Rights issue Radicale with Modoboa rights file #35

LauraRozier · 2018-07-16T15:59:28Z

When I try to manually log in to the Radicale server using their own web interface thing I seem to get a 401. (I fixed the issue with imap, btw, you now need to use a separate plugin for Radicale).
I also seem to be unable to create new agendas from within the Modoboa webclient (Using a mail-enabled user) I keep getting http/500 there, but probably a separate issue.

The log that I get when trying to access the calendars (A bit redacted, only changed the domain/tld):

[7f084d881780] INFO: PROPFIND request for '/' received from '217.100.199.170, 10.10.200.10' (forwarded by 127.0.0.1) using 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0'
[7f084d881780] DEBUG: Request headers:
{'CONTENT_LENGTH': '127',
 'CONTENT_TYPE': 'text/plain;charset=UTF-8',
 'HTTP_ACCEPT': '*/*',
 'HTTP_ACCEPT_ENCODING': 'gzip, deflate, br',
 'HTTP_ACCEPT_LANGUAGE': 'en-US,en;q=0.5',
 'HTTP_AUTHORIZATION': 'Basic **masked**',
 'HTTP_CONNECTION': 'close',
 'HTTP_COOKIE': '**masked**',
 'HTTP_HOST': 'localhost:5232',
 'HTTP_REFERER': 'https://mail.domain.tld/radicale/.web/',
 'HTTP_USER_AGENT': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) '
                    'Gecko/20100101 Firefox/61.0',
 'HTTP_X_FORWARDED_FOR': '217.100.199.170, 10.10.200.10',
 'HTTP_X_FORWARDED_HOST': 'mail.domain.tld',
 'HTTP_X_FORWARDED_PROTO': 'https',
 'HTTP_X_FORWARDED_SERVER': 'mail02.domain.tld',
 'HTTP_X_SCRIPT_NAME': '/radicale',
 'PATH_INFO': '/',
 'QUERY_STRING': '',
 'REMOTE_ADDR': '127.0.0.1',
 'REQUEST_METHOD': 'PROPFIND',
 'REQUEST_URI': '/',
 'SCRIPT_NAME': '',
 'SERVER_NAME': 'Mail02',
 'SERVER_PORT': '5232',
 'SERVER_PROTOCOL': 'HTTP/1.0',
 'UWSGI_APPID': 'localhost:5232|',
 'uwsgi.core': 0,
 'uwsgi.node': b'Mail02',
 'uwsgi.version': b'2.0.14-debian',
 'wsgi.errors': <_io.TextIOWrapper name=2 mode='w' encoding='UTF-8'>,
 'wsgi.file_wrapper': <built-in function uwsgi_sendfile>,
 'wsgi.input': <uwsgi._Input object at 0x7f084722cc90>,
 'wsgi.multiprocess': True,
 'wsgi.multithread': True,
 'wsgi.run_once': False,
 'wsgi.url_scheme': 'https',
 'wsgi.version': (1, 0)}
 
[7f084d881780] DEBUG: Script name overwritten by client: '/radicale'
[7f084d881780] DEBUG: Sanitized script name: '/radicale'
[7f084d881780] DEBUG: Sanitized path: '/'
[7f084d881780] INFO: Successful login: '[email protected]'

[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' doesn't match 'admin':'.*' from section 'sa-admin-acr'
[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' doesn't match '[email protected]':'domain1.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' doesn't match '[email protected]':'domain2.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' doesn't match '[email protected]':'domain.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' doesn't match '^(.+)@(.+)$':'{1}/.+$' from section 'domain-shared-calendars'
[7f084d881780] DEBUG: Rule '[email protected]':'[email protected]' matches '.+':'postmaster\\@domain\\.tld(/.*)?' from section 'owners-access'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match 'admin':'.*' from section 'sa-admin-acr'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain1.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain2.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '^(.+)@(.+)$':'{1}/.+$' from section 'domain-shared-calendars'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '.+':'postmaster\\@domain\\.tld(/.*)?' from section 'owners-access'
[7f084d881780] INFO: Rights: '[email protected]':'' doesn't match any section

