Create and select user_principal based on web authenticated user.

[pusateri]

I'm not expecting this to get merged right now. Just putting it here for a place holder and feedback. Will begin working on get_resource() ACLS.

Also updates nginx example to pass $remote_user as HTTP_X_REMOTE_USER from a proxy.

[jelmer]

Thanks! I think this looks reasonable overall. Left two minor comments inline.

We should add similar logic for the non-wsgi codepath in xandikos/web.py

[jelmer]

Ideally this path would be configurable, but we could leave that for a follow-up PR.

[pusateri]

Do you mean something like:

def set_principal(self, user, principal_path_prefix="/", principal_path_suffix="/"):
    principal = principal_path_prefix + user + principal_path_suffix

[jelmer]

Yep, exactly. Though we'd probably want those extra paths to come from a command-line argument/configuration file.

[pusateri]

Can you explain SCRIPT_NAME?

[jelmer]

SCRIPT_NAME is a bit of a misnomer, but it's named after a similar variable in the CGI world - it's the bit of the path to Xandikos itself. If Xandikos is under https://foo.example.com/dav/, then SCRIPT_NAME would be /dav/.

[pusateri]

We should add similar logic for the non-wsgi codepath in xandikos/web.py

If the non-wsgi codepath is web.py:main(), doesn't the current_user_principal argument do the same thing? Or do you want read the REMOTE_USER as an environment variable? Is run_simple_server() even used anywhere?

[jelmer]

Sorry for the delay - I've been traveling - but should be able to follow up more quickly during the next couple of weeks.

We should add similar logic for the non-wsgi codepath in xandikos/web.py

If the non-wsgi codepath is web.py:main(), doesn't the current_user_principal argument do the same thing? Or do you want read the REMOTE_USER as an environment variable?

In the non-wsgi codepath, REMOTE_USER could vary per request, so we can't read it from the environment. Right now, we just have a single principal, but in the future XandikosApp can't have a current_user_principal variable since there will be multiple. Hope that makes sense.

is run_simple_server() even used anywhere?

run_simple_server() is (meant to be) used in the testsuites of CalDAV/CardDAV client applications and libraries like pycaldav and vdirsync. It allows them to quickly spin up a trivial server to run tests against.