iCloud calendar: Getting unauthorized error from C

Question

I'm trying to PUT an event on iCloud calendar using CalDav. After several proper requests and responses and getting the user principal and calendars, when i try to PUT an event, the server returns Unauthorized error.

Here's the network log from fiddler:

Request:

OPTIONS https://p49-caldav.icloud.com/ HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Host: p49-caldav.icloud.com
Content-Length: 0
Connection: Keep-Alive

Response:

HTTP/1.1 200 OK
Server: AppleHttpServer/1.9.12/0643601
Date: Sat, 16 Jul 2016 15:38:55 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 0
Connection: keep-alive
X-Apple-Jingle-Correlation-Key: X27XPFLXYFCYHGGADAAWWCKMJE
apple-seq: 0
apple-tk: false
X-Responding-Instance: caldavj:44900101:pv42p49ic-zteg05101201:8501:16D67:82b3920
Allow: ACL, COPY, DELETE, GET, HEAD, LOCK, MKCOL, MOVE, OPTIONS, PROPFIND, PROPPATCH, PUT, REPORT, UNLOCK
DAV: 1, access-control, calendar-access, calendar-schedule, calendar-auto-schedule, calendar-managed-attachments, calendarserver-sharing, calendarserver-subscribed, calendarserver-home-sync
X-Accept-Client-Encoding: gzip
Strict-Transport-Security: max-age=31536000; includeSubDomains
via: icloudedge:br30p01ic-ztde01120601:7401:16D44:Berlin
X-Apple-Request-UUID: bebf7795-77c1-4583-98c0-18016b094c49
X-Apple-Xrail: false
access-control-expose-headers: X-Apple-Request-UUID
access-control-expose-headers: Via

Request:

PROPFIND https://p49-caldav.icloud.com/ HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Depth: 0
Host: p49-caldav.icloud.com
Content-Type: text/xml
Content-Length: 89

<propfind xmlns="DAV:">
  <prop>
    <current-user-principal />
  </prop>
</propfind>

Response:

HTTP/1.1 207 Multi-Status
Server: AppleHttpServer/1.9.12/0643601
Date: Sat, 16 Jul 2016 15:38:55 GMT
Content-Type: text/xml
Content-Length: 350
Connection: keep-alive
ETag: "B40001-1B000-578A54FB"
Last-Modified: Sat, 16 Jul 2016 15:38:35 GMT
DAV: 1, access-control, calendar-access, calendar-schedule, calendar-auto-schedule, calendar-managed-attachments, calendarserver-sharing, calendarserver-subscribed, calendarserver-home-sync
Accept-Ranges: bytes
X-Responding-Server: pv42p49ic-zteg04102301 21 a63660a6f7d1a25b5a7ed66dab0da843
X-Transaction-Id: b8d02729-1bcd-4df1-a1ce-3c2a545ed3f0
Vary: accept-encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
via: icloudedge:br30p01ic-ztde01120601:7401:16D44:Berlin
X-Apple-Request-UUID: b8d02729-1bcd-4df1-a1ce-3c2a545ed3f0
X-Apple-Xrail: false
access-control-expose-headers: X-Apple-Request-UUID
access-control-expose-headers: Via

<?xml version='1.0' encoding='UTF-8'?>
<multistatus xmlns='DAV:'>
  <response>
    <href>/</href>
    <propstat>
      <prop>
        <current-user-principal>
          <href>/10430699202/principal/</href>
        </current-user-principal>
      </prop>
      <status>HTTP/1.1 200 OK</status>
    </propstat>
  </response>
</multistatus>

Request:

PROPFIND https://p49-caldav.icloud.com/10430699202/principal/ HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Depth: 0
Host: p49-caldav.icloud.com
Content-Type: text/xml
Content-Length: 122

<propfind xmlns="DAV:">
  <prop>
    <calendar-home-set xmlns="urn:ietf:params:xml:ns:caldav" />
  </prop>
</propfind>

Response:

HTTP/1.1 207 Multi-Status
Server: AppleHttpServer/1.9.12/0643601
Date: Sat, 16 Jul 2016 15:38:56 GMT
Content-Type: text/xml
Content-Length: 446
Connection: keep-alive
DAV: 1, access-control, calendar-access, calendar-schedule, calendar-auto-schedule, calendar-managed-attachments, calendarserver-sharing, calendarserver-subscribed, calendarserver-home-sync
Accept-Ranges: bytes
X-Responding-Server: pv42p49ic-zteg04102001 22 a63660a6f7d1a25b5a7ed66dab0da843
X-Transaction-Id: 9b4aa58d-69d9-4e82-bd90-48380b1650cc
Vary: accept-encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
via: icloudedge:br30p01ic-ztde01120601:7401:16D44:Berlin
X-Apple-Request-UUID: 9b4aa58d-69d9-4e82-bd90-48380b1650cc
X-Apple-Xrail: false
access-control-expose-headers: X-Apple-Request-UUID
access-control-expose-headers: Via

