[commits] [Wiki] changed: ActiveSync
Wiki
wikiguest at horde.org
Thu Jun 25 07:45:57 UTC 2026
tdannhauer Thu, 25 Jun 2026 07:45:57 +0000
Modified page: https://wiki.horde.org/ActiveSync
New Revision: 291
Change log: Update to H6 status
@@ -3,441 +3,477 @@
-Exchange ActiveSync \(EAS\) is a protocol designed for client
synchronization of Email, Contacts, Calendar, Tasks, and Memo data
with a groupware/messaging server. EAS is a [WAP Binary XML
\(WBXML\)](http://en.wikipedia.org/wiki/WBXML) based protocol and is
communicated over HTTP/HTTPS. It was originally developed by Microsoft
for synchronizing PocketPC devices with Microsoft Exchange servers,
but has since become widely adopted as the preferred synchronization
method. Just about every modern device capable of synchronization
includes out of the box support for EAS. Android, iOS, Windows Phone,
Blackberry, even current versions of Microsoft Outlook and Windows
Mail include support for EAS.
+Exchange ActiveSync \(EAS\) is a protocol for synchronizing email,
contacts, calendar, tasks, and notes between mobile clients and a
groupware server. EAS uses [WAP Binary XML
\(WBXML\)](http://en.wikipedia.org/wiki/WBXML) over HTTP/HTTPS. It was
originally developed by Microsoft for Exchange, but is now supported
by iOS Mail, Android, Outlook 2013+, Windows Mail, and many
third-party clients.
-In addition to synchronization, the protocol provides some device
management and security related features.
+In addition to synchronization, the protocol provides device
management and security features \(provisioning, remote wipe, PIN
policies\).
## People
+
[Michael Rubinsky](MichaelRubinsky)
-## Bugs
+Torben Dannhauer
+## Bugs
-See the [bug tracker](http://bugs.horde.org/queue/sync) and the list
of [known issues](ActiveSync/KnownIssues) and the list of [broken
client behavior](ActiveSync/BrokenClientBehavior).
-
-## Description
-
-
-The Horde\_ActiveSync library provides the framework for
synchronizing a groupware server with an EAS client. This page
describes the use of this library for synchronizing a Horde Groupware
stack. For the specific versions and features supported in different
Horde versions, see the [ActiveSync Feature
Grid](ActiveSync/FeatureGrid).
-
-As of Horde 5, ActiveSync support passes [Microsoft's Remote
Connectivity Analyzer](https://www.testexchangeconnectivity.com) -
though you must disable provisioning on the account you use for
testing since the analyzer doesn't respond to the 449 Header that is
sent when Provisioning is required.
-
-For information on using this library in your own groupware stack,
see the [developer
documentation](http://dev.horde.org/api/master/lib/ActiveSync).
-
-## Server Setup
-
-
-To activate the server, it needs to be enabled in Horde's
configuration, on the ActiveSync tab. The SQL tables that horde uses
are created as usual from the Horde configuration screen.
-
-### Webserver
-
+See the [bug tracker](http://bugs.horde.org/queue/sync), the list of
[known issues](ActiveSync/KnownIssues), and [broken client
behavior](ActiveSync/BrokenClientBehavior).
-You will need to configure your webserver to redirect the URL
/Microsoft-Server-ActiveSync to your horde/rpc.php file. How you do
this depends on your webserver and it's configuration. For Apache,
something like:
+## Description
+
+The Horde\_ActiveSync library provides the protocol engine for
synchronizing a Horde groupware stack with EAS clients. In a typical
Horde 6 deployment the data backend is `Horde_Core_ActiveSync_Driver`
in `horde/core`, which talks to IMP \(mail\), Kronolith \(calendar\),
Turba \(contacts\), Nag \(tasks\), and Mnemo \(notes\).
+
+For the feature matrix by EAS version, see [ActiveSync Feature
Grid](ActiveSync/FeatureGrid). For developer-oriented protocol
documentation, see the [horde/activesync
README](https://github.com/horde/activesync/blob/FRAMEWORK_6_0/README.md) and
the [API documentation](http://dev.horde.org/api/master/lib/ActiveSync).
