March 2009 - calendarserver-users - lists.macosforge.org

Re: [CalendarServer-users] calendarserver on debian via nss and kerberos
by Guido Günther 02 Apr '09

02 Apr '09

On Tue, Mar 24, 2009 at 02:59:37PM +0100, root wrote: > On Mon, Mar 23, 2009 at 07:10:51AM +0100, Guido Günther wrote: > > On Tue, Mar 03, 2009 at 12:27:45PM +0100, Marco Ghidinelli wrote: > > > hello, > > > anyone was able to use calendarserver on debian 5 with users from > > > nssswitch and authentication via SPNEGO/Kerberos? > > > > > > I followed the README.Debian, but with no results. > > To verify if NSS really works you can change: > > > > + def verifyCredentials(self, credentials): > > + # FIXME: plugin in PAM authentication here if you want to - kerberos works > > + #return super(NssUserRecord, self).verifyCredentials(credentials) > > + return False > > ^^^^^ > > > > To: > > > > + def verifyCredentials(self, credentials): > > + # FIXME: plugin in PAM authentication here if you want to - kerberos works > > + #return super(NssUserRecord, self).verifyCredentials(credentials) > > + return True > > ^^^^ > > > > in twistedcaldav/directory/nss.py. This will disable *all* > > authentication but the first/lastValUid etc checks will still be in > > place. Once this works we can try to work out why kerberos fails. > > hello guido, > > i changed the line above, but with or without the change the result is > the same: Did you allow for non kerberos authentication in your configuration? You should can disable kerberos authentication completely for testing. Cheers, -- Guido

2 2

Reverse proxy issue ?
by Bastien Semene 31 Mar '09

31 Mar '09

Hi list, To compensate a lack of IPs I set up a reverse-proxy to handle some https:// connections. It includes access to the calendar server. Calendar server is reachable at https://xxx.com/calendar/ and the proxy reaches caldav at the internal URL : http://calendar.xxx.com:8008 (directives at the bottom) I can see the the calendars without problem, but I have the following issue : - When creating a new event, I must manually refresh it to see the modification. - I can't delete an event (logs are below). Note that in the logs when DELETE fails the first part of ics id is missing. Is there some particular configuration needed ? Am I doing something wrong ? Is it possible to have a reverse-proxy ? Logs : You can see access from reverse proxy or host by its IP (respectively 10.1.8.1 and 10.1.8.220). 2009-03-31 15:37:21+0200 [-] [caldav-8008] [HTTPChannel,72,10.1.8.1] [twistedcaldav.extensions#info] DELETE /calendars/users/abonnard/calendar/262f-4352-aae4-19aeff8d1e4c.ics HTTP/1.1 2009-03-31 15:37:21+0200 [-] [caldav-8008] [HTTPChannel,73,10.1.8.1] [twistedcaldav.extensions#info] HEAD /calendars/users/abonnard/calendar/262f-4352-aae4-19aeff8d1e4c.ics HTTP/1.1 2009-03-31 15:37:42+0200 [-] [caldav-8008] [HTTPChannel,76,10.1.8.1] [twistedcaldav.extensions#info] HEAD /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:37:42+0200 [-] [caldav-8008] [PooledMemCacheProtocol,client] [twistedcaldav.extensions#info] PROPFIND /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:37:48+0200 [-] [caldav-8008] [HTTPChannel,78,10.1.8.1] [twistedcaldav.extensions#info] DELETE /calendars/users/abonnard/calendar/262f-4352-aae4-19aeff8d1e4c.ics HTTP/1.1 2009-03-31 15:37:48+0200 [-] [caldav-8008] [HTTPChannel,79,10.1.8.1] [twistedcaldav.extensions#info] HEAD /calendars/users/abonnard/calendar/262f-4352-aae4-19aeff8d1e4c.ics HTTP/1.1 2009-03-31 15:38:23+0200 [-] [caldav-8008] [PooledMemCacheProtocol,client] [twistedcaldav.extensions#info] PROPFIND /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:38:24+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] OPTIONS /calendars/users/abonnard/ HTTP/1.1 2009-03-31 15:38:24+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] HEAD /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:38:24+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] REPORT /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:38:24+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] REPORT /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:38:24+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] REPORT /calendars/users/abonnard/calendar/ HTTP/1.1 2009-03-31 15:38:33+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] DELETE /calendars/users/abonnard/calendar/298bcef0-262f-4352-aae4-19aeff8d1e4c.ics HTTP/1.1 2009-03-31 15:38:33+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twisted.web2.dav.fileop#info] Deleting file /var/db/caldav/data/calendars/__uids__/c8/04/c804a264-62b4-5676-9f21-3637eb3e96e1/calendar/298bcef0-262f-4352-aae4-19aeff8d1e4c.ics 2009-03-31 15:38:35+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twistedcaldav.extensions#info] DELETE /calendars/users/abonnard/calendar/7f62916f-fbbc-477e-aaa7-44a747433895.ics HTTP/1.1 2009-03-31 15:38:36+0200 [-] [caldav-8008] [HTTPChannel,80,10.1.8.220] [twisted.web2.dav.fileop#info] Deleting file /var/db/caldav/data/calendars/__uids__/c8/04/c804a264-62b4-5676-9f21-3637eb3e96e1/calendar/7f62916f-fbbc-477e-aaa7-44a747433895.ics Directives inside the reverse proxy : ProxyPass /calendar/ http://calendar.xxx.com:8008/ ProxyPassReverse /calendar/ http://calendar.xxx.com:8008/ ProxyPreserveHost On #I must keep this directive for another reason. Thanks, -- Bastien Semene Administrateur Réseau & Système admin(a)cyanide-studio.com +33 (0)1 47 86 30 80 Cyanide S.A. 5, Boulevard des Bouvets 92000 Nanterre - FRANCE

