Installation

You can install this package from PyPi using the following command:

pip install radicale-modoboa-rights

Configuration

Here is a configuration example:

[rights]
type = radicale_modoboa_rights

modoboa_rights_endpoint = https://<modoboa>/api/v2/calendar-rights/
# Credentials of Radicale's OAuth2 application in Modoboa
modoboa_client_id = <client id>
modoboa_client_secret = <client secret>

The OAuth2 application must be named Radicale and use the client credentials grant. It is the one created for Radicale’s authentication plugin.

Optional settings:

modoboa_token_endpoint (default: /api/o/token/ on the host of modoboa_rights_endpoint)

Modoboa’s OAuth2 token endpoint.

The following optional settings are in seconds:

modoboa_rights_cache_ttl (default: 60)

How long rights fetched from Modoboa are cached. This is also the maximum delay before a revoked access is enforced.

modoboa_rights_refresh_interval (default: 5)

When an access is denied, rights are fetched again if they are older than this, so new shares are usable almost immediately.

modoboa_rights_stale_max_age (default: 3600)

While the Modoboa API is unreachable, cached rights keep being used up to this age. Past it, access to other users’ collections is denied.

modoboa_rights_timeout (default: 2)

Timeout of requests to the Modoboa API.

modoboa_rights_retry_delay (default: 10)

After a failed request, the Modoboa API is not called again before this delay.

Permissions

The d permission forbids the deletion of the calendar itself when [rights] permit_delete_collection is enabled (the default).

Share link tokens

User names starting with .modoboa-token- are reserved for share link tokens, which the authentication plugin turns into user names. Such a user has no principal or calendars of its own, and no administrator or manager rights: it only gets the calendars listed in shares by the Modoboa API. Without this, Radicale would create a principal collection for each token.

The prefix only uses characters accepted by [server] validate_user_value = strict. Modoboa must never use it for account names.

Modoboa API

The plugin gets an access token from modoboa_token_endpoint with the OAuth2 client credentials grant (client id and secret sent with HTTP Basic). The token is kept until it is about to expire, or until the API refuses it.

It then sends POST requests to modoboa_rights_endpoint with the token (Authorization: Bearer <token>):

{"user": "bob@example.com"}

and expects the following answer:

{
  "admin_domains": ["example.com"],
  "managed_domains": ["example.com"],
  "shares": {"alice@example.com/Work": "rwd"}
}

admin_domains

Domains whose user calendars the user administers. "*" means every domain.

managed_domains

Domains whose shared calendars the user manages. "*" means every domain.

shares

Calendars shared with the user, as path: permissions. Only rwdDoOi permissions are accepted. For a share link token, the calendar the token gives access to.

All keys are optional.