+
+Horde 6 ActiveSync passes [Microsoft's Remote Connectivity
Analyzer](https://www.testexchangeconnectivity.com) when provisioning
is disabled for the test account \(the analyzer does not respond to
the HTTP 449 header sent when provisioning is required\).
+
+## Server Setup
+
+### Enable ActiveSync in Horde
+
+Activate ActiveSync in Horde administration -> ActiveSync tab \(or
`var/config/horde/conf.php`\). Create the SQL state tables from the
Horde configuration screen when prompted.
+
+Minimum configuration:
+
+```php
+$conf['activesync']['enabled'] = true;
+$conf['activesync']['version'] = '16.1'; // global EAS ceiling
+$conf['activesync']['storage'] = 'Sql';
+$conf['activesync']['emailsync'] = true;
+$conf['activesync']['auth']['type'] = 'basic';
```
-
-Alias /Microsoft-Server-ActiveSync /var/www/horde/rpc.php
-```
-* Note: * Horde6 uses symlinks from the bundle/web to bundle/vendor.
Make sure your alias points to the symlink that is exposed in the
http.conf file\!
-* Note: * It has been reported that when running PHP via mod\_fcgid
on Apache that the Alias directive will not pass the correct URL to
the fcgid-script handler. This can be worked around by using a
RewriteRule instead \(adapted from
http://maurus.net/weblog/2010/10/26/running-z-push-1-4-2-with-apache-and-fastcgifcgid/\):
+
+History \(`$conf['history']['enabled']`\) must be enabled --
ActiveSync relies on it for change tracking.
+
+### Web server
+
+Clients expect two URL paths to reach Horde's RPC endpoint:
+
+- `/Microsoft-Server-ActiveSync` -- sync traffic
+- `/autodiscover/autodiscover.xml` and
`/autodiscover/autodiscover.json` -- Autodiscover \(see below\)
+
+In a Composer-based Horde 6 deployment, the web-readable entry point
is `web/horde/rpc.php` \(symlinked from the package tree\). Your web
server document root should point at the deployment's `web/` directory.
+
+#### Apache
+
+Recommended rewrite rules \(case-insensitive Autodiscover, v1 and v2\):
+
```
-
+<IfModule mod_rewrite.c>
RewriteEngine On
- RewriteRule ^/Microsoft-Server-ActiveSync /horde/rpc.php [PT,L,QSA]
-```
-There has also been a report from that the Authorization headers are
not correctly passed when using mod\_php with Apache. These are known
issues and are should actually already be taken care of by the
Horde\_Controller\_Request object. However, if you are still having
issues with ActiveSync complaining about no Authorization errors, you
can try the following configuration:
-```
-
-RewriteRule .* - [E=HTTP_MS_ASPROTOCOLVERSION:%{HTTP:Ms-Asprotocolversion}]
-RewriteRule .* - [E=HTTP_X_MS_POLICYKEY:%{HTTP:X-Ms-Policykey}]
-RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
-```
-None of these issues have been reported using lighttpd/fastcgi or
Apache+mod\_fastcgi+php-fpm.
-
-For Apache + PHP-FPM using mod\_proxy\_fcgi
-```
-
-ProxyPassMatch ^/Microsoft-Server-ActiveSync$
unix:/usr/local/php55/sockets/webapps.sock|fcgi://127.0.0.1:9000/var/www/html/horde/rpc.php$1
-```
-* Note: * Sockets are only available from Apache 2.4.8 or if the
appropriate patch has been applied. In all other case, use a tcp
connection.
-* Note: * If setting * ProxyErrorOverride On * then when testing the
ActiveSync endpoint via a browser you may not see the expected
activesync error message - as it would be replaced by the overridden
Apache error message.
-
-Since Horde ActiveSync connections are held open for a period of time
up to 3540 seconds \(depending on client and
$conf[activesync](activesync)[ping](ping)[heartbeatmax](heartbeatmax)
setting, if using a proxy server you need to ensure it does not time
out before the request is complete. Add this to your virtualhost:
-```
-
-ProxyTimeout 5400
-```
-### Autodiscover
-
-
-In order for the Autodiscovery service to work, a request to
/autodiscover/autodiscover.xml needs to reach rpc.php. How it does
this depends on your specific server setup. Below are a few examples
to point you in the right direction. Note that for autodiscovery to
work, the final endpoint MUST be over SSL. Autodiscover requests will
NOT work without a valid SSL certificate.
