bugdavfs2 - Bugs: bug #52224, Working OneDrive implementation

 
 

bug #52224: Working OneDrive implementation

Submitter:  Martin Krellmann <martink>
Submitted:  Fri 13 Oct 2017 11:10:54 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 13 Jan 2020 07:53:16 AM UTC, comment #4: 

Martin Krellmann <martink>, did you have any progress with updating your patch?

I fill similar feature request https://savannah.nongnu.org/bugs/index.php?57589 about support custom authorization header text, can you lookup it? Maybe you can add this feature too to your contribution? Thanks!

Alexey Murz Korepov <murz>
Fri 11 May 2018 09:48:44 AM UTC, comment #3: 

Hi
i found this little tool
https://github.com/yulahuyed/test
for generating the cookie. Connecting with this cookie then works great, but i'm missing folders and files with special chars liek ä,ö or ü. Other chars like & or ' are working.
Setting server_charset in davfs2.conf doesn't change anything (or at least not with the values i tried "utf8", "ansi", "Iso-8859-1", "Iso8859-1")
Thanks
Tobi

ts <royalts>
Thu 28 Dec 2017 04:15:14 PM UTC, comment #2: 

Hi.
I did not have time to come back to this yet. Might be that my file was outdated.

Yep, I'm pretty sure these cookies are only valid for OneDrive4Business. But, you should be able to identify the correct cookie for the normal OneDrive by inspecting the session cookies within an authorized session. (Using Chrome Developer Tools or similar.)

I recently found out that you can run PowerShell Scripts on linux and there should also be a official .NET framework from Microsoft. So I have the idea to use the login portion of the PowerShell script from my original post to create that cookie file by a cron job. Then you can just use it...

Anyway, with this type of intjection it might be necessary to have a more advanced cookie handling and storage. I'm not sure if it will run out of the box with the current code.


Martin Krellmann <martink>
Wed 29 Nov 2017 01:30:24 AM UTC, comment #1: 

It seems your webdav.c is from an ancient version. I tried to rebase to 1.5.4, changing xmalloc to malloc and xstrndup to ne_strndup to compile without additional includes.

This compiles cleanly for me. However, I can't mount any shares currently, getting a "400 Bad Request". I'm sure this is related to the cookies that I'm using: I don't even have "rtFa" and "FedAuth". I think those are only used for Onedrive for Business and different cookies are needed for OneDrive Personal.

Anonymous
Fri 13 Oct 2017 11:10:54 AM UTC, original submission:  

Hi.

This is not a bug report, it is a contribution.

I finally made davfs2 working with OneDrive and wanted to share my complete findings. It took me three aprroaches and a lot of reading. However, the solution I'd like to come up with is very easy and there are only small changes in the original code.

1st Approach:
The starting point was a precompiled version of davfs2 from the debian repos. I set it up, made my config and - oh dear - it did not work. Thus, I made the logs more verbose and studied the HTTP requests and responses. OneDrive servers are supposed to initiate a NTLM challenge but did not. They just send a 403 unathorized with a X-FORMS_BASED_AUTH_REQUIRED header set to an error page. Microsoft has implemented OAuth2 or MS-OFBA protocol as a standard authentication procedure for Office Online services. I've played around with some options to try forcing NTLM. However, this did not work either. You can get a redirect response if you add "Mozilla/4.0" in the client string. Wich identifies you as a browser client. But I think grabbing content from webpages is not feasible. I decided to extend libneon to try forcing NTLM auth in some way. While googling for that header I came to these pages:
https://msdn.microsoft.com/en-us/library/dd932522(v=office.12).aspx
https://msdn.microsoft.com/en-us/library/dd773463(v=office.12).aspx
On the latter you can find that setting "X-FORMS_BASED_AUTH_ACCEPTED: f" in your request will force NTLM authentication. This indeed works and leads to a NTLM challenge. But guess what... You cannot login.

