WebDAV

In CloudMount

• Choose your vendor (Nextcloud, ownCloud, SharePoint, Fastmail and others): it enables features the server supports, such as modification times and checksums. Nextcloud / ownCloud (Android) and Nextcloud (Windows) are presets in the wizard.
• Server support varies, so modification times and free space are only available where the server provides them.
• CloudMount can find WebDAV servers on your local network that announce themselves.

At a glance

Capability	Support
rclone support tier	Tier 1: Core
Checksums	SHA-1
Modification times	Kept, to 1 s
Case-insensitive names	No
Duplicate names allowed	No
Server-side copy	Yes
Server-side move and rename	Yes
Folder move and rename	Yes, in one step
Free space reporting	Yes
Empty folders	Yes
Change notifications	No
Uploads of unknown size	No
Public links	No

From rclone’s documentation

The rest of this page is adapted from rclone’s documentation for this backend (rclone v1.75.2, MIT licence). It is written for rclone’s command line: where it mentions a flag such as --webdav-example, set the option example in the wizard’s options instead. Commands such as rclone copy aren’t part of CloudMount.

Setup notes

In CloudMount you add this drive from the Add drive screen, and the wizard asks for the options listed under Options. The notes below come from rclone’s setup guide.

Modification times and hashes

Plain WebDAV does not support modified times. However when used with Fastmail Files, ownCloud or Nextcloud rclone will support modified times.

Likewise plain WebDAV does not support hashes, however when used with Fastmail Files, ownCloud or Nextcloud rclone will support SHA1 and MD5 hashes. Depending on the exact version of ownCloud or Nextcloud hashes may appear on all objects, or only on objects which had a hash uploaded with them. With Nextcloud, rclone asks the server to calculate the SHA1 of uploads which had no hash to send, such as streamed uploads, and after setting the modification time, which discards the stored hash.

Options

Standard options

The wizard asks for these when you add the drive.

url

URL of http host to connect to.

E.g. https://example.com.

Type: string · Required

vendor

Name of the WebDAV site/service/software you are using.

Type: string

Choices:

• fastmail: Fastmail Files
• nextcloud: Nextcloud
• owncloud: Owncloud 10 PHP based WebDAV server
• infinitescale: ownCloud Infinite Scale
• sharepoint: Sharepoint Online, authenticated by Microsoft account
• sharepoint-ntlm: Sharepoint with NTLM authentication, usually self-hosted or on-premises
• rclone: rclone WebDAV server to serve a remote over HTTP via the WebDAV protocol
• other: Other site/service or software

user

User name.

In case NTLM authentication is used, the username should be in the format ‘Domain\User’.

Type: string

pass

Password.

NB Input to this must be obscured - see rclone obscure.

Type: string

bearer_token

Bearer token instead of user/pass (e.g. a Macaroon).

Type: string

Advanced options

The wizard shows these under Advanced options. Most drives work without changing any of them.

bearer_token_command

Command to run to get a bearer token.

Type: string

encoding

The encoding for the backend.

See the encoding section in the overview for more info.

Default encoding is Slash,LtGt,DoubleQuote,Colon,Question,Asterisk,Pipe,Hash,Percent,BackSlash,Del,Ctl,LeftSpace,LeftTilde,RightSpace,RightPeriod,InvalidUtf8 for sharepoint-ntlm or identity otherwise.

Type: string

headers

Set HTTP headers for all transactions.

Use this to set additional HTTP headers for all transactions

The input format is comma separated list of key,value pairs. Standard CSV encoding may be used.

For example, to set a Cookie use ‘Cookie,name=value’, or ‘“Cookie”,“name=value”’.

You can set multiple headers, e.g. ‘“Cookie”,“name=value”,“Authorization”,“xxx”’.

The headers are only sent to the host in the configured URL. If the server redirects to another host (including a subdomain or a different port) the headers are not sent to it, or to any further hop in that redirect chain. The exception is the directory listing and file download requests when auth_redirect is set, as that keeps all credentials across redirects.

Type: CommaSepList

pacer_min_sleep

Minimum time to sleep between API calls.

Type: Duration · Default: 10ms

nextcloud_chunk_size

Nextcloud upload chunk size.

We recommend configuring your NextCloud instance to increase the max chunk size to 1 GB for better upload performances. See https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/big_file_upload_configuration.html#adjust-chunk-size-on-nextcloud-side

Set to 0 to disable chunked uploading.

Type: SizeSuffix · Default: 10Mi

owncloud_exclude_shares

Exclude ownCloud shares

Type: bool · Default: false

owncloud_exclude_mounts

Exclude ownCloud mounted storages

Type: bool · Default: false

unix_socket

Path to a unix domain socket to dial to, instead of opening a TCP connection directly

Type: string

auth_redirect

Preserve authentication on redirect.

If the server redirects rclone to a new domain when it is trying to read a file then normally rclone will drop the Authorization: header from the request.

This is standard security practice to avoid sending your credentials to an unknown webserver.

However this is desirable in some circumstances. If you are getting an error like “401 Unauthorized” when rclone is attempting to read files from the webdav server then you can try this option.

Note that enabling this also permits sending your credentials over a plaintext HTTP connection if the server redirects from HTTPS to HTTP, which rclone otherwise refuses to do.

Type: bool · Default: false

description

Description of the remote.

Type: string

Provider notes

See below for notes on specific providers.

Fastmail Files

Use https://webdav.fastmail.com/ or a subdirectory as the URL, and your Fastmail email username@domain.tld as the username. Follow this documentation to create an app password with access to Files (WebDAV) and use this as the password.

