WebDAV service account to allow another Photoprism instance to upload photos to my library

[abrahampm]

Hi everyone,

I am trying to create an user with WebDAV access in my Photoprism instance to allow another Photoprism instance to upload photos to my library. However, I don't want to expose my whole library through WebDAV (originals) or allow login via Web interface for that user account.

I have tried the following via command line to create the user:
photoprism users add --name "WebDAV Service Account" --password "<hidden>" --no-login --webdav --upload-path "service-upload" service-user

However, if I specify --no-login, WebDAV access is denied. Furthermore, this does not seem to limit the service account to access the originals folder.

Question: is it possible to accomplish that with Photoprism built-in WebDAV server?

[abrahampm]

Probably related to this old discussion #3337

[abrahampm]

@lastzero I would like to contribute to solve this or something related to album sharing among Photoprism instances

[abrahampm]

I tested it and it works.

Test environment: Docker 25.0.3 on Ubuntu 22.04

Steps command line:

1. photoprism users add --name "WebDAV Service Account" --password "<hidden>" --no-login --webdav --upload-path "service-upload" service-user
2. photoprism auth add --scope webdav --name WebDAV service-user

However, the scope grants access to all folders via WebDAV (including originals). Is there any way to limit access to import folder (i.e. sync apps don't need access to originals folder)?

Thank you.

[lastzero]

If you use our test image, you can specify a base_path in the users database table. However, this is currently not possible through the UI / CLI, as it might give the impression that this configures a separate library for the user account, which is not the case. We will be happy to look into additional ways to restrict API access after 2FA and OIDC support have been released.

[abrahampm]

Sounds good. Do you have an expected date for next release? I am looking forward to see this working. Thank you.

[abrahampm]

By the way, the base_path trick works ;) Thank you

[lastzero]

We plan to release the 2FA this month, assuming I don't catch another cold.