NotImplementedError: The server does not provide any of the currently supported authentication methods: basic, digest, bearer

[Kreijstal]

My server is configured with the "none" authentifcation (it only listens to localhost), but the library refuses to accept this... how to fix?

the server is called radicale, with the none authentication.

[Kreijstal]

maybe a dumb suggestion but

--- a/caldav/davclient.py.bak
+++ b/caldav/davclient.py
@@ -695,28 +695,46 @@
             if not r.status_code == 401:
                 raise
 
+        # davclient.py already has a log object defined at the top:
+        # from .objects import log
+        # So we can use log.debug, log.error etc.
+
         ## Returned headers
         r_headers = CaseInsensitiveDict(r.headers)
-        if (
+        elif (
             r.status_code == 401
-            and "WWW-Authenticate" in r_headers
             and not self.auth
             and self.username
+            and self.password is not None # We have a password (even if it's an empty string)
         ):
-            auth_types = self.extract_auth_types(r_headers["WWW-Authenticate"])
+            log.debug(f"DAVClient: Received 401. Attempting to set up authentication.")
+            auth_setup_done = False
+            if "WWW-Authenticate" in r_headers:
+                auth_types = self.extract_auth_types(r_headers["WWW-Authenticate"])
+                log.debug(f"DAVClient: WWW-Authenticate header found. Types: {auth_types}")
+                if "digest" in auth_types: # self.password and self.username already checked
+                    log.debug("DAVClient: Setting up Digest Auth based on WWW-Authenticate.")
+                    self.auth = niquests.auth.HTTPDigestAuth(self.username, self.password)
+                    auth_setup_done = True
+                elif "basic" in auth_types: # self.password and self.username already checked
+                    log.debug("DAVClient: Setting up Basic Auth based on WWW-Authenticate.")
+                    self.auth = niquests.auth.HTTPBasicAuth(self.username, self.password)
+                    auth_setup_done = True
+                elif "bearer" in auth_types: # Assuming self.password is the token for bearer
+                    log.debug("DAVClient: Setting up Bearer Auth based on WWW-Authenticate.")
+                    self.auth = HTTPBearerAuth(self.password)
+                    auth_setup_done = True
+            
+            if not auth_setup_done:
+                # If WWW-Authenticate was missing, or didn't list a usable type,
+                # but we have username/password, default to trying Basic Auth.
+                # This is for servers like Radicale with auth=none which might not
+                # send a WWW-Authenticate header or send one that's not 'basic'.
+                log.debug("DAVClient: No suitable auth type from WWW-Authenticate or header missing. Defaulting to Basic Auth attempt.")
+                self.auth = niquests.auth.HTTPBasicAuth(self.username, self.password)
+                # auth_setup_done = True # Not strictly needed here as we set self.auth
 
-            if self.password and self.username and "digest" in auth_types:
-                self.auth = niquests.auth.HTTPDigestAuth(self.username, self.password)
-            elif self.password and self.username and "basic" in auth_types:
-                self.auth = niquests.auth.HTTPBasicAuth(self.username, self.password)
-            elif self.password and "bearer" in auth_types:
-                self.auth = HTTPBearerAuth(self.password)
-            else:
-                raise NotImplementedError(
-                    "The server does not provide any of the currently "
-                    "supported authentication methods: basic, digest, bearer"
-                )
-
+            log.debug(f"DAVClient: Retrying request with auth object: {self.auth}")
             return self.request(url, method, body, headers)
 
         elif (
@@ -736,7 +743,23 @@
         if (
             response.status == niquests.codes.forbidden
             or response.status == niquests.codes.unauthorized
         ):
+            # If self.auth is still None after trying to handle 401 above, then we truly failed to auth
+            if response.status == niquests.codes.unauthorized and not self.auth:
+                 # This re-raises a NotImplementedError if we couldn't set an auth type
+                 # after the 401 response.
+                 if "WWW-Authenticate" in r_headers:
+                     auth_types_str = str(self.extract_auth_types(r_headers["WWW-Authenticate"]))
+                 else:
+                     auth_types_str = "Header not present"
+
+                 raise NotImplementedError(
+                    f"The server (at {str(url_obj)}) responded with 401, but after attempting to handle, "
+                    f"no suitable authentication method could be established. "
+                    f"Provided username: '{self.username}'. WWW-Authenticate types: {auth_types_str}. "
+                    f"Supported by client: basic, digest, bearer."
+                )
+
             try:
                 reason = response.reason
             except AttributeError:

[tobixen]

I'm a bit confused here, if I'm not mistaken the NotImplementedError should only be raised if r.status_code == 401 and the auth-method is unknown. If no authentication is needed, then you should not get a 401? (or perhaps I should drink my morning coffee and check again...)

