Tickets :: [#11624] ActiveSync Autodiscovery for Apple iOS devices (easy to fix)

6.0.0-beta1

7/16/25

Summary	ActiveSync Autodiscovery for Apple iOS devices (easy to fix)
Queue	Horde Framework Packages
Queue Version	Git master
Type	Bug
State	Resolved
Priority	1. Low
Owners	mrubinsk (at) horde (dot) org
Requester	torben (at) dannhauer (dot) info
Created	11/02/2012 (4639 days ago)
Due
Updated	08/28/2023 (688 days ago)
Assigned	11/05/2012 (4636 days ago)
Resolved	11/05/2012 (4636 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch	Yes

08/28/2023 10:36:33 AM	dje (at) ecrimoi (dot) com	Comment #16	Reply to this comment
[Show Quoted Text - 25 lines][Hide Quoted Text] Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) With the above settings I get a green checkmark for the connectivity test. I use a SRV record (_autodiscover._tcp.example.com) by the way. This is an elegant way to direct the /Autodiscover/Autodiscover.xml to the ActiveSync server if the SSL certificate is for something else than 'example.com' or 'autodiscover.example.com'. It would be even better, if Android would only support this... :-(

11/05/2012 09:22:58 PM	arjen+horde (at) de-korte (dot) org	Comment #15	Reply to this comment
[Show Quoted Text - 20 lines][Hide Quoted Text] It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) Just an FYI, you don't need anything special as the Domain. Horde ignores this data Sure, but ExRCA doesn't. It will not accept the '\username' that is acceptable for Horde here. This is what I initially tried, but that is not accepted as input. You must fill in either 'domain\user' or 'user@domain' where the latter doesn't work, but the first does. Hmm, for me ExRCA works. I have the full email adresse as username, so I have to input domain.tld/user@domain.tld and it passes the test! What I initially tried was just 'user@domain.tld'. That doesn't work (although ExRCA accepts that as input).

11/05/2012 09:18:03 PM	torben (at) dannhauer (dot) info	Comment #14	Reply to this comment
[Show Quoted Text - 25 lines][Hide Quoted Text] Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) Just an FYI, you don't need anything special as the Domain. Horde ignores this data Sure, but ExRCA doesn't. It will not accept the '\username' that is acceptable for Horde here. This is what I initially tried, but that is not accepted as input. You must fill in either 'domain\user' or 'user@domain' where the latter doesn't work, but the first does. Hmm, for me ExRCA works. I have the full email adresse as username, so I have to input domain.tld/user@domain.tld and it passes the test!

11/05/2012 09:17:26 PM	Michael Rubinsky	Comment #13	Reply to this comment
[Show Quoted Text - 25 lines][Hide Quoted Text] Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) Just an FYI, you don't need anything special as the Domain. Horde ignores this data Sure, but ExRCA doesn't. It will not accept the '\username' that is acceptable for Horde here. This is what I initially tried, but that is not accepted as input. You must fill in either 'domain\user' or 'user@domain' where the latter doesn't work, but the first does. Sorry, the rest of that comment got deleted somehow before I sent it. I know ExRCA doesn't. I was simply letting you know you don't need to input that data on clients that do not require it - and that you can input ANYTHING as that value in clients that require SOMETHING there.

11/05/2012 09:12:35 PM	arjen+horde (at) de-korte (dot) org	Comment #12	Reply to this comment
[Show Quoted Text - 20 lines][Hide Quoted Text] Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) Just an FYI, you don't need anything special as the Domain. Horde ignores this data Sure, but ExRCA doesn't. It will not accept the '\username' that is acceptable for Horde here. This is what I initially tried, but that is not accepted as input. You must fill in either 'domain\user' or 'user@domain' where the latter doesn't work, but the first does.