[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match 'admin':'.*' from section 'sa-admin-acr'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain1.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain2.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '[email protected]':'domain.tld/user/.*' from section '[email protected]'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '^(.+)@(.+)$':'{1}/.+$' from section 'domain-shared-calendars'
[7f084d881780] DEBUG: Rule '[email protected]':'' doesn't match '.+':'postmaster\\@domain\\.tld(/.*)?' from section 'owners-access'
[7f084d881780] INFO: Rights: '[email protected]':'' doesn't match any section

[7f084d881780] INFO: Access to '/' denied for '[email protected]'
[7f084d881780] DEBUG: Response content:
Access to the requested resource forbidden.
[7f084d881780] INFO: PROPFIND response status for '/' in 4.573 seconds: 403 Forbidden
localhost:5232 [pid: 6868|app: 0|req: 7/15] 127.0.0.1 () {52 vars in 1075 bytes} [Mon Jul 16 17:46:55 2018] PROPFIND / => generated 61 bytes in 4572 msecs (HTTP/1.0 403) 3 headers in 111 bytes (1 switches on core 0)

The text was updated successfully, but these errors were encountered:

tonioo · 2018-07-17T07:05:49Z

@thibmo Have you checked rights file content?

LauraRozier · 2018-07-17T07:39:06Z

Yep, I'll post it here, too as reference.
I generated the rights file via the modoboa command python manage.py generate_rights --force

The config file

root@Mail02:~# cat /etc/radicale/config
[auth]
# Authentication method
# Value: None | htpasswd | radicale_imap | remote_user | http_x_remote_user
type = radicale_imap

# Radicale_IMAP Configuration
imap_host = mail.domain.tld:143
imap_secure = True

[rights]
# Rights backend
# Value: None | authenticated | owner_only | owner_write | from_file | custom
type = from_file

# Custom rights handler
#custom_handler =

# File for rights management from_file
file = /etc/modoboa_radicale/rights

[logging]
debug = True

The rights file

root@Mail02:~# cat /etc/modoboa_radicale/rights
# Rights management file for Radicale
# This file was generated by Modoboa on 2018-07-17 09:32:02.315145
# DO NOT EDIT MANUALLY!

[sa-admin-acr]
user = admin
collection = .*
permission = rw

[[email protected]]
user = [email protected]
collection = domain1.tld/user/.*
permission = rw

[[email protected]]
user = [email protected]
collection = domain2.tld/user/.*
permission = rw

[[email protected]]
user = [email protected]
collection = domain.tld/user/.*
permission = rw

# Access rule to domain shared calendars
[domain-shared-calendars]
user = ^(.+)@(.+)$
collection = {1}/.+$
permission = rw

# Read/Write permission for calendar owners
[owners-access]
user = .+
collection = %(login)s(/.*)?
permission = rw

The collection dir

root@Mail02:~# ls -la /var/lib/radicale/collections/
total 12
drwxrwxrwx 3 modoboa www-data 4096 Jul 16 17:18 .
drwxrwx--- 3 modoboa www-data 4096 Jul 16 17:18 ..
drwxrwxrwx 8 modoboa www-data 4096 Jul 16 17:32 collection-root
-rw-rw-rw- 1 modoboa www-data    0 Jul 16 17:44 .Radicale.lock
root@Mail02:~# ls -la /var/lib/radicale/collections/collection-root
total 32
drwxrwxrwx 8 modoboa www-data 4096 Jul 16 17:32 .
drwxrwxrwx 3 modoboa www-data 4096 Jul 16 17:18 ..
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:31 [email protected]
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:31 [email protected]
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:32 [email protected]
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:31 [email protected]
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:31 [email protected]
drwxrwxrwx 2 modoboa www-data 4096 Jul 16 17:18 [email protected]

tonioo · 2018-07-17T10:17:25Z

Which version of Radicale are you using?