1 0

CalendarServer + LDAP on linux
by Xavier Ambrosioni 31 Mar '09

31 Mar '09

Hi, I've just installed calendarserver on my ubuntu server and using the account.xml file for authentication everythink is ok. Now I would like to connect calendarserver to my OpenLDAP server hosted on ubuntu. My OpenLDAP server has the same schema as OpenDirectory and I manage my users/groups from my Mac using WorgroupManager from Apple. So I should have everythink in place on LDAP side. Is there a solution to connect calendarserver to LDAP ? From what I read opendirectory module doesn't exist on linux. Thank you in advance for your help Xavier

4 3

groups are not working after an update
by jean duffas 30 Mar '09

30 Mar '09

I recently tried to update my old darwincalendar server version to the latest one. everything is ok, except the groups. it says to me that there is no home calendar for each group... any idea ? jean duffas

1 1

launchd problems
by Pascal Robert 27 Mar '09

27 Mar '09

Hi, I'm trying out the launchd plist coming from trunk/contrib/launchd, and after modifying the path to caldavd and loading the plist, I get : exec python /usr/bin/twistd -n caldav Usage: twistd [options] Options: <snip> /usr/bin/twistd: Unknown command: caldav Program arguments in the plist : <key>ProgramArguments</key> <array> <string>/usr/local/CalendarServer/bin/caldavd</string> <string>-X</string> </array> If I change them to : <key>ProgramArguments</key> <array> <string>/usr/local/CalendarServer/run</string> <string>-d</string> </array> I get : /usr/local/CalendarServer/run: line 615: USER: unbound variable ------------------------------------------------------- Pascal Robert http://www.macti.ca http://www.aircourriel.com http://www.linkedin.com/in/macti Skype: MacTICanada AIM/iChat : MacTICanada

2 1

calendarserver on debian via nss and kerberos
by Marco Ghidinelli 24 Mar '09

24 Mar '09

hello, anyone was able to use calendarserver on debian 5 with users from nssswitch and authentication via SPNEGO/Kerberos? I followed the README.Debian, but with no results. using strace i found that the user was found from nss but it doesn't even try to open the /etc/krb5.keytab. any idea? where I am wrong? thanks, mg.

