Server: CalDAV - Shared Calender invitation link not working

[blenkers]

Steps to reproduce

1. Create a calendar and share it with another user. Make it possible for this user to create events in that calender
2. login as 2nd user, create event on calender and invite other attendees. E-Mail gets send with Link for accepting to that user
3. click on the link in the invitation email. Error will be displayed. Only if event gets created in shared calendar and not for events created in private calendars

Expected behaviour

There should be a message saying "Event is updated", which happens if the event gets created not in the shared calendar but the private calendar

Actual behaviour

The invited person should be able to click on the link and the status should be updated. But instead an error gets displayed saying the invited person should contact the creator of the event.

Server configuration

Operating system:
debian 9.5
Web server:
nginx 1.10.3
Database:
mariadb Ver 15.1 Distrib 10.1.26-MariaDB
PHP version:
PHP 7.0.30-0+deb9u1 (php-fpm)
Nextcloud version: (see Nextcloud admin page)
14.0.3
Updated from an older Nextcloud/ownCloud or fresh install:
fresh install
Where did you install Nextcloud from:
original tar-all
Signing status:

Signing status

Login as admin user into your Nextcloud and access 
http://example.com/index.php/settings/integrity/failed 
paste the results here.

No errors have been found.
</details>

**List of activated apps:**
<details>
<summary>App list</summary>

Enabled:
  - accessibility: 1.0.1
  - activity: 2.7.0
  - admin_audit: 1.4.0
  - admin_notifications: 1.0.2
  - apporder: 0.5.0
  - bruteforcesettings: 1.2.0
  - calendar: 1.6.3
  - checksum: 0.4.1
  - cloud_federation_api: 0.0.1
  - comments: 1.4.0
  - contacts: 2.1.7
  - dav: 1.6.0
  - deck: 0.5.0
  - encryption: 2.2.0
  - federatedfilesharing: 1.4.0
  - federation: 1.4.0
  - files: 1.9.0
  - files_pdfviewer: 1.3.2
  - files_sharing: 1.6.2
  - files_texteditor: 2.6.0
  - files_trackdownloads: 1.3.1
  - files_trashbin: 1.4.1
  - files_versions: 1.7.1
  - firstrunwizard: 2.3.0
  - groupfolders: 1.3.3
  - logreader: 2.0.0
  - lookup_server_connector: 1.2.0
  - nextcloud_announcements: 1.3.0
  - notes: 2.4.2
  - notifications: 2.2.1
  - oauth2: 1.2.1
  - password_policy: 1.4.0
  - provisioning_api: 1.4.0
  - serverinfo: 1.4.0
  - support: 1.0.0
  - survey_client: 1.2.0
  - systemtags: 1.4.0
  - tasks: 0.9.7
  - theming: 1.5.0
  - twofactor_backupcodes: 1.3.1
  - updatenotification: 1.4.1
  - user_external: 0.4
  - workflowengine: 1.4.0
Disabled:
  - files_external
  - files_videoplayer
  - gallery
  - mail
  - sharebymail
  - user_ldap

Nextcloud configuration:

Config report

{
"system": {
"instanceid": "REMOVED SENSITIVE VALUE",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"REMOVED SENSITIVE VALUE"
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"dbtype": "mysql",
"version": "14.0.3.0",
"overwrite.cli.url": "https:\/\/REMOVED SENSITIVE VALUE",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"default_language": "en",
"default_locale": "en_UK",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_smtpmode": "smtp",
"mail_domain": "REMOVED SENSITIVE VALUE",
"mail_smtphost": "REMOVED SENSITIVE VALUE",
"mail_smtpsecure": "ssl",
"mail_smtpport": "465",
"defaultapp": "calendar",
"auth.bruteforce.protection.enabled": true,
"user_backends": [
{
"class": "OC_User_IMAP",
"arguments": [
"{sensitive-data:993\/imap\/ssl\/novalidate-cert}",
"sensitive-data"
]
}
],
"maintenance": false,
"mail_smtpauthtype": "LOGIN",
"mail_smtpauth": 1,
"mail_smtpname": "REMOVED SENSITIVE VALUE",
"mail_smtppassword": "REMOVED SENSITIVE VALUE"
}
}

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption: yes

Are you using an external user-backend, if yes which one: IMAP

With access to your command line run e.g.:
sudo -u www-data php occ ldap:show-config
from within your Nextcloud installation folder

  There are no commands defined in the "ldap" namespace.