11/05/2012 09:06:58 PM	Michael Rubinsky	Comment #11 State ⇒ Resolved	Reply to this comment
[Show Quoted Text - 17 lines][Hide Quoted Text] Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) Just an FYI, you don't need anything special as the Domain. Horde ignores this data With the above settings I get a green checkmark for the connectivity test. I use a SRV record (_autodiscover._tcp.example.com) by the way. This is an elegant way to direct the /Autodiscover/Autodiscover.xml to the ActiveSync server if the SSL certificate is for something else than 'example.com' or 'autodiscover.example.com'. It would be even better, if Android would only support this... :-(

11/05/2012 09:02:49 PM	arjen+horde (at) de-korte (dot) org	Comment #10	Reply to this comment
Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere. It was ExRCA reporting this. But never mind, this was due to user error. I assumed that I could just repeat the e-mail addres in the 'Domain\User Name (or UPN)' field (according to the popup windows), but this is not the case. What worked here was E-mail address: username@example.com Domain\User Name (or UPN): example.com/username (not: username@example.com) With the above settings I get a green checkmark for the connectivity test. I use a SRV record (_autodiscover._tcp.example.com) by the way. This is an elegant way to direct the /Autodiscover/Autodiscover.xml to the ActiveSync server if the SSL certificate is for something else than 'example.com' or 'autodiscover.example.com'. It would be even better, if Android would only support this... :-(

11/05/2012 08:39:59 PM	Michael Rubinsky	Comment #9 State ⇒ Feedback	Reply to this comment
Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. Where are you seeing this error? That is not something Horde should be outputting anywhere.

11/05/2012 08:38:40 PM	Michael Rubinsky	Comment #8	Reply to this comment
Microsoft makes the exact same error in their implementation of the Microsoft Remote Connectivity Analyzer (https://www.testexchangeconnectivity.com/). This too uses '/Autodiscover/Autodiscover.xml' in the Exchange ActiveSync Autodiscover tests, so we can't really blame Apple here. In fact, by not accepting this, Horde would fail the above test immediately. FWIW, my server passes this test, including autodiscovery even without the case insensitive matching patches. Though this is due to the fact that I have configured my redirect rules as indicated in the wiki which clearly says to redirect to the lowercase version in order to deal with broken clients.

11/05/2012 08:13:02 PM	arjen+horde (at) de-korte (dot) org	Comment #7	Reply to this comment
Which makes the above test pass, if only the '@domain' would be stripped from the e-mail adress (but this could be due to the fact that I'm not fully up-to-date with Git). Never mind, even hard-coding the address will make this test fail with An HTTP 401 Unauthorized response was received from the remote Unknown server. I can login to the ActiveSync server with the same credentials, so not stripping the '@domain' part is definitly not the problem (when run in a PHP-shell, the stripping works as expected).

11/05/2012 07:45:46 PM	torben (at) dannhauer (dot) info	Comment #6	Reply to this comment
[Show Quoted Text - 21 lines][Hide Quoted Text] The ActiveSync AutoDiscovery does no work for iOS (iOS 6.0.1) because the REQUEST_URI is checked case sensitive for "autodiscover/autodiscover.xml" while iOS uses the URI "Autodiscover/Autodiscover.xml" Well, iOS is plain wrong then. Then documentation clearly states that the URL is all lowercase. Then again, it's not a big surprise the Apple has screwed up a communication protocol. In that case, Microsoft makes the exact same error in their implementation of the Microsoft Remote Connectivity Analyzer (https://www.testexchangeconnectivity.com/). This too uses '/Autodiscover/Autodiscover.xml' in the Exchange ActiveSync Autodiscover tests, so we can't really blame Apple here. In fact, by not accepting this, Horde would fail the above test immediately. Nevertheless, I've added the case insensitive matching. Which makes the above test pass, if only the '@domain' would be stripped from the e-mail adress (but this could be due to the fact that I'm not fully up-to-date with Git). Hmm, in this documentation it is domumentet in lower case: http://officeimg.vo.msecnd.net/en-us/files/212/753/AF010210506.doc

