Login/Password for Calibre Server

[myudkowsky]

I'd like to use Calibre server with WordPlay, etc. on my Android phone, but when I attempt to log in with my username and password, I get errors.

I've set the port, username, and password for Calibre Server using the preferences pane, but the login/password protection sometimes does not work, and sometimes prevents me from accessing the content.

In these examples, I use the command line tool to demonstrate the problem of setting calibre to require a username and password, and then being unable to log in to the server.

643 ~: calibre-server --version
calibre-server (calibre 0.7.18)

Now I try to start the server with username foo and password bar, then I attempt to log in using curl for simplicity's sake:

: curl --user foo --include http://localhost:8083
Enter host password for user 'foo':
HTTP/1.1 401 Unauthorized
Date: Thu, 18 Nov 2010 13:31:55 GMT
Content-Length: 1344
Content-Type: text/html
Www-Authenticate: Digest realm="Password to access your calibre library. Username is foo", nonce="c8c2b42f5a613eb2290a2a2921826d3c", algorithm="MD5", qop="auth"
Server: CherryPy/3.1.2

Error:

  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 591, in respond
    self.hooks.run('on_start_resource')
  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 98, in run
    hook()
  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 58, in __call__
    return self.callback(**self.kwargs)
  File "/usr/lib/pymodules/python2.6/cherrypy/lib/auth.py", line 74, in digest_auth
    raise cherrypy.HTTPError(401, "You are not authorized to access that resource")

What's really odd is

: calibre-server --username foo --port 8083

I.e., no password set, still gives me

  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 591, in respond
    self.hooks.run('on_start_resource')
  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 98, in run
    hook()
  File "/usr/lib/pymodules/python2.6/cherrypy/_cprequest.py", line 58, in __call__
    return self.callback(**self.kwargs)
  File "/usr/lib/pymodules/python2.6/cherrypy/lib/auth.py", line 74, in digest_auth
    raise cherrypy.HTTPError(401, "You are not authorized to access that resource")
HTTPError: (401, 'You are not authorized to access that resource')

I find similar problems when I attempt to log in via a regular browser, e.g., via lynx or Firefox.

I also get the impression that from time to time, even when I require a username and password in the preferences, Calibre will let me through without one -- but that's a problem for a different day.

I installed Calibre from Debian unstable, and cherrypy is version 3.1.2-1l, also Debian unstable.

[myudkowsky]

P.S. I should mention that on the eReader forums on this site, Android users have run across similar problems. I'm not quite at the phone stage just yet -- I am still trying to make this work locally.

[kovidgoyal]

use a binary calibre install, don't use the version from debian.

[myudkowsky]

Not fixed.

I've used the official download, 0.7.28, in /usr/local.

: curl --user yudkowsky --include http://localhost:8083 
Enter host password for user 'yudkowsky':
HTTP/1.1 401 Unauthorized
Date: Thu, 18 Nov 2010 21:14:21 GMT
Content-Length: 1173
Content-Type: text/html
Www-Authenticate: Digest realm="Password to access your calibre library. Username is yudkowsky", nonce="50d31711349c7d128dcc34c0970febf1", algorithm="MD5", qop="auth"
Server: CherryPy/3.1.2

and

  File "/home/kovid/build/calibre/src/cherrypy/_cprequest.py", line 591, in respond
  File "/home/kovid/build/calibre/src/cherrypy/_cprequest.py", line 98, in run
  File "/home/kovid/build/calibre/src/cherrypy/_cprequest.py", line 58, in __call__
  File "/home/kovid/build/calibre/src/cherrypy/lib/auth.py", line 74, in digest_auth
HTTPError: (401, 'You are not authorized to access that resource')

By the way... where is per-user info (such as the server setting) kept?