Eventually replace sensitive data as the name/IP-address of your LDAP server or groups.

Client configuration

Browser:
Chrome, Firefox
Operating system:
Linux, Windows

Logs

Web server error log

Web server error log

none
Insert your webserver log here

Nextcloud log (data/nextcloud.log)

Nextcloud log

Insert your Nextcloud log here

Browser log

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

[nextcloud-bot]

GitMate.io thinks possibly related issues are https://github.com/nextcloud/server/issues/8766 (Caldav ), https://github.com/nextcloud/server/issues/9605 (CalDav Issue, Calendar and Tasks not working), https://github.com/nextcloud/server/issues/10232 (Calender - all shares invalid?), https://github.com/nextcloud/server/issues/3830 (No calendar invitation send for event in shared calendars ), and https://github.com/nextcloud/server/issues/10797 (Invitations (attendees) not supported on shared calendars via macOS / iOS CalDAV clients).

[intelligentpotato]

I am also experiencing the same issue.
The error is:
There was an error updating your attendance status. Please contact the organizer directly.

I could not find any traces of it in nextcloud.log.

[vahem2lu]

Same error here. Also I see that some emails with invitations are sent, some not.

[coderkun]

Same issue here, same error message as @intelligentpotato and no entries in nextcloud.log.

[sandromario]

Same error here.

[wirepatch]

Same here, Current Nextcloud 14.04, calendar app 1.6.4. There is however a nextcloud.log entry:

{"reqId":"CsIhmMXLtDq490aH9Fk6","level":0,"time":"2018-11-29T17:24:12+00:00", "remoteAddr":"141.62.31.244","user":"--","app":"no app in context", "method":"GET", "url":"\/owncloud\/index.php\/apps\/dav\/invitation\/accept\/mpc57HLUk5pNYzGNGS5B8ySpC8R3a4Awp6lTWcmtA7uaakdYZzekjdZDlha2", "message":"No cache entry found for \/appdata_oc85bf2bd50d\/theming\/images\/background (storage: local::\/opt\/nextcloud\/data\/, internalPath: appdata_oc85bf2bd50d\/theming\/images\/background)", "userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/70.0.3538.77 Chrome\/70.0.3538.77 Safari\/537.36","version":"14.0.4.2"} {"reqId":"UUAbkY5JCablp0SIid0v","level":0,"time":"2018-11-29T17:24:13+00:00","remoteAddr":"141.62.31.244", "user":"--","app":"no app in context","method":"GET","url":"\/owncloud\/index.php\/css\/icons\/icons-vars.css", "message":"No cache entry found for \/appdata_oc85bf2bd50d\/css\/icons\/icons-vars.css.gzip (storage: local::\/opt\/nextcloud\/data\/, internalPath: appdata_oc85bf2bd50d\/css\/icons\/icons-vars.css.gzip)","userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ubuntu Chromium\/70.0.3538.77 Chrome\/70.0.3538.77 Safari\/537.36","version":"14.0.4.2"}

[boothb]

Exactly the same issue here with 14.04. But no log entries.

[Woosah]

Same bug with 14.04 and no log entries

[jvir]

apps/dav/lib/Controller/InvitationResponseController.php

On lines 82 and 105 $iTipMessage->getScheduleStatus() return '5.0' instead of '1.2' expected

'scheduleStatus' => '5.0;iTip message was not processed by the server, likely because we didn\'t understand it.'

[adlh]

I have the same problem with 15.0.0

[sschleic]

The same problem with 15.0.2

[shoopdawoop]

I am seeing the same error in 15.0.2 when creating an event in private calendars as well as in shared calendars (both of which I own).

[zacaro]

I did plenty of tests and combinations, none of them worked... every single test threw the same response as other users.

Here is some info.