11/05/2012 07:39:04 PM	arjen+horde (at) de-korte (dot) org	Comment #5	Reply to this comment
The ActiveSync AutoDiscovery does no work for iOS (iOS 6.0.1) because the REQUEST_URI is checked case sensitive for "autodiscover/autodiscover.xml" while iOS uses the URI "Autodiscover/Autodiscover.xml" Well, iOS is plain wrong then. Then documentation clearly states that the URL is all lowercase. Then again, it's not a big surprise the Apple has screwed up a communication protocol. In that case, Microsoft makes the exact same error in their implementation of the Microsoft Remote Connectivity Analyzer (https://www.testexchangeconnectivity.com/). This too uses '/Autodiscover/Autodiscover.xml' in the Exchange ActiveSync Autodiscover tests, so we can't really blame Apple here. In fact, by not accepting this, Horde would fail the above test immediately. Nevertheless, I've added the case insensitive matching. Which makes the above test pass, if only the '@domain' would be stripped from the e-mail adress (but this could be due to the fact that I'm not fully up-to-date with Git).

11/05/2012 02:51:15 PM	torben (at) dannhauer (dot) info	Comment #4	Reply to this comment
[Show Quoted Text - 11 lines][Hide Quoted Text] The ActiveSync AutoDiscovery does no work for iOS (iOS 6.0.1) because the REQUEST_URI is checked case sensitive for "autodiscover/autodiscover.xml" while iOS uses the URI "Autodiscover/Autodiscover.xml" Well, iOS is plain wrong then. Then documentation clearly states that the URL is all lowercase. Then again, it's not a big surprise the Apple has screwed up a communication protocol. Nevertheless, I've added the case insensitive matching. I agree, apple is very careless regarding some protocols. Besides this bug you fixed, it has also some other major flaws regarding the exchange autodiscover protocol: It DOES obey a redirect DNS entry, but it does not restart the autodiscover with the new URL in a clean way: It still compares the old URL with the new URL SSL cert which leads to an invalid SSL cert warning. Lots of sysadmins have trouble integrating iOS devices.... I assume this bug happens because MS is not as case sensitive as other OS are and they have tested it with a MS exchange server. Thanks for fixing this issue anyway!

11/05/2012 02:43:18 PM	Michael Rubinsky	Comment #3 State ⇒ Resolved	Reply to this comment
The ActiveSync AutoDiscovery does no work for iOS (iOS 6.0.1) because the REQUEST_URI is checked case sensitive for "autodiscover/autodiscover.xml" while iOS uses the URI "Autodiscover/Autodiscover.xml" Well, iOS is plain wrong then. Then documentation clearly states that the URL is all lowercase. Then again, it's not a big surprise the Apple has screwed up a communication protocol. Nevertheless, I've added the case insensitive matching.

11/05/2012 02:42:37 PM	Git Commit	Comment #2	Reply to this comment
Changes have been made in Git (master): commit a86c01f0a9aafc49fd14215174bc5676b305df3b Author: Michael J Rubinsky <mrubinsk@horde.org> Date: Mon Nov 5 09:39:37 2012 -0500 ~~Bug: 11624~~ Work around for iOS's broken AUTODISCOVER request. framework/Rpc/lib/Horde/Rpc/ActiveSync.php \| 6 +++--- horde/rpc.php \| 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) http://git.horde.org/horde-git/-/commit/a86c01f0a9aafc49fd14215174bc5676b305df3b

11/02/2012 01:30:07 PM	Michael Rubinsky	Assigned to Michael Rubinsky State ⇒ Assigned Priority ⇒ 1. Low

11/02/2012 12:19:37 PM	torben (at) dannhauer (dot) info	Comment #1 Priority ⇒ 3. High State ⇒ Unconfirmed Patch ⇒ Yes Milestone ⇒ Summary ⇒ ActiveSync Autodiscovery for Apple iOS devices (easy to fix) Type ⇒ Bug Queue ⇒ Horde Framework Packages	Reply to this comment
The ActiveSync AutoDiscovery does no work for iOS (iOS 6.0.1) because the REQUEST_URI is checked case sensitive for "autodiscover/autodiscover.xml" while iOS uses the URI "Autodiscover/Autodiscover.xml" Please adapt the following files and use stripos(..) instead of strpos(..) or "==" - Horde/Rpc/ActiveSync.php (3x) - /horde/rpc.php (1x) I tested with iOS6, with case insensitive comaprisions the autodiscovery works.