Bad 301 redirect without fastmailsharing

[dilyanpalauzov]

http_dav.c:calcarddav_parse_path() does:

/* Check for FastMail legacy sharing URLs and redirect */
if (httpd_userid && !config_getswitch(IMAPOPT_FASTMAILSHARING) &&
    tgt->flags != TGT_DAV_SHARED &&
    !mboxname_userownsmailbox(httpd_userid, mboxname)) {
    buf_reset(&redirect_buf);
    buf_printf(&redirect_buf, "%s/%s/%s/%s%c%s",
             tgt->namespace->prefix, USER_COLLECTION_PREFIX,
             httpd_userid, tgt->userid, SHARED_COLLECTION_DELIM,
             tgt->collection);
    *resultstr = buf_cstring(&redirect_buf);
    ret = HTTP_MOVED;
    goto done;
}

When a is an administrator, calling

curl -v -HDepth:0 -XPROPFIND -H"content-type:application/xml" -ua:a http://127.0.0.3/dav/calendars/user/test/Default/

sets above *resultstr= "/dav/calendars/user/a/test.Default/ and does

HTTP/1.1 301 Moved Permanently
Location: /dav/calendars/user/a/test.Default/

likewise

$ curl -v -HDepth:0 -XPROPFIND -H"content-type:application/xml" -ua:a http://127.0.0.3/dav/calendars/user/test/

sets *resultstr = "/dav/calendars/user/a/test.(null)" and the result is:

HTTP/1.1 301 Moved Permanently
Location: /dav/calendars/user/a/test.(null)

The URLs ase invalid: /dav/calendars/user/a does not exist.

[dilyanpalauzov]

This is actually very similar to #3205 , but it prevents implementing #3403 - when the administrator does PROPPATCH it wants to changes the properties, as if they were modified by the owner (not masked for the authenticated user). But cannot, because the administrator is redirected to invalid URL.

[ksmurchison]

So, Cyrus allows HTTP proxy authentication for admins by using the Cyrus-specific Authorize-As header in the request. However, its currently only allowed when talking to backend servers in a murder. I think proxy auth (like we have for IMAP) is a better way to go rather than just assuming that an admin wants to operate as the owner of a resource. This would also work for both DAV and JMAP without changing any other code.

@brong @rsto Any thoughts on allowing proxy auth (admins only) to standalone servers?

[dilyanpalauzov]

I do not understand why the snippet above is necessary — there should be no redirect and that’s it. When does this redirect make sense?