# sudo -u www-data php occ config:list
{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "dbtype": "mysql",
        "version": "15.0.2.0",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "installed": true,
    },
    "apps": {
        "accessibility": {
            "enabled": "yes",
            "installed_version": "1.1.0",
            "types": ""
        },
        "activity": {
            "enabled": "yes",
            "installed_version": "2.8.2",
            "types": "filesystem"
        },
        "admin_audit": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "logging"
        },
        "backgroundjob": {
            "lastjob": "251"
        },
        "calendar": {
            "enabled": "yes",
            "installed_version": "1.6.4",
            "types": ""
        },
        "cloud_federation_api": {
            "enabled": "yes",
            "installed_version": "0.1.0",
            "types": "filesystem"
        },
        "comments": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "logging"
        },
        "contacts": {
            "enabled": "yes",
            "installed_version": "3.0.2",
            "types": ""
        },
        "core": {
            "backgroundjobs_mode": "ajax",
            "installedat": "1547656132.6047",
            "lastcron": "1548801519",
            "lastupdateResult": "[]",
            "lastupdatedat": "1548677142",
            "oc.integritycheck.checker": "[]",
            "public_files": "files_sharing\/public.php",
            "public_webdav": "dav\/appinfo\/v1\/publicwebdav.php",
            "vendor": "nextcloud"
        },
        "dav": {
            "enabled": "yes",
            "installed_version": "1.8.1",
            "types": "filesystem"
        },
        "event_update_notification": {
            "enabled": "yes",
            "installed_version": "0.3.2",
            "types": "logging,dav"
        },
        "federatedfilesharing": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": ""
        },
        "federation": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "authentication"
        },
        "files": {
            "cronjob_scan_files": "500",
            "enabled": "yes",
            "installed_version": "1.10.0",
            "types": "filesystem"
        },
        "files_accesscontrol": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "filesystem"
        },
        "files_external": {
            "allow_user_mounting": "no",
            "enabled": "yes",
            "installed_version": "1.6.0",
            "types": "filesystem",
            "user_mounting_backends": "ftp,dav,owncloud,sftp,amazons3,swift,\\OC\\Files\\Storage\\SFTP_Key"
        },
        "files_markdown": {
            "enabled": "yes",
            "installed_version": "2.0.5",
            "types": ""
        },
        "files_pdfviewer": {
            "enabled": "yes",
            "installed_version": "1.4.0",
            "types": ""
        },
        "files_rightclick": {
            "enabled": "yes",
            "installed_version": "0.11.0",
            "types": ""
        },
        "files_sharing": {
            "enabled": "yes",
            "installed_version": "1.7.0",
            "types": "filesystem"
        },
        "files_texteditor": {
            "enabled": "yes",
            "installed_version": "2.7.0",
            "types": ""
        },
        "files_trashbin": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "filesystem,dav"
        },
        "files_versions": {
            "enabled": "yes",
            "installed_version": "1.8.0",
            "types": "filesystem,dav"
        },
        "files_videoplayer": {
            "enabled": "yes",
            "installed_version": "1.4.0",
            "types": ""
        },
        "firstrunwizard": {
            "enabled": "yes",
            "installed_version": "2.4.0",
            "types": "logging"
        },
        "gallery": {
            "enabled": "yes",
            "installed_version": "18.2.0",
            "types": ""
        },
        "logreader": {
            "enabled": "yes",
            "installed_version": "2.0.0",
            "levels": "01111",
            "types": ""
        },
        "lookup_server_connector": {
            "enabled": "yes",
            "installed_version": "1.3.0",
            "types": "authentication"
        },
        "nextcloud_announcements": {
            "enabled": "yes",
            "installed_version": "1.4.0",
            "pub_date": "Sat, 10 Dec 2016 00:00:00 +0100",
            "types": "logging"
        },
        "notifications": {
            "enabled": "yes",
            "installed_version": "2.3.0",
            "types": "logging"
        },
        "oauth2": {
            "enabled": "yes",
            "installed_version": "1.3.0",
            "types": "authentication"
        },
        "password_policy": {
            "enabled": "yes",
            "enforceHaveIBeenPwned": "1",
            "enforceNumericCharacters": "1",
            "enforceUpperLowerCase": "1",
            "installed_version": "1.5.0",
            "types": ""
        },
        "provisioning_api": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "prevent_group_restriction"
        },
        "serverinfo": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": ""
        },
        "sharebymail": {
            "enabled": "yes",
            "enforcePasswordProtection": "no",
            "installed_version": "1.5.0",
            "types": "filesystem"
        },
        "support": {
            "enabled": "yes",
            "installed_version": "1.0.0",
            "types": ""
        },
        "survey_client": {
            "enabled": "yes",
            "encryption": "yes",
            "installed_version": "1.3.0",
            "types": ""
        },
        "systemtags": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "logging"
        },
        "twofactor_backupcodes": {
            "enabled": "yes",
            "installed_version": "1.4.1",
            "types": ""
        },
        "updatenotification": {
            "enabled": "yes",
            "files_rightclick": "0.11.0",
            "installed_version": "1.5.0",
            "types": "",
            "update_check_errors": "0"
        },
        "workflowengine": {
            "enabled": "yes",
            "installed_version": "1.5.0",
            "types": "filesystem"
        }
    }
}

