalendarServer-users] Digest authentication > > Hello Cyrus, > > > Ok, then the server should be sending you a WWW-Authenticate headed for > > Digest that does NOT contains a "qop=..." option in it. Can you check what > > you are sending back to the server? The client should NOT be sending back a > > "qop=..." if the server did not send one. > > > > Then that might be the problem. The server always > returns the client a 'Qop' value in the "WWW-Authenticate" > header. > > I will send you a text dump of the exchange in a few > minutes. > > Best regards, > Kervin > > > > > _______________________________________________ > calendarserver-users mailing list > calendarserver-users(a)lists.macosforge.org > http://lists.macosforge.org/mailman/listinfo/calendarserver-users >

2 1

Re: [CalendarServer-users] Digest authentication
by Kervin L. Pierre 31 Mar '08

31 Mar '08

Hello Cyrus, > Ok, then the server should be sending you a WWW-Authenticate headed for > Digest that does NOT contains a "qop=..." option in it. Can you check what > you are sending back to the server? The client should NOT be sending back a > "qop=..." if the server did not send one. > Then that might be the problem. The server always returns the client a 'Qop' value in the "WWW-Authenticate" header. I will send you a text dump of the exchange in a few minutes. Best regards, Kervin

1 0

Re: [CalendarServer-users] Digest authentication
by Kervin L. Pierre 31 Mar '08

31 Mar '08

Hello Cyrus, It seems to be....  <key>Digest</key> <dict> <key>Enabled</key> <true/> <key>Algorithm</key> <string>md5</string> <key>Qop</key> <string></string> </dict> Best regards, Kervin ----- Original Message ---- > From: Cyrus Daboo <cdaboo(a)apple.com> > To: Kervin L. Pierre <kervin(a)adevsoft.com>; calendarserver-users(a)lists.macosforge.org > Sent: Monday, March 31, 2008 11:47:01 AM > Subject: Re: [CalendarServer-users] Digest authentication > > Hi Kervin, > > --On March 30, 2008 12:19:43 PM -0700 "Kervin L. Pierre" > wrote: > > > I'm working on getting my application's digest > > authentication to work with calendar server. I > > noticed that Evolution users had, at least at > > one point, the same issue we're facing... > > https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/160190 > > > > Does Evolution currently work with calendar > > server + digest authentication? > > > > Specifically the error is raised in 'digest.py'. > > Calendar server complains that the nonce count > > value is more than it expected... > > > > 2008-03-30 10:46:31-0700 [-] [caldav-8008] [HTTPChannel,1,208.54.95.252] > > PROPFI ND /calendars/users/kervin/calendar/ HTTP/1.1 > > 2008-03-30 10:46:31-0700 [-] [caldav-8008] [HTTPChannel,1,208.54.95.252] > > 'Authe ntication failed: nonce-count value out of sequence: 2 should be > > one more than 0 ' > > Can anyone shed some light on this? > > Make sure the value is empty for the "Qop" item in the digest auth > section of the caldavd.plist file you are using. That will disable the > client-nonce value checks. > > > -- > Cyrus Daboo > >

2 1

Digest authentication
by Kervin L. Pierre 31 Mar '08

31 Mar '08

Hello, I'm working on getting my application's digest authentication to work with calendar server. I noticed that Evolution users had, at least at one point, the same issue we're facing... https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/160190 Does Evolution currently work with calendar server + digest authentication? Specifically the error is raised in 'digest.py'. Calendar server complains that the nonce count value is more than it expected... 2008-03-30 10:46:31-0700 [-] [caldav-8008] [HTTPChannel,1,208.54.95.252] PROPFI ND /calendars/users/kervin/calendar/ HTTP/1.1 2008-03-30 10:46:31-0700 [-] [caldav-8008] [HTTPChannel,1,208.54.95.252] 'Authe ntication failed: nonce-count value out of sequence: 2 should be one more than 0 ' Can anyone shed some light on this? Best regards, Kervin

2 1

Multi-user XMLDirectoryService
by Gerald McNulty 26 Mar '08

26 Mar '08

I've been playing around with multi-user access under the XMLDirectoryService and had the following questions: - Is it possible to allow users to access the calendar of other users? Either read-only or read-write but without sharing credentials. I can see how this can be done using <location> via <proxies>, but can it be done directly as a user? Or do I need to hack it using a resource or location? Is there a recommended way of doing this? - What's the difference between a resource and a location? - What's the meaning of the <password> field for groups, locations and resources? - Under <proxies>, what are valid <member type=... values and what's their meaning? Is this where I can use groups?

6 9