<?xml version='1.0' encoding='UTF-8'?>
<multistatus xmlns='DAV:'>
  <response>
    <href>/10430699202/principal/</href>
    <propstat>
      <prop>
        <calendar-home-set xmlns='urn:ietf:params:xml:ns:caldav'>
          <href xmlns='DAV:'>https://p49-caldav.icloud.com:443/10430699202/calendars/</href>
        </calendar-home-set>
      </prop>
      <status>HTTP/1.1 200 OK</status>
    </propstat>
  </response>
</multistatus>

Request:

PUT https://p49-caldav.icloud.com/10430699202/calendars/ee451a47-c242-40c1-b295-4f1251a5d0cd.ics HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
Host: p49-caldav.icloud.com
If-None-Match: *
Content-Type: text/calendar
Content-Length: 302

BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//tracky/iCal//FUBU v1.0//EN
BEGIN:VEVENT
UID:ee451a47-c242-40c1-b295-4f1251a5d0cd
DESCRIPTION:
DTEND:20160716T202635
DTSTAMP:20160716T155652Z
DTSTART:20160716T202635
LAST-MODIFIED:20160716T155652Z
SEQUENCE:1468684613
SUMMARY:
END:VEVENT
END:VCALENDAR

Response:

HTTP/1.1 301 Moved Permanently
Server: AppleHttpServer/1.9.12/0643601
Date: Sat, 16 Jul 2016 15:56:53 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 216
Connection: keep-alive
Location: https://p49-caldav.icloud.com/10430699202/calendars/ee451a47-c242-40c1-b295-4f1251a5d0cd.ics/
X-Responding-Server: pv42p49ic-zteg04092901 6 a63660a6f7d1a25b5a7ed66dab0da843
X-Transaction-Id: e537a470-ddf6-4a8f-a059-580d52075840
Strict-Transport-Security: max-age=31536000; includeSubDomains
via: icloudedge:br30p01ic-ztde01130201:7401:16D44:Berlin
X-Apple-Request-UUID: e537a470-ddf6-4a8f-a059-580d52075840
X-Apple-Xrail: false
access-control-expose-headers: X-Apple-Request-UUID
access-control-expose-headers: Via

<html><head><title>Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>Document moved to https://p49-caldav.icloud.com/10430699202/calendars/ee451a47-c242-40c1-b295-4f1251a5d0cd.ics/.</p></body></html>

The server redirects me and removes the authorization header causing the unauthorized error:

PUT https://p49-caldav.icloud.com/10430699202/calendars/ee451a47-c242-40c1-b295-4f1251a5d0cd.ics/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2
If-None-Match: *
Content-Type: text/calendar
Host: p49-caldav.icloud.com
Content-Length: 302

BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//tracky/iCal//FUBU v1.0//EN
BEGIN:VEVENT
UID:ee451a47-c242-40c1-b295-4f1251a5d0cd
DESCRIPTION:
DTEND:20160716T202635
DTSTAMP:20160716T155652Z
DTSTART:20160716T202635
LAST-MODIFIED:20160716T155652Z
SEQUENCE:1468684613
SUMMARY:
END:VEVENT
END:VCALENDAR

Response:

HTTP/1.1 401 Unauthorized
Server: AppleHttpServer/1.9.12/0643601
Date: Sat, 16 Jul 2016 15:56:53 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 141
Connection: keep-alive
WWW-Authenticate: x-mobileme-authtoken realm="MMCalDav"
WWW-Authenticate: basic realm="MMCalDav"
X-Responding-Server: pv42p49ic-zteg05101701 1 a63660a6f7d1a25b5a7ed66dab0da843
X-Transaction-Id: 25cf8cf5-3c86-4c11-915f-f51ee9c79c86
Strict-Transport-Security: max-age=31536000; includeSubDomains
via: icloudedge:br30p01ic-ztde01130201:7401:16D44:Berlin
X-Apple-Request-UUID: 25cf8cf5-3c86-4c11-915f-f51ee9c79c86
X-Apple-Xrail: false
access-control-expose-headers: X-Apple-Request-UUID
access-control-expose-headers: Via

<html><head><title>Unauthorized</title></head><body><h1>Unauthorized</h1><p>You are not authorized to access this resource.</p></body></html>

When I targeted the redirecting URL encountered another error:

<html><head><title>Conflict</title></head><body><h1>Conflict</h1><p>cannot PUT to non-existent parent</p></body></html>

What am I doing wrong?

Answer 1

You are trying to PUT an event into the calendar homeset collection:

PUT https://p49-caldav.icloud.com
  /10430699202       # user scope
  /calendars         # calendar home
  /???               # calendar
  /ee451a47-c242-40c1-b295-4f1251a5d0cd.ics # event

A calendar homeset contains calendars, not events. So the next step is selecting the calendar you want to put your event into (e.g. the default calendar).

You can list the available calendars (and todo lists) with another PROPFIND Depth:1 on the homeset.