Our client has a calendar that shows events in two ways:

  1. Non-authenticated users see public events that are available for everyone to see.
  2. Authenticated users see those public events and events that are in organic groups that they are a member of.

The client would like users to be able to download an ICS file of events that they're entitled to see. This should be authenticated each time a request is sent. There should be one URL for all users, that they can plug into their calendar client. There should be some authentication to make sure they are allowed to access those events.

We tried Secure Site but on my local machine it kept segfaulting - we spent two days looking into that problem and couldn't solve it, and on the basis that I'm the one that needs to do the work, we chose to use Services, Services Views and Services Basic Authentication instead.

We've got a calendar view, and I set up a Date iCal display on it, just so I can get all of the appropriate fields and filters. (It could have been anything - a page or block - I just chose this one.)

I also set up a Services display that returns the data. Finally, I added a custom REST server response formatter that reformats the Services display as an ICS, ready for use in calendar applications.

I can use cURL to retrieve that data and everything there seems to be okay. However, I don't seem to be able to get the basic authentication working.

There should only be one URL that user needs to be able to enter into their calendar, for example:


And that should retrieve the correct output for the user, regardless of what they've got on their calendar. (So no separate authenticated/unauthenticated views.)

However, I don't retrieve what I want to retrieve: if I access the page in my browser or directly through Apple Calendar, I only ever get the public events, regardless of what account information I use (and yes, I'm using the correct user information). According to the report log, no sign in occurs.

But, if I access it through cURL on the command line, no matter whether or not I include a username/password, I get the authenticated, private events. Each time, I get "session opened for username" in the report log.

I've tried changing various settings around in the Resources section of the Services view, but to no avail. I can't seem to find any documentation online either, and I've spent the best part of two days looking now.

However I don't know if I've just gone about this in completely the wrong way, because there is a lack of documentation and I've pieced all of this together from various tutorials and documentation pages, most of which are for Drupal 6.

Extra info: this is on my localhost. I don't know much about developing in a local environment, is it possible that I need to set something up on my machine for this to work?

Latest versions of Drupal and Services, Services Views and Services Basic Authentication.

Update 12th June:
It looks like this won't be possible with Services Basic Auth on our setup. The module checks the PHP_AUTHORIZATION setting which doesn't get set when using a CGI/Fast CGI server setup - unfortunately it looks like that's what we're using ...

While I could rewrite everything to send off a request that checks your username/password, e.g. access example.com/calendar.ics and have the script check there, it's not possible to send your username and password through that URL such as username:password@example.com/calendar.ics.

So I'll be looking for another solution. Any suggestions are appreciated.

  • Sorry if I've misunderstood, but are you expecting the user:password you include in the URL to translate to the username/password for a Drupal account, and for Drupal to somehow authenticate based on that? If so, that's not how it works (not just with Drupal, with any application). If you want to authenticate users in that way you'll need to set something up completely separate to Drupal to make that translation, instigate the session, and so on. But you probably don't want to do that, passing auth details in a URL is obviously a security risk. But if I've misunderstood please let me know – Clive Jun 10 '14 at 9:35
  • That is what I was hoping for, but okay, if that's not how it can/will work, then that's fine, I can do it another/the correct way - do you know of a resource I can look at to find out how it should work? Like I say, all the tutorials/docs I've seen have been for old versions, or incomplete. My own knowledge is lacking, too, so it's no surprise I've misunderstood how to get it working :) – Sophie S-K Jun 10 '14 at 9:40
  • Sorry, I didn't notice that you've got Services Basic Auth installed - ignore what I said, that module is supposed to facilitate exactly what you're trying to do. I don't have any suggestions I'm afraid, hopefully someone else will be more familiar with this set up – Clive Jun 10 '14 at 9:45
  • Okay, no worries. I'll go back and edit the original post to make that more obvious then. Thanks! – Sophie S-K Jun 10 '14 at 9:45
  • 1
    @wizonesolutions No, in the end the client put this piece of work on hold. As far as I know, it never got picked up again. – Sophie S-K Feb 19 '16 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.