-
-The easiest example is when Horde is running on the same domain, with
NO subdomain as the email address domain. Example, for
user at example.com and Horde is reachable at https://example.com/horde.
For this, you simply create an Alias pointing
/autodiscover/autodiscover.xml to /rpc.php. Note that the
documentation specifies different case for the URL in different parts.
You should allow the following URLs to be redirected:
-```
+ # Pass MS headers through mod_proxy_fcgi to PHP-FPM when needed:
+ RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+ RewriteRule .* -
[E=HTTP_MS_ASPROTOCOLVERSION:%{HTTP:Ms-Asprotocolversion}]
+ RewriteRule .* - [E=HTTP_X_MS_POLICYKEY:%{HTTP:X-Ms-Policykey}]
+
+ # Autodiscover v1 (POX/XML) -- [NC] is required; iOS sends
/Autodiscover/Autodiscover.xml
+ RewriteRule "^/autodiscover/autodiscover\.xml$" "/horde/rpc.php" [NC,L]
+
+ # Autodiscover v2 (JSON) -- no $ anchor; path continues with
/v1.0/<email>
+ RewriteRule "^/autodiscover/autodiscover\.json" "/horde/rpc.php"
[NC,L,QSA]
+
+ # ActiveSync
+ RewriteRule "^/Microsoft-Server-ActiveSync" "/horde/rpc.php" [L,QSA]
+</IfModule>
+```
+
+*Note:* An `Alias` to `rpc.php` also works when PHP runs as mod\_php
in the same vhost. With `mod_proxy_fcgi`, prefer `RewriteRule` as
shown. If Authorization headers are not passed to PHP, the
`E=HTTP_AUTHORIZATION` rule above usually fixes it.
+
+*Note:* Horde 6 uses symlinks under `web/` into `vendor/`. Make sure
rewrites target `/horde/rpc.php` relative to the vhost document root
that serves Horde.
+
+#### nginx
+
+```
+location /Microsoft-Server-ActiveSync {
+ rewrite ^ /horde/rpc.php last;
+}
+location ~* ^/autodiscover/autodiscover\.xml$ {
+ rewrite ^ /horde/rpc.php last;
+}
+location ~* ^/autodiscover/autodiscover\.json {
+ rewrite ^ /horde/rpc.php last;
+}
+```
+
+Pass `Authorization`, `Ms-Asprotocolversion`, and `X-Ms-Policykey`
headers to PHP-FPM. Increase `fastcgi_read_timeout` \(or equivalent\)
for long-poll `Ping` requests -- see *Reverse proxy* below.
-Alias /autodiscover/autodiscover.xml /var/www/horde/rpc.php
-Alias /Autodiscover/Autodiscover.xml /var/www/horde/rpc.php
-Alias /AutoDiscover/AutoDiscover.xml /var/www/horde/rpc.php
-```
+#### lighttpd
-For Apache + PHP-FPM using mod\_proxy\_fcgi
+```
+alias.url = (
+ "/Microsoft-Server-ActiveSync" => "/var/www/horde/web/horde/rpc.php",
+ "/autodiscover/autodiscover.xml" => "/var/www/horde/web/horde/rpc.php",
+ "/autodiscover/autodiscover.json" => "/var/www/horde/web/horde/rpc.php"
+)
```
-ProxyPassMatch ^/autodiscover/autodiscover.xml$
unix:/usr/local/php55/sockets/webapps.sock|fcgi://127.0.0.1:9000/var/www/html/horde/rpc.php$1
-ProxyPassMatch ^/Autodiscover/Autodiscover.xml$
unix:/usr/local/php55/sockets/webapps.sock|fcgi://127.0.0.1:9000/var/www/html/horde/rpc.php$1
-ProxyPassMatch ^/AutoDiscover/AutoDiscover.xml$
unix:/usr/local/php55/sockets/webapps.sock|fcgi://127.0.0.1:9000/var/www/html/horde/rpc.php$1
-```
+Use case-insensitive matching or multiple alias entries if your
clients vary path casing.
