RFC 5397

WebDAV Current Principal Extension

📅 published December 2008, from ietf

RFC 5397: WebDAV Current Principal Extension 🎀

Okay so RFC 5397 is titled WebDAV Current Principal Extension and it's by W. Sanchez and C. Daboo, both at Apple Inc. It's a Standards Track document, dated December 2008. It doesn't list anything it obsoletes or updates, so it's standing on its own. ✨

Status of This Memo 💅

This document specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements. For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 📜

Copyright Notice 🌸

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. 🫶

Abstract ✨

This spec defines a brand new WebDAV property that lets clients quickly figure out the principal that matches the current authenticated user. It's giving efficiency 🦋

Table of Contents 🗂️

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Conventions Used in This Document . . . . . . . . . . . . . . . 2
3.  DAV:current-user-principal  . . . . . . . . . . . . . . . . . . 3
4.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
5.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 4
6.  Normative References  . . . . . . . . . . . . . . . . . . . . . 4

1. Introduction 🧚

Okay so WebDAV [RFC4918] is an extension to HTTP [RFC2616] that levels up document authoring. Then the WebDAV Access Control Protocol ("WebDAV ACL") [RFC3744] extension adds access control to WebDAV. It brings in the idea of a "principal" resource, which holds info about the authenticated entities on the system. Iconic. 👑

Some clients need to figure out which [RFC3744] principal the server is linking to the currently authenticated HTTP user. ngl, that's a real need. [RFC3744] defines a DAV:current-user-privilege-set property for getting the privileges granted to that principal, but there's no recommended way to identify the principal itself, and you need that for other useful stuff. For example, a client might want to find out which groups the current user belongs to, or change a property on the principal resource tied to that user. 🔥

The DAV:principal-match REPORT is useful, but it can get messy. Not only does it return the individual user principal, it also returns every group principal that user is a member of, and there's no clear way to tell which one is which. Not me being confused by that 💀

So this spec proposes an extension to WebDAV ACL that adds a DAV:current-user-principal property to resources under access control on the server. The property gives a URL to the principal resource for the currently authenticated user. That lets a client "bootstrap" itself by running more queries on the principal resource to get more info from it, and that's the whole purpose of this extension. 💖

Quick note: multiple URLs can point to the same principal resource, and multiple principal resources can match one principal. This spec only allows a single http(s) URL in the DAV:current-user-principal property, though. If a client wants other URLs for the principal, it can ask the principal resource for them. The extension isn't trying to give a full list of those URLs. It's just a way to find a resource that has that info and other stuff too. 🦋

2. Conventions Used in This Document 🍓

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These are the official BCP 14 vibes 💅

When XML element types in the namespace "DAV:" get referenced in this document outside of an XML fragment, the string "DAV:" gets added as a prefix to the element type names. 🌈

Processing of XML by clients and servers MUST follow the rules defined in Section 17 of WebDAV [RFC4918]. No skipping that, bestie 🫶

Some of the declarations refer to XML elements that WebDAV [RFC4918] defines. ✨

3. DAV:current-user-principal 👑

Name: current-user-principal

Namespace: DAV:

Purpose: Shows a URL for the currently authenticated user's principal resource on the server. 💜

Value: A single DAV:href or DAV:unauthenticated element. 🎀

Protected: This property gets computed on a per-request basis, so it's protected. Locked in 🔒

Description: The DAV:current-user-principal property holds either a DAV:href or a DAV:unauthenticated XML element. The DAV:href element has a URL to a principal resource for the currently authenticated user. That URL MUST be one of the URLs in the DAV:principal-URL or DAV:alternate-URI-set properties defined on the principal resource, and it MUST be an http(s) scheme URL. When authentication hasn't happened or has failed, this property MUST contain the DAV:unauthenticated pseudo-principal. 🙈

Sometimes there could be several principal resources for the same authenticated principal. In that case, the server can pick any one of those principal resource URIs for the value of the DAV:current-user-principal property. But servers SHOULD be consistent and use the same principal resource URI for each authenticated principal. Consistency is the vibe ✨

COPY/MOVE behavior: This property is computed on a per-request basis, so it's never copied or moved. 🦋

Definition:

<!ELEMENT current-user-principal (unauthenticated | href)>
<!-- href value: a URL to a principal resource -->

Example:

<D:current-user-principal xmlns:D="DAV:">
  <D:href>/principals/users/cdaboo</D:href>
</D:current-user-principal>

4. Security Considerations 🔐

This spec doesn't add any new security issues beyond the ones already defined for HTTP [RFC2616], WebDAV [RFC4918], and WebDAV ACL [RFC3744]. Those are the ones you need to take seriously, so please keep them in mind when you implement this. 😭

5. Acknowledgments 🌷

This spec is based on discussions that happened within the Calendaring and Scheduling Consortium's CalDAV Technical Committee. The authors thank everyone in that group for their input. 💖

The authors also thank Julian Reschke for his valuable input via the WebDAV working group mailing list. Thank you, Julian 🫶

6. Normative References 📚

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2616]  Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
           Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
           Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

[RFC3744]  Clemm, G., Reschke, J., Sedlar, E., and J. Whitehead, "Web
           Distributed Authoring and Versioning (WebDAV)
           Access Control Protocol", RFC 3744, May 2004.

[RFC4918]  Dusseault, L., "HTTP Extensions for Web Distributed
           Authoring and Versioning (WebDAV)", RFC 4918, June 2007.

Authors' Addresses 💌

Wilfredo Sanchez
Apple Inc.
1 Infinite Loop
Cupertino, CA  95014
USA

EMail: wsanchez@wsanchez.net
URI:   http://www.apple.com/

Cyrus Daboo
Apple Inc.
1 Infinite Loop
Cupertino, CA  95014
USA

EMail: cyrus@daboo.name
URI:   http://www.apple.com/

📦 where this page comes from

ietf: rfc5397 2008-12
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms