Mailing List Archive

Evolution CardDav plugin
I want to write a carddav plugin for evolution and have some questions.

1) I'm a bit confused about how to implement the MKCOL in a UI
and how to represent child collections.

2) Somewhere in the spec it says you can have a parent
collection with child collections,
but the parent collections can't have any addressbook
items in it if it has any child collections. Is that right?

3) The carddav spec explains that, if SRV records are used, the client
should only need
A) the server-name (not URL)
B) the username and password,
then it should automatically select the 'default'
addressbook collection (e.g. Contacts) for the user's account.
This implies that any carddav server SHALL have SRV records for this
mode to work,
but the spec doesn't specifically REQUIRE SRV records for a carddav
server.
So, if there is no SRV record, how should the UI collect the URL
instead of just the server-name? There are disjoint concepts here.

4) In Evolution, I'm thinking that there should be a separate CardDAV
plugin
that asks for only the username and password,
then shows all of the visible collections, including public collections,
in a subtree under the carddav's addressbook entry
(in the left column list of addressbooks)
of course, it would only show collections that are actually of
addressbook type

5) Each collection (or addressbook) could have options
(as they do now, however they would be child-addressbooks
under the account), one of which would be selectable as
the default addressbook. By automatically adding all available
addressbooks,
a user won't have to add each addressbook individually.
Perhaps an option menu under the webdav-server entry
(parent to the subtree of collections) would allow a user
to select which addressbook collections to show or hide and
an option to automatically show new collections that are
available for instance when a different user gives you
access to see his or her addressbook.

6) If all of (5) sounds fine, then how do you handle nested
addressbooks:
child collections of children of the root.
Does davical support nested collections?
Should public, read-only, and writable addressbooks be shown in
separate groups under the CardDAV server entry (in the left column)?

7) I'm also unclear on how public addressbooks are to be handled.
Read-only carddav addressbooks also need to be supported,
at present evolution doesn't seem to handle read-only very
well other than erroring out when you try to make a change
to an entry in a read-only addressbook.
A) Should all public addressbooks appear under the subtree
alongside your private addressbooks if you are
authenticated with a server?
B) If you don't have a username and password on a server,
should the webdav plugin automatically show all
public addressbooks on a server?

8) How are username and password exchanged via CardDAV?
Is there any kind of hash used for the password
or is it sent cleartext if the server isn't using SSL?

>K
Evolution CardDav plugin [ In reply to ]
On Wed, 2011-01-19 at 18:21 -0600, Kirk Wolff wrote:
> I want to write a carddav plugin for evolution and have some questions.
>
> 1) I'm a bit confused about how to implement the MKCOL in a UI
> and how to represent child collections.

Some of these specs can be confusing stuff - it's like they're using a
dialect of some language that looks almost exactly like English, but is
something else entirely...


> 2) Somewhere in the spec it says you can have a parent
> collection with child collections,
> but the parent collections can't have any addressbook
> items in it if it has any child collections. Is that right?

No, it's saying the addressbook collections must not have other
collections. Collections normally *can* contain collections, but
addressbook (and calendar) collections aren't allowed to do this.


> 3) The carddav spec explains that, if SRV records are used, the client
> should only need
> A) the server-name (not URL)
> B) the username and password,
> then it should automatically select the 'default'
> addressbook collection (e.g. Contacts) for the user's account.
> This implies that any carddav server SHALL have SRV records for this
> mode to work, but the spec doesn't specifically REQUIRE SRV records for a carddav
> server.
> So, if there is no SRV record, how should the UI collect the URL
> instead of just the server-name? There are disjoint concepts here.

Yes. I think this is a bug in the spec in some ways. You can't require
a CardDAV server to have SRV records because SRV records are something
that a different server does... a domain name server, in fact.

It can be nice to have SRV records, because it makes discovery easy for
the client side, but on the other hand it can be a right old pain to
setup in lightweight environments.