LauraRozier · 2018-07-17T10:28:44Z

2.1.9

tonioo · 2018-07-18T12:50:10Z

And what calendar client do you use? Are you trying to access an owned calendar, or a shared one?

LauraRozier · 2018-07-18T13:48:29Z

I was using the Radicale's own webapp. With the Modoboa extention/webmail I only get the 500 errors.

tonioo · 2018-07-19T13:10:30Z

@thibmo How did you install the radicale plugin? Manually?

LauraRozier · 2018-07-21T18:07:45Z

Sorry for the late reply.

I installed it manually via:

sudo -u modoboa -i
bash
source env/bin/activate
cd instance/
pip install modoboa-radicale
python manage.py migrate
python manage.py collectstatic
python manage.py check --deploy

edit: Tried with the installer now, too. Same issue with modoboa giving a http 500 error when trying to create a calendar. (There also seem to be no default ones?)

tonioo · 2018-08-19T08:31:05Z

@thibmo The 500 error at creation might be due a bad certificate (ie self signed one or invalid certification chain)

LauraRozier · 2018-08-19T11:18:48Z

@tonioo Any way to retrieve this from a log?
I am using a wildcard certificate for the mailservers and webserver. I do have multiple domains, though.
I'll check and see if I can find an issue.

EDIT:
Enabled debugging and got this issue back:
ImportError at /api/v1/user-calendars/
cannot import name ical

Title	Value
Request Method:	POST
Request URL:	https://mail.server.tld/api/v1/user-calendars/
Django Version:	1.11.13
Exception Type:	ImportError
Exception Value:	cannot import name ical
Exception Location:	`/srv/modoboa/env/local/lib/python2.7/site-packages/modoboa_radicale/backends/caldav_.py in <module>, line 7`
Python Executable:	`/usr/bin/uwsgi-core`
Python Version:	2.7.13
Python Path:	`['.', '', '/srv/modoboa/env/lib/python2.7', '/srv/modoboa/env/lib/python2.7/plat-x86_64-linux-gnu', '/srv/modoboa/env/lib/python2.7/lib-tk', '/srv/modoboa/env/lib/python2.7/lib-old', '/srv/modoboa/env/lib/python2.7/lib-dynload', '/usr/lib/python2.7', '/usr/lib/python2.7/plat-x86_64-linux-gnu', '/usr/lib/python2.7/lib-tk', '/srv/modoboa/env/local/lib/python2.7/site-packages', '/srv/modoboa/env/lib/python2.7/site-packages']`
Server time:	Sun, 19 Aug 2018 15:07:39 +0200

LauraRozier · 2018-08-19T13:25:49Z

Right, so I found the issue here.
Caldav release 0.5.0 doesn't have ical.py, this was added after the release of 0.5.0: 0af268c9c40415e9c464d994ca35fe925f461baf

Edit: Also had to execute the followin gin the virt env: pip install icalendar
Edit 2: Now I get gateway timeouts.. not sure why this is happening.

LauraRozier · 2018-08-19T14:34:02Z

Perhaps it'd be easier if I provide you with some temp credentials, then you can have a look at how things are on my server and what the real issue is here.
(It's a Debian container, btw)

tonioo · 2018-08-19T14:36:08Z

@thibmo You need to install the fork we made of caldav. Look here: https://github.com/modoboa/caldav.

LauraRozier · 2018-08-19T15:08:36Z

Thanks for the reply.
Pulled your fork but still have the issue.

tonioo · 2018-08-20T13:42:33Z

@thibmo How did you install it?

LauraRozier · 2018-08-20T14:26:41Z

The current one (30 days ago from today): Using the modoboa installer.
Then I followed the steps of the recent comments. I downloaded your caldav fork via wget for each (raw) file.

tonioo · 2018-08-20T14:33:10Z

To make sure the installation is correct, you can execute the following command (with the virtualenv loaded):

pip install -e git+https://github.com/modoboa/caldav#egg=caldav

tonioo · 2018-08-20T14:33:22Z

And reload uwsgi of course.

mirtouf · 2018-10-29T19:22:36Z

Is it possible to test with a virtualenv based on python 3 ?
I used to have the same issue with python 2.7 but not the same version of modoboa and modoboa-radicale though.

LauraRozier · 2018-10-29T20:10:23Z

Sorry for the long wait.
Just installed the egg, fixed a TLS version issue (Seems I needed to switch it from PROTOCOL_TLSv1_2 to PROTOCOL_TLS.
I restarted supervisord and uwsgi but still get the 500 error.
I can create calendars but I can't do anything else with them.

When inspecting /srv/radicale/collections/collection-root I do see directories but no content, also .Radicale.lock is dated to Aug 19.
If I can do anything to test or if you need something delivered, do tell me. I'm glad to help.

mirtouf · 2018-10-29T20:26:14Z

Are you using uwsgi for spawning radicale ?

LauraRozier · 2018-10-29T20:27:49Z

I used to, but this didn't work, so I switched to supervisord (Which the installer setup, iirc)

mirtouf · 2018-10-29T20:33:38Z

Would you mind copying the configuration for supervisor you are using ?

LauraRozier · 2018-10-29T20:46:34Z

Sureo

root@mail02:~# cat /etc/supervisor/conf.d/radicale.conf
# This file was automatically installed on 2018-07-21T21:08:16.272886
[program:radicale]
autostart=true
autorestart=true
command=/srv/radicale/env/bin/radicale -C /etc/radicale/config
directory=/srv/radicale
redirect_stderr=true
user=radicale
numprocs=1

mirtouf · 2018-10-29T21:04:41Z

I can reproduce this behaviour.

LauraRozier · 2018-10-29T21:11:54Z

What setup are you using that fixed the issue?
I'm guessing Python 3 virt env based on your earlier reply..

mirtouf · 2018-10-29T21:13:29Z

It helps, give me a moment I am trying to figure out where it fails.

mirtouf · 2018-10-29T21:27:21Z

OK, here the steps to make it work:

use a python3 venv
install modoboa-radicale, radicale (and its imap plugin) and caldav as described by @tonioo
make radicale spawn with the method of your choice
delete all past calendars through modoboa interface
recreate calendars and events, it should work.
By the way, using a reverse proxy for accessing radicale web interface does not work in my setup.

LauraRozier · 2018-10-29T21:46:48Z

Could you perhaps share your steps?
Perhaps I did it all a bit too simplistic, but what I did: (Note, with this I still get the 500 after removing and recreating the calendars)

root@mail02:~# sudo -u modoboa -i
$ /bin/bash
modoboa@mail02:~$ source env/bin/activate
(env) modoboa@mail02:~$ cd instance/
(env) modoboa@mail02:~/instance$ pip3 install modoboa-radicale
(env) modoboa@mail02:~/instance$ pip3 install -e git+https://github.com/modoboa/caldav#egg=caldav
(env) modoboa@mail02:~/instance$ python manage.py migrate
(env) modoboa@mail02:~/instance$ python manage.py collectstatic
(env) modoboa@mail02:~/instance$ python manage.py check --deploy
root@mail02:~# service supervisor stop
root@mail02:~# service supervisor start
root@mail02:~# service uwsgi restart

When doing a ps aunxf I get:

// Snipped to only show relevant parts
Ss   22:38   0:00 /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
S    22:38   0:00  \_ /srv/radicale/env/bin/python3 /srv/radicale/env/bin/radicale -C /etc/radicale/config
S    22:38   0:00 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/automx_instance.ini --daemonize /var/log/uwsgi/app/automx_instance.log
S    22:38   0:00  \_ /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/automx_instance.ini --daemonize /var/log/uwsgi/app/automx_instance.log
S    22:38   0:00  \_ /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/automx_instance.ini --daemonize /var/log/uwsgi/app/automx_instance.log
S    22:38   0:00 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/modoboa_instance.ini --daemonize /var/log/uwsgi/app/modoboa_instance.log
S    22:38   0:01  \_ /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/modoboa_instance.ini --daemonize /var/log/uwsgi/app/modoboa_instance.log
S    22:38   0:01  \_ /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/modoboa_instance.ini --daemonize /var/log/uwsgi/app/modoboa_instance.log

mirtouf · 2018-10-29T22:01:48Z

Can you confirm you installed imap plugin for radicale ?