4 6

Documentation for Delegation
by C#4/135 D4/w!~ 08 Mar '09

08 Mar '09

<http://docs.info.apple.com/article.html?path=ServerAdmin/10.5/en/c2cs9.html > To learn how to configure calendar delegation, see the documentation for your calendar client. Where is the documentation for Apple's iCal? Thanks,

1 0

Re: [CalendarServer-users] calendarserver on debian via nss and kerberos
by Georg Troska 04 Mar '09

04 Mar '09

Hi Marco, it seems that kerberos does not work on your client or on your server the main interesting things might be:  <key>DirectoryService</key> <dict> <key>type</key> <string>twistedcaldav.directory.xmlfile.XMLDirectoryService</ string> <key>params</key> <dict> <key>xmlFile</key> <string>/etc/caldavd/accounts.xml</string> </dict> </dict>  <key>Authentication</key> <dict>  <key>Basic</key> <dict> <key>Enabled</key> <false/> </dict>  <key>Digest</key> <dict> <key>Enabled</key> <false/> <key>Algorithm</key> <string>md5</string> <key>Qop</key> <string></string> </dict>  <key>Kerberos</key> <dict> <key>Enabled</key> <true/> <key>ServicePrincipal</key> <string>http/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE </string> </dict> </dict>   <key>SSLCertificate</key> <string>/etc/ssl/certs/server07_crt.pem</string>  <key>SSLPrivateKey</key> <string>/etc/ssl/certs/server07_privatekey.pem</string> The accounts.xml looks like this: <!DOCTYPE accounts SYSTEM "accounts.dtd"> <accounts realm="E4 Calendars"> <user> <uid>User1</uid> <guid>User1</guid> <name>User1 Bla</name> </user> ... </accounts> root@server07:/etc/caldavd# klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 HTTP/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE 4 HTTP/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE 6 host/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE 6 host/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE 3 http/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE 3 http/server07.e4.physik.uni-dortmund.de(a)E4.PHYSIK.UNI-DORTMUND.DE root@server07:/etc/caldavd# You have to create your keytab with the administrative tools from your kerberos server I used kadmin for that. You need a hostticket a http and a HTTP ticket create them with a randkey commands are addprinc an ktadd Before doing that you should be sure that kerberos ist running well. Look if single-sign on works e.g. Georg Am 04.03.2009 um 13:09 schrieb Marco Ghidinelli: > On 03/04/2009 12:50 PM, Georg Troska wrote: >> Hi, > > hello georg, > >> have you tried to disable all other kinds of authorisation than >> kerberos? > > i tried, but when i do that it complains that: > > 2009-03-04 12:57:37+0100 [-] [caldav-8008] [HTTPChannel, > 0,192.168.0.29] "Client authentication scheme digest is not provided > by server ['negotiate']" > > and i got a 403 (forbidden) result. > > without the digest it doesn't work, so i have to keep it enabled. > > could you send me your configuration files? i fear that i just > forget something around. > > how you got your /etc/krb5.keytab? > > what is your output of: > klist -k /etc/krb5.keytab > ?? > > now i'm downloading the ubuntu server for replicating your running > environment. > > thank you very much.

1 0

Re: [CalendarServer-users] calendarserver on debian via nss and kerberos
by Marco Ghidinelli 03 Mar '09