So I think the client software should always fall back to trying the
domain name it's been given, if the SRV records didn't work (or if
you're coding in Java on an Android and can't work out how to even query
SRV records :-)


> 4) In Evolution, I'm thinking that there should be a separate CardDAV
> plugin
> that asks for only the username and password,
> then shows all of the visible collections, including public collections,
> in a subtree under the carddav's addressbook entry
> (in the left column list of addressbooks)
> of course, it would only show collections that are actually of
> addressbook type

That would be just awesome.


> 5) Each collection (or addressbook) could have options
> (as they do now, however they would be child-addressbooks
> under the account), one of which would be selectable as
> the default addressbook. By automatically adding all available
> addressbooks, a user won't have to add each addressbook individually.
> Perhaps an option menu under the webdav-server entry
> (parent to the subtree of collections) would allow a user
> to select which addressbook collections to show or hide and
> an option to automatically show new collections that are
> available for instance when a different user gives you
> access to see his or her addressbook.

I think this is how it should be done, although I think the only
automatically added ones should be the ones that this user owns, and
maybe a site-wide one. The user should need to take some further action
to see other people's addressbooks, even when they do have access.


> 6) If all of (5) sounds fine, then how do you handle nested
> addressbooks:
> child collections of children of the root.

Well, no... see (2) :-)

> Does davical support nested collections?

It's explicitly caught and generates an error.


> Should public, read-only, and writable addressbooks be shown in
> separate groups under the CardDAV server entry (in the left column)?

I think one nice way is to show a separate tree for "addressbooks you
have access to" separate to "your addressbooks".


> 7) I'm also unclear on how public addressbooks are to be handled.
> Read-only carddav addressbooks also need to be supported,
> at present evolution doesn't seem to handle read-only very
> well other than erroring out when you try to make a change
> to an entry in a read-only addressbook.
> A) Should all public addressbooks appear under the subtree
> alongside your private addressbooks if you are
> authenticated with a server?
> B) If you don't have a username and password on a server,
> should the webdav plugin automatically show all
> public addressbooks on a server?

Some of these questions might be better asked on the Evolution list.
The erroring out situation might be able to be improved if the
information about whether the addressbook is read-only is actually
propagated further than at present.


> 8) How are username and password exchanged via CardDAV?
> Is there any kind of hash used for the password
> or is it sent cleartext if the server isn't using SSL?


These things are inherited from DAV, which in turn inherits them from
HTTP, so you can use the standard methods from HTTP. In general DAViCal
uses basic auth (hopefully over SSL) though it does also support Digest
authentication. Digest authentication will only work if the password is
stored in plaintext in the database (though I'd be happy to be proved
wrong on that) so if you want to use fancy authentication schemes it's
better to use something like Kerberos as an external authentication
mechanism - probably handled in the webserver.

Cheers,
Andrew.
--
------------------------------------------------------------------------
andrew (AT) morphoss (DOT) com +64(272)DEBIAN
Though a superhero, Bruce Schneier disdains the use of a mask or secret
identity as 'security through obscurity'.

------------------------------------------------------------------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <http://lists.davical.org/pipermail/davical-dev/attachments/20110120/27b7d9d5/attachment.pgp>
Evolution CardDav plugin [ In reply to ]
On Jan 20, 2011, at 4:44 AM, Andrew McMillan wrote:
>
> Digest authentication will only work if the password is
> stored in plaintext in the database (though I'd be happy to be proved
> wrong on that)

I believe you can store md5(username:realm:password) in the DB and use that for digest auth.

Wikipedia says that's what JBoss does, and it looks like apache2 htdigest does that too (although I didn't check the code to see if that's what it's really doing).

--
Daniel J. Luke
+========================================================+
| *---------------- dluke at geeklair.net ----------------* |
| *-------------- http://www.geeklair.net -------------* |
+========================================================+
| Opinions expressed are mine and do not necessarily |
| reflect the opinions of my employer. |
+========================================================+