Fastmail supports modified times using the X-OC-Mtime header.

ownCloud

Click on the settings cog in the bottom right of the page and this will show the WebDAV URL that rclone needs in the config step. It will look something like https://example.com/remote.php/webdav/.

ownCloud supports modified times using the X-OC-Mtime header.

Nextcloud

This is configured in an identical way to ownCloud. Note that Nextcloud initially did not support streaming of files (rcat) whereas ownCloud did, but this seems to be fixed as of 2020-11-27 (tested with rclone v1.53.1 and Nextcloud Server v19).

ownCloud Infinite Scale

The WebDAV URL for Infinite Scale can be found in the details panel of any space in Infinite Scale, if the display was enabled in the personal settings of the user through a checkbox there.

Infinite Scale works with the chunking tus upload protocol. The chunk size is currently fixed 10 MB.

Sharepoint Online

Rclone can be used with Sharepoint provided by OneDrive for Business or Office365 Education Accounts. This feature is only needed for a few of these Accounts, mostly Office365 Education ones. These accounts are sometimes not verified by the domain owner github#1975

This means that these accounts can’t be added using the official API (other Accounts should work with the “onedrive” option). However, it is possible to access them using webdav.

To use a sharepoint remote with rclone, add it like this: First, you need to get your remote’s URL:

• Go here to open your OneDrive or to sign in
• Now take a look at your address bar, the URL should look like this: https://[YOUR-DOMAIN]-my.sharepoint.com/personal/[YOUR-EMAIL]/_layouts/15/onedrive.aspx

You’ll only need this URL up to the email address. After that, you’ll most likely want to add “/Documents”. That subdirectory contains the actual data stored on your OneDrive.

Add the remote to rclone like this: Configure the url as https://[YOUR-DOMAIN]-my.sharepoint.com/personal/[YOUR-EMAIL]/Documents and use your normal account email and password for user and pass. If you have 2FA enabled, you have to generate an app password. Set the vendor to sharepoint.

Your config file should look like this:

[sharepoint]
type = webdav
url = https://[YOUR-DOMAIN]-my.sharepoint.com/personal/[YOUR-EMAIL]/Documents
vendor = sharepoint
user = YourEmailAddress
pass = encryptedpassword

Sharepoint with NTLM Authentication

Use this option in case your (hosted) Sharepoint is not tied to OneDrive accounts and uses NTLM authentication.

To get the url configuration, similarly to the above, first navigate to the desired directory in your browser to get the URL, then strip everything after the name of the opened directory.

Example: If the URL is: https://example.sharepoint.com/sites/12345/Documents/Forms/AllItems.aspx

The configuration to use would be: https://example.sharepoint.com/sites/12345/Documents

Set the vendor to sharepoint-ntlm.

NTLM uses domain and user name combination for authentication, set user to DOMAIN\username.

Your config file should look like this:

[sharepoint]
type = webdav
url = https://[YOUR-DOMAIN]/some-path-to/Documents
vendor = sharepoint-ntlm
user = DOMAIN\user
pass = encryptedpassword

Required Flags for SharePoint

As SharePoint does some special things with uploaded documents, you won’t be able to use the documents size or the documents hash to compare if a file has been changed since the upload / which file is newer.

For Rclone calls copying files (especially Office files such as .docx, .xlsx, etc.) from/to SharePoint (like copy, sync, etc.), you should append these flags to ensure Rclone uses the “Last Modified” datetime property to compare your documents:

--ignore-size --ignore-checksum --update

Rclone

Use this option if you are hosting remotes over WebDAV provided by rclone. Read rclone serve webdav for more details.

rclone serve supports modified times using the X-OC-Mtime header.

dCache

dCache is a storage system that supports many protocols and authentication/authorisation schemes. For WebDAV clients, it allows users to authenticate with username and password (BASIC), X.509, Kerberos, and various bearer tokens, including Macaroons and OpenID-Connect access tokens.

Configure as normal using the other type. Don’t enter a username or password, instead enter your Macaroon as the bearer_token.

The config will end up looking something like this.

[dcache]
type = webdav
url = https://dcache...
vendor = other
user =
pass =
bearer_token = your-macaroon

There is a script that obtains a Macaroon from a dCache WebDAV endpoint, and creates an rclone config file.

Macaroons may also be obtained from the dCacheView web-browser/JavaScript client that comes with dCache.

OpenID-Connect

dCache also supports authenticating with OpenID-Connect access tokens. OpenID-Connect is a protocol (based on OAuth 2.0) that allows services to identify users who have authenticated with some central service.

Support for OpenID-Connect in rclone is currently achieved using another software package called oidc-agent. This is a command-line tool that facilitates obtaining an access token. Once installed and configured, an access token is obtained by running the oidc-token command. The following example shows a (shortened) access token obtained from the XDC OIDC Provider.

paul@celebrimbor:~$ oidc-token XDC
eyJraWQ[...]QFXDt0
paul@celebrimbor:~$

Note Before the oidc-token command will work, the refresh token must be loaded into the oidc agent. This is done with the oidc-add command (e.g., oidc-add XDC). This is typically done once per login session. Full details on this and how to register oidc-agent with your OIDC Provider are provided in the oidc-agent documentation.

The rclone bearer_token_command configuration option is used to fetch the access token from oidc-agent.

Configure as a normal WebDAV endpoint, using the ‘other’ vendor, leaving the username and password empty. When prompted, choose to edit the advanced config and enter the command to get a bearer token (e.g., oidc-agent XDC).

The following example config shows a WebDAV endpoint that uses oidc-agent to supply an access token from the XDC OIDC Provider.

[dcache]
type = webdav
url = https://dcache.example.org/
vendor = other
bearer_token_command = oidc-token XDC