Differential D931
implemented microsoft autodiscover v2 and secure autodiscover.xml Authored by dhoffend on Feb 1 2020, 1:07 AM. Tags None Referenced Files
Subscribers
Details
Added support for json based autodiscover v2 which currently only supports Protocol ActiveSync or rediret to the XML based autodiscover v1 In addition this change implements basic authentication for autodiscover.xml to support the autodiscover/authentication flow and protect users data (prevents email testing/scraping)
Diff Detail
Event TimelineComment Actions
This helps the autodiscover process. With basic auth enabled on This also protects the autodiscover service to not leak senstive Comment Actions Start an unauthenticated autodiscover request with a known email address # curl -H 'Content-Type: text/xml' -X POST -d '<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/mobilesync/requestschema/2006"> > <Request> > <EMailAddress>XXXXX@kolab.org</EMailAddress> > <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006a</AcceptableResponseSchema> > </Request> > </Autodiscover>' https://kolabnow.com/autodiscover/autodiscover.xml The response <?xml version="1.0" encoding="UTF-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/mobilesync/responseschema/2006">
<User>
<DisplayName>Daniel Hoffend</DisplayName>
<EMailAddress>XXXXX@kolab.org</EMailAddress>
</User>
<Action>
<Settings>
<Server>
<Type>MobileSync</Type>
<Url>https://apps.kolabnow.com/Microsoft-Server-ActiveSync</Url>
<Name>https://apps.kolabnow.com/Microsoft-Server-ActiveSync</Name>
</Server>
</Settings>
</Action>
</Response>
</Autodiscover>With an unknown email address, the DisplayName field stays empty. Comment Actions
|