3.2.0 Server: iOS clients CardDAV Account Profile Pop-up

[matthewstock]

I have been running a Radicale v3.2.0 server on Ubuntu 20.04 since May 2024 with largely great success. I have a fleet of iOS clients that have a CardDAV Account profile created on the devices to connect to my server hosting one read-only contact list using a shared username and password.

Up until very recently, the system has worked great, but out of the blue last week, a large subset of my iOS clients seemed to have an issue authenticating with the server. I'm seeing that the devices now have pop-ups asking for the CardDAV Account profile password. I'm not aware of any updates to my server which may have lead to a breaking change.

I am familiar with going into the /etc/radicale/config file and turning the Level=debug, then using the journalctl command to review logging. But I have yet to see anything useful helping me troubleshoot. Does anyone have any recommendations about how to go about looking into and additional logs on the server-side to see what may have occurred here?

[pbiering]

Are you terminating TLS directly on Radicale or is there a reverse proxy terminating TLS in front of? Something wrong with the certificate like expired?

[matthewstock]

We do have an reverse proxy fronting the Radicale server, but hosted on a different physical machine. I'm showing the certificate is still valid and expires next year. Is there any additional troubleshooting that is recommended? It's just odd to me that some of our clients had this issue, while others were seemingly not impacted.

[pbiering]

Any pattern found related to "User Agent" - did the client store and remember the password after this unexpected pop-up?

[matthewstock]

I have been mostly successful manually re-typing the password into the client iOS device. Most of the time, the device accepts the password, then after a period of several hours, the device will eventually reconnect to the server and re-sync all of the contacts in the contact list. Other times, after diligently re-typing the password, the client is still unable to connect to the server.

The contact list has 200 contacts, so I was wondering if I was touching some sort of upper limit on number of contacts by size, or some other limitation.

[pbiering]

I don't believe it's reaching limits. I more assume that in case a connection is not successful, client forgets the credentials.

You have to investigate logs on reverse proxy and check also connection between reverse proxy and Radicale.

See also
https://github.com/Kozea/Radicale/wiki/Reverse-Proxy-Hints
https://github.com/Kozea/Radicale/wiki/Reverse-Proxy-Diagnostics-Troubleshooting#connection-not-working-or-flapping

[matthewstock]

I will dive into those links. Thank you Peter!