03 Mar '09

On 03/03/2009 03:26 PM, Georg Troska wrote: > what does your error.log say? nothing useful from the logs: 2009-03-03 15:29:55+0100 [-] Log opened. 2009-03-03 15:29:55+0100 [-] twistd 8.1.0 (/usr/bin/python 2.5.2) starting up 2009-03-03 15:29:55+0100 [-] reactor class: <class 'twisted.internet.selectreactor.SelectReactor'> 2009-03-03 15:29:55+0100 [-] twistedcaldav.logging.AMPLoggingFactory starting on "'/var/run/caldavd/caldavd.socket'" 2009-03-03 15:29:55+0100 [-] [caldav-8008] /usr/lib/python2.5/site-packages/twisted/plugins/twisted_web2.py:22: DeprecationWarning: mktap and related support modules are deprecated as of Twisted 8.0. Use Twisted Application Plugins with the 'twistd' command directly, as described in 'Writing a Twisted Application Plugin for twistd' chapter of the Developer Guide. 2009-03-03 15:29:55+0100 [-] [caldav-8008] from twisted.scripts.mktap import _tapHelper 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] Log opened. 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] twistd 8.1.0 (/usr/bin/python 2.5.2) starting up 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] reactor class: <class 'twisted.internet.selectreactor.SelectReactor'> 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] twisted.web2.channel.http.HTTPFactory starting on 8008 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] Starting factory <twisted.web2.channel.http.HTTPFactory instance at 0x1f6bef0> 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] twisted.web2.channel.http.HTTPFactory starting on 8443 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] set uid/gid 103/105 2009-03-03 15:29:55+0100 [twistedcaldav.logging.AMPLoggingFactory] AMPLoggingProtocol connection established (HOST:UNIXSocket('/var/run/caldavd/caldavd.socket') PEER:UNIXSocket('')) 2009-03-03 15:29:55+0100 [-] [caldav-8008] [-] AMP connection established (HOST:UNIXSocket(None) PEER:UNIXSocket('/var/run/caldavd/caldavd.socket')) **** authentication here **** 2009-03-03 15:30:04+0100 [-] [caldav-8008] [HTTPChannel,0,192.168.0.29] "Directory service <SudoDirectoryService 'domain.net': FilePath('/etc/caldavd/sudoers.plist')> has no GUID; generating service GUID from realm name." 2009-03-03 15:30:04+0100 [-] [caldav-8008] [HTTPChannel,0,192.168.0.29] GET /calendars/users/marco.ghidinelli/ HTTP/1.1 2009-03-03 15:30:08+0100 [-] [caldav-8008] [HTTPChannel,0,192.168.0.29] GET /calendars/users/marco.ghidinelli/ HTTP/1.1 2009-03-03 15:30:08+0100 [-] [caldav-8008] [HTTPChannel,0,192.168.0.29] "Directory service <NssDirectoryService 'domain.net'> has no GUID; generating service GUID from realm name." 2009-03-03 15:30:08+0100 [-] [caldav-8008] [HTTPChannel,0,192.168.0.29] "Authentication failed: Incorrect credentials for <NssUserRecord[users(a)27a5f82b-c2bd-5387-8942-a62eb12bb26c(domain.net)] marco.ghidinelli(marco.ghidinelli) 'Marco Ghidinelli'>" > Am 03.03.2009 um 15:20 schrieb Marco Ghidinelli: > >> On 03/03/2009 02:14 PM, Georg Troska wrote: >>> Hi, >>> I was able to do it with Ubuntu Intrepid. >>> >>> Kerberos works. NSS not at the moment. I wrote a script that runs via >>> cronjob creating a xml-file from LDAP for the user information. >>> I'm still working on the NSS thing. >> >> i didn't understand: did nss works for you, but nss + kerberos doesn't >> authenticate, or nss doesn't work and so you didn't try nss+kerberos? >> >>> Use account.xml with no password and loginnames that are of the same >>> kind than in your kerberos database. Make sure that your keytab is >>> readable by caldavd and use lowercase http/ (not HTTP/) for the >>> principal entry. >> >> it's readable. i've tried with lowercase http, with the same results. >> >>> Kerberos based login are depending on your client as well. Which one are >>> you using? >> >> it doesn't work neither with sunbird nor with firefox >> (i've put in the network.negotiate-auth.trusted-uris "http://"). > > Georg Troska > Experimentelle Physik IV > TU Dortmund > +49 231 755 3501 >

1 0