2nd approach:
Therefore I extended libneon a bit further to get some more debug infomration regarding that NTLM challenge. I compared the messages to numerous docs and they seem to be (more or less) correct. The responses from the MS Server seem to have NTLMv2 Target Information blocks set. But, the flags indicate a NTLMv1 challenge. I guess there is something wrong with the username format (user@tenant.onmicrosoft.com) or you can use NTLM only if you integrate OneDrive4B with your own AD server.

3rd approach:
On some wepages or forums you can find the information that previously loggin in by a webbrowser and then using a different dav client (I forgot the name) works on linux. This brought me to the final idea: Wy not injecting the auth cookie to the davfs2 session? And voila this indeed worked!

Before I present the code I'd like to share some more resources I found:
https://gitlab.com/Lieben/OnedriveMapper_V3/blob/master/OneDriveMapper.ps1
http://www.lieben.nu/liebensraum/onedrivemapper/
This is a OneDrive "client" for Windows (similar to davfs2) using PowerShell. It maps a drive letter to OneDrive and reveals uses that OAuth2 procedure (or so called federated logins where auth is done by the servers of your company).
Maybe one can port this auth scheme into libneon (I guess I should post ot there too).

https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/authentication
https://msdn.microsoft.com/en-us/library/office/cc313069(v=office.12).aspx
These two resources contain everything about the MSOFBA protocol.

Okay... enough of this :)

The solution:
First you must create a login cookie by logging in to you one drive with a webbrowser and exporting the cookies of this session. (I've used chrome and the cookie.txt plugin) Thus you get some cookies of which you need only two: "rtFa" and "FedAuth". You must have both of them set in the requests! I've placed them in a text file in the davfs2 config directory which has the following sheme: [name]=[value]; [name]=[value]; Because of how my code uses that text there are no newlines or any other characters allowed at the end or beginning. (It is directly added to the requests header and the format will get corrupted otherwise)
Then I've added a special secret to the secrets file: [sharename] "@cookie" "/path/to/cookie/file"
Thus you have "@cookie" as username and "/path/to..." as password in the program.
Set use_locks to 0 in the config file. (Otherwise you cannot write to the mount)

Now I have extended webdav.c:
- added public variable (ln. 257): static char *auth_cookies;
- extended dav_init_webdav to bypass auth, read cookie file and copy its contents to auth_cookies
- extended get_cookies to copy Set-Cookie headers to auth_cookies and not to cookie_list if the names match the names in auth_cookies
- extended add_header to copy auth_cookies contents into the requests header

Because Set-Cookie is used to update auth_cookies you should always have a fresh copy it if there are any changes by the server. However, writing the buffer back to the cookie file is not yet implemented in my code. This should be done on a timed basis or at least on exit. I will add this.

I think it is a good ideas to keep that "X-FORMS_BASED_AUTH_ACCEPTED: f" header until somebody implemented oauth2/msofba for libneon. Maybe anybody can find out how NTLM would work. I still have it hardcoded in libneon so it is not yet in webdav.c. But, I think it should be added to the custom_header list. Which is just a matter of configuration.

Hint: To get full log output of the auth session from libneon you must set both flags: NE_DBG_HTTP and NE_DBG_HTTPAUTH

The code is attached as a file. But I'm not sure if it will compile with the default repo version (I made some changes in the first place and do not know if they are fully reverted). If not just copy the mentioned functions and add that variable.

Best regards and have fun with it!
Martin.

Martin Krellmann <martink>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #42514:  webdav-onedrive.patch added by None (4KiB - application/octet-stream - diff against latest 1.5.4)
file #42138:  webdav.c added by martink (53KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by murz (Posted a comment)
  • -email is unavailable- added by royalts (Posted a comment)
  • -email is unavailable- added by vortexmak
  • -email is unavailable- added by martink (Submitted the item)
  • -email is unavailable- added by martink
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-02-13 vortexmak Carbon-Copy- Added vortexmak
    2017-11-29 None Attached File- Added webdav-onedrive.patch, #42514
    2017-10-13 martink Attached File- Added webdav.c, #42138
        Carbon-Copy- Added wbaumann

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code