Handle 403 error due to expired (external) cookies when using webdav (with onedrive business/sharepoint)

ozel · February 6, 2025, 11:45am

Hi,

I'm successfully using the webdav backend with vendor = other to mount files of a onedrive business (actually sharepoint) account with externally supplied auth cookies in my rclone.conf:
headers = "Cookie","FedAuth=XXX;rtFa=XXX;"

I cannot use vendor = sharepoint as my tennant org unfortunately does not anymore allow the authentication used by rclone in that case. I understand this would include creation of and renewing the cookies every 12 hours by rclone itself.
The auth error I would get is the same as reported here and here:

Authentication Failure (AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.)

My python script for externally updating rclone.conf with these cookies fetched from Firefox or Chromium can be found here:

gist.github.com

https://gist.github.com/ozel/bb1cbdd4674445aba1c25289166afda3

fetch_sharepoint_auth.py

#!/bin/python3

import sqlite3
from pycookiecheat import BrowserType, get_cookies # only required for decrypting chromium cookies

# This script fetches the current rtFa and FedAuth auth cookies of MS sharepoint.com from the Firefox 
# or Chromium cookies database (tested with MS Edge for linux) and updates the *last line* of 
# davfs2.conf or rclone.conf files with those cookies. There must not be empty lines at the end of those files.
#
# This essentially enables mounting all files of a OneDrive Business account as a local WebDAV share in Linux

This file has been truncated. show original

Now I would like to catch the 403 Forbidden error whenever the cookies expire after 5 days, unmount rclone gracefully, supply new cookies and remount.
Ideally, I would like to call a hook script which opens the sharepoint website followed by my cookie fetching script above. Any ideas how this could be achieved? Or maybe a different solution for renewing the cookies before they actually expire? I am willing to work on the rclone codebase myself but would require some help/best practice guidance

ozel · February 10, 2025, 9:12am

Let me generalise this request a bit more: whenever an rclone mount is failing suddenly (connection issues, expired auth issues etc.), it would be extremely convenient to be notified on the user level beyond parsing the log files independently.

Sure, default Unix style is dumping errors in log files. However, I'd argue that rclone is so versatile and likely used for important user backup purposes in "mount mode" that it could justify the effort. I'm unsure which widely established user land protocol on Linux desktops could be appropriate (DBUS/libnotify?).
Maybe something like an error_hook_script config option could enable a reliable call of a custom user script and would be most straightforward to implement?

Or is there already some similar rclone feature I've overlooked?