Great care should be taken when changing this code section, it tends to come in new issues from people with exotic server configurations every time it's modified, but I don't see any big issues with your changeset. If it fixes your problems, submit it as a pull-request and we'll take it from there.

[tobixen]

Ok, I've had my coffee. So your Radicale sends a 401, does not send a WWW-Authenticate-header, but do expect a basic auth authentication? It's also a bit strange that the current code does not work, because I'm pretty sure it has been tested towards a radicale running on localhost ... I should check that up again. What version of radicale?

[Kreijstal]

Rqdicale 3.5.2 my config is the default config

But in [auth]
Is type=none, no password

[tobixen]

I have 3.5.2 here, and pytest -k TestForServerLocalRadicale does indeed break badly with the current master.

Post a pull-request, first thing I will do is to see if it fixes my problems with Radicale :-)

I should also check up that the github test run checks towards Radicale.

[tobixen]

My problem looks slightly different. I don't provide a password, but my local Radicale does send 401 and a WWW-Authenticate-header, so things break with an authorization error.

[tobixen]

In tests/conf.py the radicale username is hardcoded as user1 with password any-password-seems-to-work. If I replace it with empty strings, I can reproduce the NotImplementedError.

I tried hacking up things like this:

$ git diff
diff --git a/caldav/davclient.py b/caldav/davclient.py
index c18ea44..badeb4a 100644
--- a/caldav/davclient.py
+++ b/caldav/davclient.py
@@ -703,13 +703,12 @@ class DAVClient:
             r.status_code == 401
             and "WWW-Authenticate" in r_headers
             and not self.auth
-            and self.username
         ):
             auth_types = self.extract_auth_types(r_headers["WWW-Authenticate"])
 
             if self.password and self.username and "digest" in auth_types:
                 self.auth = niquests.auth.HTTPDigestAuth(self.username, self.password)
-            elif self.password and self.username and "basic" in auth_types:
+            elif "basic" in auth_types:
                 self.auth = niquests.auth.HTTPBasicAuth(self.username, self.password)
             elif self.password and "bearer" in auth_types:
                 self.auth = HTTPBearerAuth(self.password)
diff --git a/tests/conf.py b/tests/conf.py
index b777b33..e8e473b 100644
--- a/tests/conf.py
+++ b/tests/conf.py
@@ -134,8 +134,8 @@ if test_radicale:
         {
             "url": url,
             "name": "LocalRadicale",
-            "username": "user1",
-            "password": "any-password-seems-to-work",
+            "username": "",
+            "password": "",
             "backwards_compatibility_url": url + "user1",
             "incompatibilities": compatibility_issues.radicale,
             "setup": setup_radicale,

... but then I get an AuthorizationError, it does not seem that my radicale server will approve the empty password and username.

Any help or pull request is appreciated :-) Most likely I will have time to look more into this tomorrow.

[Kreijstal]

my username was not empy, password was empty..

[tobixen]

According to the documentation at https://radicale.org/v3.html#simple-5-minute-setup any username and any password should do.

So I get this to work:

$ python -m radicale --storage-filesystem-folder=~/radicale/collections --auth-type none &
[1] 398497

$ python
Python 3.13.3 (main, Apr  9 2025, 07:44:25) [GCC 14.2.1 20250207] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import caldav
>>> conn=caldav.DAVClient(url='http://localhost:5232', username='any', password='any')
>>> conn.principal()
Principal(http://localhost:5232/any/)

But with empty password and username it won't work for me - even when hacking up the code so it will use basic-auth with a blank username and password.

But the test code for radicale still breaks with AuthorizationError. I will need to look into that.

[tobixen]

I did manage to get the test case for radicale test again. At least locally. The github runners says that tests for python 3.12 and 3.13 has passed, elder versions of python is stuck at 39% complete. Hm!

[tobixen]

Now if I set an arbitrary username and an empty password, I get that NotImplementedError. Indeed, sending a username and a blank password should be allowed. Do you want to make a pull request on it?

[Kreijstal]

uhm, sure but I cannot do it this month, I'll do it once whenever I have time... I just wanted to see if I could use this as caldav

[tobixen]

Ok, I will fix it myself :-)