Martin Krellmann <martink>, did you have any progress with updating your patch?

I fill similar feature request https://savannah.nongnu.org/bugs/index.php?57589 about support custom authorization header text, can you lookup it? Maybe you can add this feature too to your contribution? Thanks!

Hi.
I did not have time to come back to this yet. Might be that my file was outdated.

Yep, I'm pretty sure these cookies are only valid for OneDrive4Business. But, you should be able to identify the correct cookie for the normal OneDrive by inspecting the session cookies within an authorized session. (Using Chrome Developer Tools or similar.)

I recently found out that you can run PowerShell Scripts on linux and there should also be a official .NET framework from Microsoft. So I have the idea to use the login portion of the PowerShell script from my original post to create that cookie file by a cron job. Then you can just use it...

Anyway, with this type of intjection it might be necessary to have a more advanced cookie handling and storage. I'm not sure if it will run out of the box with the current code.

Hi.

This is not a bug report, it is a contribution.

I finally made davfs2 working with OneDrive and wanted to share my complete findings. It took me three aprroaches and a lot of reading. However, the solution I'd like to come up with is very easy and there are only small changes in the original code.

1st Approach:
The starting point was a precompiled version of davfs2 from the debian repos. I set it up, made my config and - oh dear - it did not work. Thus, I made the logs more verbose and studied the HTTP requests and responses. OneDrive servers are supposed to initiate a NTLM challenge but did not. They just send a 403 unathorized with a X-FORMS_BASED_AUTH_REQUIRED header set to an error page. Microsoft has implemented OAuth2 or MS-OFBA protocol as a standard authentication procedure for Office Online services. I've played around with some options to try forcing NTLM. However, this did not work either. You can get a redirect response if you add "Mozilla/4.0" in the client string. Wich identifies you as a browser client. But I think grabbing content from webpages is not feasible. I decided to extend libneon to try forcing NTLM auth in some way. While googling for that header I came to these pages:
https://msdn.microsoft.com/en-us/library/dd932522(v=office.12).aspx
https://msdn.microsoft.com/en-us/library/dd773463(v=office.12).aspx
On the latter you can find that setting "X-FORMS_BASED_AUTH_ACCEPTED: f" in your request will force NTLM authentication. This indeed works and leads to a NTLM challenge. But guess what... You cannot login.

2nd approach:
Therefore I extended libneon a bit further to get some more debug infomration regarding that NTLM challenge. I compared the messages to numerous docs and they seem to be (more or less) correct. The responses from the MS Server seem to have NTLMv2 Target Information blocks set. But, the flags indicate a NTLMv1 challenge. I guess there is something wrong with the username format (user@tenant.onmicrosoft.com) or you can use NTLM only if you integrate OneDrive4B with your own AD server.

3rd approach:
On some wepages or forums you can find the information that previously loggin in by a webbrowser and then using a different dav client (I forgot the name) works on linux. This brought me to the final idea: Wy not injecting the auth cookie to the davfs2 session? And voila this indeed worked!

Before I present the code I'd like to share some more resources I found:
https://gitlab.com/Lieben/OnedriveMapper_V3/blob/master/OneDriveMapper.ps1
http://www.lieben.nu/liebensraum/onedrivemapper/
This is a OneDrive "client" for Windows (similar to davfs2) using PowerShell. It maps a drive letter to OneDrive and reveals uses that OAuth2 procedure (or so called federated logins where auth is done by the servers of your company).
Maybe one can port this auth scheme into libneon (I guess I should post ot there too).

https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/authentication
https://msdn.microsoft.com/en-us/library/office/cc313069(v=office.12).aspx
These two resources contain everything about the MSOFBA protocol.

Okay... enough of this :)

The solution:
First you must create a login cookie by logging in to you one drive with a webbrowser and exporting the cookies of this session. (I've used chrome and the cookie.txt plugin) Thus you get some cookies of which you need only two: "rtFa" and "FedAuth". You must have both of them set in the requests! I've placed them in a text file in the davfs2 config directory which has the following sheme: [name]=[value]; [name]=[value]; Because of how my code uses that text there are no newlines or any other characters allowed at the end or beginning. (It is directly added to the requests header and the format will get corrupted otherwise)
Then I've added a special secret to the secrets file: [sharename] "@cookie" "/path/to/cookie/file"
Thus you have "@cookie" as username and "/path/to..." as password in the program.
Set use_locks to 0 in the config file. (Otherwise you cannot write to the mount)

Now I have extended webdav.c:
- added public variable (ln. 257): static char *auth_cookies;
- extended dav_init_webdav to bypass auth, read cookie file and copy its contents to auth_cookies
- extended get_cookies to copy Set-Cookie headers to auth_cookies and not to cookie_list if the names match the names in auth_cookies
- extended add_header to copy auth_cookies contents into the requests header

Because Set-Cookie is used to update auth_cookies you should always have a fresh copy it if there are any changes by the server. However, writing the buffer back to the cookie file is not yet implemented in my code. This should be done on a timed basis or at least on exit. I will add this.

I think it is a good ideas to keep that "X-FORMS_BASED_AUTH_ACCEPTED: f" header until somebody implemented oauth2/msofba for libneon. Maybe anybody can find out how NTLM would work. I still have it hardcoded in libneon so it is not yet in webdav.c. But, I think it should be added to the custom_header list. Which is just a matter of configuration.

Hint: To get full log output of the auth session from libneon you must set both flags: NE_DBG_HTTP and NE_DBG_HTTPAUTH

The code is attached as a file. But I'm not sure if it will compile with the default repo version (I made some changes in the first place and do not know if they are fully reverted). If not just copy the mentioned functions and add that variable.

Best regards and have fun with it!
Martin.