[myudkowsky]

Here's another possible clue:

: curl --user calibre --include http://localhost:8083
Enter host password for user 'calibre':
HTTP/1.1 401 Unauthorized
Date: Thu, 18 Nov 2010 21:21:21 GMT
Content-Length: 1173
Content-Type: text/html
Www-Authenticate: Digest realm="Password to access your calibre library. Username is yudkowsky", nonce="2453dff2e88c81e16bc42c320be06d53", algorithm="MD5", qop="auth"
Server: CherryPy/3.1.2

In other words, when I start up the calibre server with "calibre-server --port 8083," I get the default auth name from my personal information and not the name "calibre." The inclusion of the correct user name strikes me as a security issue.

If I use

calibre-server --username calibre --port 8083 --password ""

then I can access the server using calibre and a blank password

If I use

calibre-server --username calibre --port 8083 --password "foo"

Then neither a blank nor "foo" work as the password.

Please let me know if I can be any further assistance.

[kovidgoyal]

If you're using curl you need to add --digest

so use

curl --user whatever --digest http://localhost:8083

[myudkowsky]

Thank you for your help so far -- caliber-server now works with authentication on both my local machine, from remote machines, and from my Android's browser.

It does not work from either WordPlay or from Aldiko. Both refuse to authenticate.

I'm using a URL of the form http://example.com:1234 - I have tried it with and without the /stanza portion of the URL, but of course my issue is authentication.

I'll try their forums next, but I was wondering if I'm overlooking something obvious.

[Paede]

@myudkowsky: Hi, you know that I had a similar problem with calibre. After installing the new version, all the problems are gone ! Maybe you also have to install and try the version 0.7.29

Have a nice day and happy reading !

[myudkowsky]

Paede, thanks for the suggestion, and I just downloaded the 0.7.29 edition.

I still can't log in from Aldiko or WordPlayer. It's very odd. Aldiko clearly reaches the Calibre server but will not accept my login and password.

[myudkowsky]

I should also mention that I can clearly see the access attempts in the server log, but that I do not see any associated errors.

[kovidgoyal]

IIRC neither aldiko nor wordplayer support digest auth.

[myudkowsky]

Other than using just a login and not a password, do you have any suggestions for alternative Android readers? And for eBook readers that support login/password?

[kovidgoyal]

not really, I don't own any android devices. But I am going to be adding an embedded reader to the content server soon, so you wont need to use any third party readers at all.

You can also integrate the content server into apache with WSGI and try using basic auth (instructions are in the tutorial section of the User Manual)

[myudkowsky]

Thanks, almost there. I've enabled WSGI. I get a 500 error message with the following error report:

[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1] mod_wsgi (pid=15170): Target WSGI script '/var/www/calibre-apache-config/scripts/calibre-wsgi-adapter.py' cannot be loaded as Python module.
[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1] mod_wsgi (pid=15170): Exception occurred processing WSGI script '/var/www/calibre-apache-config/scripts/calibre-wsgi-adapter.py'.
[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1] Traceback (most recent call last):
[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1]   File "/var/www/calibre-apache-config/scripts/calibre-wsgi-adapter.py", line 38, in <module>
[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1]     from calibre.library.server.main import create_wsgi_app
[Sun Nov 21 12:48:16 2010] [error] [client 127.0.0.1] ImportError: No module named calibre.library.server.main

I'm using a binary installation, which puts all the modules inside /usr/local/calibre/loader.zip. calibre-debug --paths gives me

CALIBRE_RESOURCES_PATH=/usr/local/calibre/resources
CALIBRE_EXTENSIONS_PATH=/usr/local/calibre/plugins
CALIBRE_PYTHON_PATH=/usr/local/calibre/loader:/usr/local/calibre:/usr/local/calibre/loader.zip

And my customized wsgi script contains:

# The first entry from CALIBRE_PYTHON_PATH
sys.path.insert(0, '/usr/local/calibre/loader')

If you have any additional hints, I'd be grateful.

[kovidgoyal]

you cannot use a binary installation, you have to install from source as typically the binary installs python modules will be mismatched with the python installation used by apache.