[poldi171254]

Same issue
Thanks

[vwidmer]

I have had this issue for a while when try to invite a guest. Anyone know if there is any plans to fix this?
Thanks

[vahem2lu]

Confirmed that attendance update is working in Nextcloud 14.0.7 and calendar 1.6.4.

[asadana]

I can confirm this is still an issue in 15.0.4 using Ubuntu 18.0.4.2 with Snappy.

[vahem2lu]

I was bit rush in previous post. I'm having issues with some calendars/attendees (not sure). But something is working and something is not.

[poldi171254]

I think the issue only occurs when the second user (the one user1 shares the calendar with) Invites others.
If user1 creates an event and invites others, there is no error; looks like a rights issue

[apircalabu]

Still broken in Nextcloud 15.0.5 on CentOS 7 with httpd 2.4.38 and PHP 7.3.2 run as mod_php

[asadana]

@MorrisJobke @rullzer

This issue has been open for a while, and has been confirmed across multiple releases. Is there any additional information that is missing here that would help root cause?

[georgehrke]

@MorrisJobke @rullzer In the retrospective, it was a mistake to allow invitations in shared calendars (#3830).

This bug is related to the Sabre/Dav Invitation handling using getUsersOwnCalendars to look for the event, but obviously it's not in any calendars of the organiser but in a shared calendar.

Digging deeper into the corresponding standards, sending invitations in shared calendars is not the expected behaviour. Calendar users are only supposed to create them in their own calendars and they will automatically popup in other people's calendars when they are invited.

How do we handle this best? Advertise this behavior as deprecated with Nc 16 and revert #3830 for Nc 17 or 18?

[asadana]

@georgehrke @MorrisJobke @rullzer

Would it be possible instead of reverting the feature to instead check if the user who sent the invite has write/edit permissions on the shared calendar?

Alternatively, imho, it might be less-misleading if in the shared calendars the invite area was read-only for everyone but the owner, and possibly display a message saying "Only the owner of the calendar can invite additional people".
This would improve the UX even if the feature was reverted to ensure that people understand why.

[parafin]

I think it's OK to disable invites if calendar is shared with editing permissions. But for read-only shared calendars original owner obviously shouldn't lose the possibility to invite people. Or are personal calendars somehow special in this sense?

[vahem2lu]

If I have RW permission to calendar I should have RW permission to invite guests.
For example - I have global calendar, which owner is admin and this is shared among many people. And in this setup they couldn't invite participants to events. This makes invitations pointless if I'd need always to invite them from one user.

[georgehrke]

Would it be possible instead of reverting the feature to instead check if the user who sent the invite has write/edit permissions on the shared calendar?

This is already done obviously. You can only invite people if you create an event and you can only create events when you have write permission.

Alternatively, imho, it might be less-misleading if in the shared calendars the invite area was read-only for everyone but the owner, and possibly display a message saying "Only the owner of the calendar can invite additional people".

Yes, we would do that in the calendar app.

original owner obviously shouldn't lose the possibility to invite people

No no. This is not what i meant. The original owner will always have the ability to invite people, no matter whether the calendar is shared or not. The question is whether people, who the calendar is shared with, can invite other people.

If I have RW permission to calendar I should have RW permission to invite guests.

I don't want to have the same discussion as in #3830 please. Really no offence here, please don't take this wrong or personally, but it's not important what your personal opinion is here. We are using CalDAV and it's important what the CalDAV standard says about it.

For example - I have global calendar, which owner is admin and this is shared among many people. And in this setup they couldn't invite participants to events. This makes invitations pointless if I'd need always to invite them from one user.