LauraRozier · 2018-10-29T22:10:01Z

I just double checked and saw it was missing, so I did the following:

root@mail02:~# sudo -u radicale -i
radicale@mail02:~$ pwd
/srv/radicale
radicale@mail02:~$ source env/bin/activate
(env) radicale@mail02:~$ pip3 install radicale-imap
root@mail02:~# service supervisor stop
root@mail02:~# service supervisor start
root@mail02:~# service uwsgi restart

Checked again, same issue when deleting, then recreating. I noticed that when creating it also ignores the given color.

tonioo · 2018-10-30T07:18:48Z

@thibmo And the error is still the same? Make sure you installed all the required Radicale plugins. You can check what the installer does: https://github.com/modoboa/modoboa-installer/blob/master/modoboa_installer/scripts/radicale.py#L30.

kryskool added help wanted question labels Oct 23, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rights issue Radicale with Modoboa rights file #35

Rights issue Radicale with Modoboa rights file #35

LauraRozier commented Jul 16, 2018 •

edited

Loading

tonioo commented Jul 17, 2018

LauraRozier commented Jul 17, 2018 •

edited

Loading

tonioo commented Jul 17, 2018

LauraRozier commented Jul 17, 2018

tonioo commented Jul 18, 2018

LauraRozier commented Jul 18, 2018

tonioo commented Jul 19, 2018

LauraRozier commented Jul 21, 2018 •

edited

Loading

tonioo commented Aug 19, 2018

LauraRozier commented Aug 19, 2018 •

edited

Loading

LauraRozier commented Aug 19, 2018 •

edited

Loading

LauraRozier commented Aug 19, 2018

tonioo commented Aug 19, 2018

LauraRozier commented Aug 19, 2018

tonioo commented Aug 20, 2018

LauraRozier commented Aug 20, 2018

tonioo commented Aug 20, 2018

tonioo commented Aug 20, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018 •

edited

Loading

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018 •

edited

Loading

tonioo commented Oct 30, 2018

Rights issue Radicale with Modoboa rights file #35

Rights issue Radicale with Modoboa rights file #35

Comments

LauraRozier commented Jul 16, 2018 • edited Loading

tonioo commented Jul 17, 2018

LauraRozier commented Jul 17, 2018 • edited Loading

tonioo commented Jul 17, 2018

LauraRozier commented Jul 17, 2018

tonioo commented Jul 18, 2018

LauraRozier commented Jul 18, 2018

tonioo commented Jul 19, 2018

LauraRozier commented Jul 21, 2018 • edited Loading

tonioo commented Aug 19, 2018

LauraRozier commented Aug 19, 2018 • edited Loading

LauraRozier commented Aug 19, 2018 • edited Loading

LauraRozier commented Aug 19, 2018

tonioo commented Aug 19, 2018

LauraRozier commented Aug 19, 2018

tonioo commented Aug 20, 2018

LauraRozier commented Aug 20, 2018

tonioo commented Aug 20, 2018

tonioo commented Aug 20, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018

mirtouf commented Oct 29, 2018

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018 • edited Loading

mirtouf commented Oct 29, 2018

LauraRozier commented Oct 29, 2018 • edited Loading

tonioo commented Oct 30, 2018

LauraRozier commented Jul 16, 2018 •

edited

Loading

LauraRozier commented Jul 17, 2018 •

edited

Loading

LauraRozier commented Jul 21, 2018 •

edited

Loading

LauraRozier commented Aug 19, 2018 •

edited

Loading

LauraRozier commented Aug 19, 2018 •

edited

Loading

LauraRozier commented Oct 29, 2018 •

edited

Loading

LauraRozier commented Oct 29, 2018 •

edited

Loading