nextcloud
Support webcal http auth & store credentials
Ideally :
- Have a checkbox "Provide credentials" beneath the url input field
- Show login and password beneath when it's checked
- Save credentials in the app. Secured enough ?
- Perform the proxy request and provide these credentials in the headers
What do you think ? @georgehrke @raghunayyar
Regarding security/storing of credentials @LukasReschke should have look too I guess.
Well, you can already store credentials by putting them in the url with user:password@url, The problem is, that a user with whom the calendar is shared is will see the credentials. But as the webcal is fetched by the browser, you would not be able to share password protected webcal calendars (without sharing the auth as well)
I wonder if webcal calendars should be shared anyway, since you can just give the link to other people.
Sharing it is still way easier than telling someone to copy and paste that url into the new subscription field.
Well, you can already store credentials by putting them in the url with user:password@url
Right now ? Doesn't work for me, maybe because it seems http:// gets added on front.
I have also a problem, that I have to put ht eusername and password in the URL. ...and I have a non standard.port for my cloud.
This result in a URL für webdav: webdav://username:password/example.to:1234/cloud/remote.php/dav/calendar.ics
Outlook can't get the calendar. Error: "Der Internetkalender kann in Outlook nicht überprüft oder hinzugefügt werden. Setellen sie sicher, dass der Hyperlink ein gültiger Kalenderhyperlink ist.
Any suggestions? Or is this not supported (credentials + special port)
I would like to subscribe to another Nextcloud calendar so I tried to subscribe with the following URL:
http://USERNAME:PASSWORD@HOST/remote.php/dav/calendars/USERNAME/CALENDARNAME?export
The first request works without any problems but any further requests are sent without a password. When I check the WebCal-Address it looks like this:
http://USERNAME@HOST/remote.php/dav/calendars/USERNAME/CALENDARNAME?export
Is there any security mechanisms which prevent that the password is remaining in the URL?
@wuethrich44 Not that I know of, but you should publish the calendar on the other end and then subscribe to it's public url.
@tcitworld Ok that could be an approach but I don't have admin rights in the other server so I can't make the calendar public.
You don't need admin rights, just regular user access that you seem to have.
As stated in Issue #287 it should be possible to retrieve a WebCal calendar via HTTPS. For me it does not work, if I need authentication at the same time.
If I subscribe to
https://USERNAME:PASSWORD@HOST/url/to/calendar
the App changes the URL after creation to
https://USERNAME@HOST/url/to/calendar,
which obviously ends in a
The remote server did not give us access to the calendar (HTTP {403} error).
Am I doing something wrong? How can I subscribe to a calendar with authentication and HTTPS?
I've observed the same behavior. I use the following link to share the calendar:
For me , the password is intact as source in the oc_calendarsubscriptions table. But not in the url used for the proxy.
Maybe the calender can check for the 401 code and then ask the user for user/password?
Beside this it would be cool if subscribing has an option to sync the remote calendar into a local one so one is able to share this calendar with others by using a local one...
Maybe the calender can check for the 401 code and then ask the user for user/password?
Yes, that's what this ticket is about :)
Beside this it would be cool if subscribing has an option to sync the remote calendar into a local one so one is able to share this calendar with others by using a local one...
This would be an issue that belongs into the server repository. See: https://github.com/nextcloud/server/issues/1497 https://github.com/nextcloud/server/issues/1600
For me , the password is intact as source in the oc_calendarsubscriptions table. But not in the url used for the proxy.
@elgaard It's because the method build of the sabre\uri library contains :
$authority = $parts['user'] . '@' . $authority;
and should maybe be :
$authority = $parts['user'] . ':' . $parts['pass'] . '@' . $authority;
I'v tried and i was able to import my calendar.
@pepea28 Would you care to open a PR to the https://github.com/sabre-io/uri/ repository ?
So what is the state of this issue? (i.e. that the password is removed when it is requested by the proxy) I see none of your PRs are merged, @tcitworld…
Or is there at least any workaround one can try?
FYI the Nextcloud "news" app does have a similar UI as proposed in the OP (with a field for username/password).
I also need this feature. Could the according PRs please be merged?
What PRs?
It turns out that you can now actually use user:password with https links. I'm unable to reproduce the issue where sabre strips the password for https but not for http.
So the remaining part is storing the auth values separately but also the sharing. Even if we have a separate storage for credentials, you would currently have to expose them to the sharees so they are able to sync. Unless they have to submit their own password, but that kind of defeats the purpose of sharing. So that one make https://github.com/nextcloud/server/issues/1600 a lot more complex.
That's odd, I don't see how this could work since not much has changed since then. Will try to reproduce.
Even if we have a separate storage for credentials, you would currently have to expose them to the sharees so they are able to sync.
Subscriptions are exposed as regular calendars inside this app because they are cached on server, so we could make sure they don't expose auth information (currently probably accessible through href and default displayname).
We could do the same for any CalDAV client as long as the subscription URI contains credentials. In that case, we wouldn't need to worry about storing the auth values separately or how to handle sharing.
See https://github.com/nextcloud/server/blob/decb70b9ac6048e72305154af841271902f6b10c/apps/dav/lib/CalDAV/CalendarHome.php#L107-L116
Okay, so you would allow sharees to see the cached calendar, but they will be unable to refresh it, right?
No one can refresh the cached calendar subscriptions right now anyway.
This is either defined by the calendar data itself through REFRESH-INTERVAL or X-PUBLISHED-TTL icalendar keys, or fallback to the value defined by the calendarSubscriptionRefreshRate app setting (defaults to one week).
Oh, then I simply read an outdated comment about the sync happening just in the browser. Thanks for the clarification.
Didn't see an answer while scrolling this thread: what if my username is an email address? The Webcal log-in should be:
[email protected]:password@http://example.com/webdav
I think the email ampersand (@) confuses NextCloud. I get an error that says:
Please enter a valid link (starting with http://, https://, webcal://, or webcals://)