This is not how you are supposed to use the calendaring system. In your scenario, you would create a group for everyone (or use the everyone group app) and every user would share their own calendar with that group. Invitations are only supposed to be sent from calendars that are owned by a user.

As i said in my comment above:

In the retrospective, it was a mistake to allow invitations in shared calendars (#3830).

We should extend our manual in this regard and document how you are supposed to use invitations, what kind of scenarios are supported and what aren't. cc @MariusBluem

[zguig52]

I was facing the same symptoms, and I found that my problem was linked to the fact that I was having an account coming from ldap connector + local administrator stored in DB sharing the same email address.
In the file ./apps/dav/lib/Connector/Sabre/Principal.php
the function findByUri was returning 2 records of users for the function $this->userManager->getByEmail.
As soon as I removed the duplicate mail, it started working. Maybe adding an error or warning trace here would simplify debugging?
if (count($users) !== 1) {
PUT A TRACE HERE
return null;
}

[georgehrke]

@zguig52 Your issue is related to https://github.com/nextcloud/server/issues/6235.
This ticket is exclusively about shared calendars.

[zguig52]

OK @georgehrke, I just put this comment here as the symptoms described here were the same as mine, but my problem was neither about shared calendar or permissions. In fact I searched for bugs related to calendar invitation links not working. That's how I came here :) Should I post this message in the bug you referenced or in another, as my problem was not about sending the email to an external participant, but to manage the response on the server when he clicked on the accept / refuse links.

[rullzer]

So I have to agree with @georgehrke. We are using caldav so we have to follow their standard. Else it is also unknown how clients properly react to this.

So lets disable shared calendar invites for now. And then we can when the caldav standard gets updated see how we can improve here.

[Contik]

This is not how you are supposed to use the calendaring system. In your scenario, you would create a group for everyone (or use the everyone group app) and every user would share their own calendar with that group. Invitations are only supposed to be sent from calendars that are owned by a user.

I'm totally open to the possibility that I've just been using Nextcloud's calendars or more specifically CalDAV wrong for group situations. Forgive me if I'm being dense here, I'm not quite there with you yet on how adding a group and everybody sharing a personal calendar with it would help in this scenario. I'm basically in the same boat as @vahem2lu.

Let me do some quick rubber duck debugging and spell out where I'm stuck: My imaginary group members all shared a personal calendar with the group. For privacy reasons they didn't share their main calendar but instead one they want to use for the specific purpose of scheduling group events. So user Alice now has a personal calendar aptly named _group events_. Alice creates a calendar entry that's relevant to her friends in her own _group events_ calendar. She invites whomever she wants, specifically also people who don't have accounts on her Nextcloud instance. Because she's the calendar owner this issue #12501 isn't triggered, everyone can accept Alice's invite, among them Bob. All is well. Bob has an account and his calendars on the same Nextcloud instance as Alice and accepted her invite. Since their extended circle of friends is that large Bob sees a total of 61 shared _group events_ calendars from all of them. The event planned by Alice shows up in Alice's _group events_ calendar, the one that Charlie organizes is in Charlie's _group events_ calendar and so on and so forth.

That does seem doable but a bit clunky. Am I missing something? Is this the way I should handle group calendar/event situations via CalDAV and by extension Nextcloud? When Bob accepts an invite from Alice does he get a calendar event entry in his own calendar or just the one he sees in Alice's shared _group events_ calendar?

Thanks!

[parafin]

Bob gets an event in his own personal calendar. He doesn’t have to look at any of shared calendars unless he wants to check the schedule of another person. Basically it’s not even necessary to have any shared calendars otherwise.

[georgehrke]

Won't fix.

Starting with Nextcloud 17 it won't be possible anymore to send invitations in shared calendars.
See #15676 (comment) for the reason.

[georgehrke]

That does seem doable but a bit clunky. Am I missing something? Is this the way I should handle group calendar/event situations via CalDAV and by extension Nextcloud? When Bob accepts an invite from Alice does he get a calendar event entry in his own calendar or just the one he sees in Alice's shared group events calendar?

He will get one in his own calendar.

Since their extended circle of friends is that large Bob sees a total of 61 shared group events calendars from all of them.

Most calendar applications allow you to hide duplicates / combine identical events for this reason.

That is not supported in the calendar app itself yet, let me open a ticket for that.