Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Recurring CalDAV login issues with iPhones and SLS (10.6 Server)

I have 10.6.4 Snow Leopard Server running on a Mac Mini and am having intermittent problems with various iPhones logging into CalDAV calendars. The iPhones are a 3G running iOS 3.1.3 and a 3GS running iOS 4.1.

iCal server works perfectly, with Push, on desktop clients.

The iPhones do work occasionally. Push is still not possible (AFAIK) but 15 minute fetch interval is acceptable for now (when is push coming to iPhones btw?). However, a few times per week, sometimes as many as 5 times in a single day, the iPhone will report "Password Incorrect." This happens on its on, presumably after one of the fetch intervals. Re-entering the password usually works, and is stored correctly for hours or days, but eventually it happens again. Sometimes password is accepted after re-entry but sync will silently stop working, which is even worse than the error popping up.

Each iPhone has 3 CalDAV accounts, one of which is a delegate, one of which is shared by all. The password issue happens with all of them, but far more often with the shared account. The password incorrect prompt does NOT always happen with all of them at once, sometimes just one of the accounts will throw the login error and the others will work for a while.

On the server, iCal has Authentication set to "any method", port 8008 and SSL on, Port 8443

The iPhones connect to CalDAV with SSL on port 8443 using "server" set to server.companyname.com

I have deleted the Calendar accounts on the phones repeatedly, hardware reset the phones, deleted all data and set up accounts again. This fixes the problem for a few days but then it comes back.

I don't see much in the iCal server logs, but I might not know what to look for. What should I look for or try next?

Thanks for any help.

Mac Mini 2Ghz Intel Core 2 Duo, 4GB RAM, Mac OS X (10.6.4)

Posted on Oct 13, 2010 12:58 PM

Reply
151 replies

Dec 2, 2010 7:12 AM in response to josephcorbett

Luckily I have email notifications turned on for this thread. I found your rant to be hilariously classic while still making some valid points. Don't let Apple's moderation of your post deter you from making your voice heard elsewhere about this issue. My only advice would be to try and keep it more factual & less animated - that will probably garner you more respect from people like Jobs than ranting will. YMMV.

Dec 3, 2010 10:24 AM in response to e.f.

Hi folks, I'm sorry you're having such a big problem with this, but I thought I'd offer up an update and ask for some testing help. We think we've finally narrowed the problem down to something related to digest authentication.

Here's how you can try to work around this: if you run an SSL-only server (please don't do this if you allow non-encrypted traffic to your server, or you will drastically lower your network security), then try disabling digest authentication and enabling basic instead.

To do this, you'll need to edit /etc/caldavd/caldavd.plist and change the value for Authentication->Basic->Enabled to true and Authentication->Digest->Enabled to false, then restart your server.

Back that file up before you start so you can revert if things go funny on you; a wrong config can cause your server to fail to start up at all, or cause other problems. After restarting your server, make sure it's operating properly, then wait and see if this problem persists.

Dec 3, 2010 11:06 AM in response to Todd Fleisher

I didn't say anything that wasn't based on facts, I admittedly was quite "animated". Being the go to "IT Guy" the "Sys Admin" and/or the "resident geek" when things are not working perfectly really *****. The only time people care about you or your job is when things are not working right. I've had to send out announcements to my team about this bug so they don't think I'm a complete idiot. Here is the most recent one I made.

https://files.me.com/josephcorbett/vjx5v0

The reality is I put my name and reputation on the line when I advise my company to use these products and right now I'm getting burnt because of it. I really just want to fix this issue.

Dec 3, 2010 3:04 PM in response to wsanchez

Thanks for the proposed solution.
I'm new to this, but I just wanted to make sure I understand.

You don't recommend turning Digest authentication off if our server allows unencrypted traffic, correct?

If we're talking about iPhones/iPods using CalDAV, the chances are the server is exposed to unencrypted traffic unless these devices connect only over Wi-Fi, no? The majority of us would be in the position unless I'm misunderstanding something.

I just want to understand the risks of trying this change.

Thanks

Dec 3, 2010 3:10 PM in response to OoO_Bailey_OoO

That's correct. By default, iCal operates on port 8008 for unencrypted traffic & port 8443 for encrypted (SSL) traffic. If you firewall off port 8008 & make sure port 8443 is open that will force users through an encrypted session to the server.

Even if you're using 3G (as opposed to wifi) on an iPhone - sending your password in the clear using basic authentication without an encrypted connection to the server is a security exposure.

Dec 3, 2010 3:19 PM in response to e.f.

Sadly the problem still persists after changing the plist file.

After the change the beginning of my plist looks like:


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AccessLogFile</key>
<string>/var/log/caldavd/access.log</string>
<key>AdminPrincipals</key>
<array/>
<key>Aliases</key>
<dict/>
<key>Authentication</key>
<dict>
<key>Basic</key>
<dict>
<key>Enabled</key>
<true/>
</dict>
<key>Digest</key>
<dict>
<key>Algorithm</key>
<string>md5</string>
<key>Enabled</key>
<false/>
<key>Qop</key>
<string></string>
</dict>
<key>Kerberos</key>
<dict>
<key>Enabled</key>
<false/>
<key>ServicePrincipal</key>
<string></string>
</dict>
<key>Wiki</key>

I rebooted the server. Everything ok for about two hours then asked for password again on the iphone and ipad and also get a popup from iCal on my MacBookPro.

Recurring CalDAV login issues with iPhones and SLS (10.6 Server)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.