Subject: Find my principal resource

From: Cyrus Daboo <[email-masked]>
Date: Tue, 30 Jan 2007 16:37:44 -0700

Hi,
What is the right way on a WebDAV server supporting ACL for a client to 
determine the principal resource for the currently authenticated user?

Right now the only technique I know of is to do:

1) PROPFIND on a resource to get DAV:principal-collection-set
2) Iterate over each DAV:href in the set and do a DAV:principal-match 
report for DAV:self.

The problem with that is that it not only returns the current user's 
principal, but any group principal that one is a member of. So how would 
you know from those which was the actual user principal? i.e. this approach 
is not 100% reliable.

If there really isn't a way to reliably do this now, I would propose the 
following: define a new DAV:self-principal-resource (or just DAV:self) 
property that is available on any resource supporting ACL and which 
contains a single DAV:href pointing to the principal resource for the 
currently authorized user (or is empty if anonymous).

Note that in CalDAV it is important for a client to know the principal 
resource, as there are properties on the principal resource that are 
required to find a users calendars, inbox, outbox etc

-- 
Cyrus Daboo

---

From: Julian Reschke <[email-masked]>
Date: Wed, 31 Jan 2007 19:55:08 +0100

Hi Cyrus,

(ccing the ACL mailing list).

> determine the principal resource for the currently authenticated user?

As far as I can recall, in general there simply isn't a single principal 
resource.

> 2) Iterate over each DAV:href in the set and do a DAV:principal-match 

Yep.

> you know from those which was the actual user principal? i.e. this 
> approach is not 100% reliable.

Well, you can easily filter out groups, but in the end you may still end 
up with more than one resource.

> currently authorized user (or is empty if anonymous).

I think the spec would have defined exactly that would there have been a 
consensus that this kind of definition always is meaningful.

> required to find a users calendars, inbox, outbox etc

Best regards, Julian