bugdavfs2 - Bugs: bug #52224, Working OneDrive implementation

 
 

bug #52224: Working OneDrive implementation

Submitted by:  Martin Krellmann <martink>
Submitted on:  Fri 13 Oct 2017 11:10:54 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 13 Oct 2017 11:10:54 AM UTC, original submission:

Hi.

This is not a bug report, it is a contribution.

I finally made davfs2 working with OneDrive and wanted to share my complete findings. It took me three aprroaches and a lot of reading. However, the solution I'd like to come up with is very easy and there are only small changes in the original code.

1st Approach:
The starting point was a precompiled version of davfs2 from the debian repos. I set it up, made my config and - oh dear - it did not work. Thus, I made the logs more verbose and studied the HTTP requests and responses. OneDrive servers are supposed to initiate a NTLM challenge but did not. They just send a 403 unathorized with a X-FORMS_BASED_AUTH_REQUIRED header set to an error page. Microsoft has implemented OAuth2 or MS-OFBA protocol as a standard authentication procedure for Office Online services. I've played around with some options to try forcing NTLM. However, this did not work either. You can get a redirect response if you add "Mozilla/4.0" in the client string. Wich identifies you as a browser client. But I think grabbing content from webpages is not feasible. I decided to extend libneon to try forcing NTLM auth in some way. While googling for that header I came to these pages:
https://msdn.microsoft.com/en-us/library/dd932522(v=office.12).aspx
https://msdn.microsoft.com/en-us/library/dd773463(v=office.12).aspx
On the latter you can find that setting "X-FORMS_BASED_AUTH_ACCEPTED: f" in your request will force NTLM authentication. This indeed works and leads to a NTLM challenge. But guess what... You cannot login.

2nd approach:
Therefore I extended libneon a bit further to get some more debug infomration regarding that NTLM challenge. I compared the messages to numerous docs and they seem to be (more or less) correct. The responses from the MS Server seem to have NTLMv2 Target Information blocks set. But, the flags indicate a NTLMv1 challenge. I guess there is something wrong with the username format (user@tenant.onmicrosoft.com) or you can use NTLM only if you integrate OneDrive4B with your own AD server.

3rd approach:
On some wepages or forums you can find the information that previously loggin in by a webbrowser and then using a different dav client (I forgot the name) works on linux. This brought me to the final idea: Wy not injecting the auth cookie to the davfs2 session? And voila this indeed worked!

Before I present the code I'd like to share some more resources I found:
https://gitlab.com/Lieben/OnedriveMapper_V3/blob/master/OneDriveMapper.ps1
http://www.lieben.nu/liebensraum/onedrivemapper/
This is a OneDrive "client" for Windows (similar to davfs2) using PowerShell. It maps a drive letter to OneDrive and reveals uses that OAuth2 procedure (or so called federated logins where auth is done by the servers of your company).
Maybe one can port this auth scheme into libneon (I guess I should post ot there too).

https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/authentication
https://msdn.microsoft.com/en-us/library/office/cc313069(v=office.12).aspx
These two resources contain everything about the MSOFBA protocol.

Okay... enough of this :)

The solution:
First you must create a login cookie by logging in to you one drive with a webbrowser and exporting the cookies of this session. (I've used chrome and the cookie.txt plugin) Thus you get some cookies of which you need only two: "rtFa" and "FedAuth". You must have both of them set in the requests! I've placed them in a text file in the davfs2 config directory which has the following sheme: [name]=[value]; [name]=[value]; Because of how my code uses that text there are no newlines or any other characters allowed at the end or beginning. (It is directly added to the requests header and the format will get corrupted otherwise)
Then I've added a special secret to the secrets file: [sharename] "@cookie" "/path/to/cookie/file"
Thus you have "@cookie" as username and "/path/to..." as password in the program.
Set use_locks to 0 in the config file. (Otherwise you cannot write to the mount)

Now I have extended webdav.c:
- added public variable (ln. 257): static char *auth_cookies;
- extended dav_init_webdav to bypass auth, read cookie file and copy its contents to auth_cookies
- extended get_cookies to copy Set-Cookie headers to auth_cookies and not to cookie_list if the names match the names in auth_cookies
- extended add_header to copy auth_cookies contents into the requests header

Because Set-Cookie is used to update auth_cookies you should always have a fresh copy it if there are any changes by the server. However, writing the buffer back to the cookie file is not yet implemented in my code. This should be done on a timed basis or at least on exit. I will add this.

I think it is a good ideas to keep that "X-FORMS_BASED_AUTH_ACCEPTED: f" header until somebody implemented oauth2/msofba for libneon. Maybe anybody can find out how NTLM would work. I still have it hardcoded in libneon so it is not yet in webdav.c. But, I think it should be added to the custom_header list. Which is just a matter of configuration.

Hint: To get full log output of the auth session from libneon you must set both flags: NE_DBG_HTTP and NE_DBG_HTTPAUTH

The code is attached as a file. But I'm not sure if it will compile with the default repo version (I made some changes in the first place and do not know if they are fully reverted). If not just copy the mentioned functions and add that variable.

Best regards and have fun with it!
Martin.

Martin Krellmann <martink>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #42138:  webdav.c added by martink (53KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by martink (Submitted the item)
  • -unavailable- added by martink
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 13 Oct 2017 11:10:54 AM UTCmartinkAttached File-=>Added webdav.c, #42138
      Carbon-Copy-=>Added wbaumann

    Back to the top


    Powered by Savane 3.1-cleanup1