+
+### Autodiscover
-A more common example is when Horde is running on something like
mail.example.com while the email addresses are simply @example.com.
For this, there are two options. First, if example.com is an existing
site, already runs over HTTPS and is on the same physical server as
mail.example.com, you could simply use the Alias example above in the
configuration for the example.com site. Note again, this MUST ALL BE
OVER SSL.
+Autodiscover tells the device where the ActiveSync server lives.
Horde supports **both** Autodiscover protocols:
-If the [ActiveSync](ActiveSync) client fails to find an acceptable
autodiscover response at https://example.com, it will then send a
request to http://autodiscover.example.com. Note that this is NOT over
SSL. This request MUST respond with a 302 redirect to a SSL endpoint
that will answer the autodiscover request:
+| Protocol | Request | Auth | Response |
+| --- | --- | --- | --- |
+| **v2 JSON** | `GET
/autodiscover/autodiscover.json/v1.0/<email>?Protocol=ActiveSync` |
None |
`{"Protocol":"ActiveSync","Url":"https://.../Microsoft-Server-ActiveSync"}`
|
+| **v1 POX/XML** | `POST /autodiscover/autodiscover.xml` | HTTP Basic
| XML with ActiveSync and optional IMAP/SMTP settings |
-```
+Modern clients \(recent iOS, Outlook\) try **v2 first**, then fall
back to v1. Both must reach `rpc.php` via the web server rules above.
A v2 `404` alone is harmless \(clients fall back\), but routing v2 is
recommended for faster account setup.
+SSL is required for production Autodiscover. Self-signed certificates
require the device to trust the CA.
+
+#### Email domain vs Horde hostname
+
+Autodiscover is driven by the **email domain** -- the part after `@`.
For `user at example.com`, the device queries `example.com` and
`autodiscover.example.com`. It does **not** know that Horde might live
on `mail.example.com` or `webmail.example.com` unless discovery
succeeds and returns that URL.
+
+This matters when Horde runs on a different host than the email
domain \(very common\).
+
+#### Discovery sequence
+
+For `user at example.com`, a typical iOS/Outlook client tries, in order:
+
+1. `GET
https://example.com/autodiscover/autodiscover.json/v1.0/user@example.com?Protocol=ActiveSync`
\(v2\)
+2. `POST https://example.com/autodiscover/autodiscover.xml` \(v1\)
+3. `POST
https://autodiscover.example.com/autodiscover/autodiscover.xml` \(v1\)
+4. `GET
http://autodiscover.example.com/autodiscover/autodiscover.xml` --
expects a **302 redirect** to HTTPS, then POST
+5. DNS SRV lookup `_autodiscover._tcp.example.com` -> POST to the target host
+
+DNS is used in two ways: **A/AAAA** records for each hostname in
steps 1-4, and an optional **SRV** record in step 5:
+
+```
+_autodiscover._tcp.example.com. 3600 IN SRV 0 1 443 mail.example.com.
+```
+
+Point the SRV target at the host that actually serves Horde Autodiscover.
+
+#### Path case sensitivity
+
+Microsoft documentation uses mixed case
\(`AutoDiscover/AutoDiscover.xml`\). Real clients often send
`/Autodiscover/Autodiscover.xml` or `/autodiscover/autodiscover.xml`
-- the difference is the **`d`** in the middle of the word. Apache
`RewriteRule` is case-sensitive unless `[NC]` is set. Use `[NC]` on
all Autodiscover rewrite rules.
+
+#### Single-host setup
+
+When Horde and the email domain are the same host \(e.g.
`https://example.com/horde` for `user at example.com`\), the Apache/nginx
rules in *Web server* above are sufficient. No redirect is needed.
+
+#### Multi-host / central Horde setup
+
+When email addresses use `@example.com` but Horde runs on
`https://mail.example.com`, configure **each email-domain vhost** to
forward Autodiscover to the Horde host.
+
+On the **email-domain** vhost \(e.g. `example.com`,
`autodiscover.example.com`\) -- **not** the Horde host:
+
+```
+RedirectMatch 302 (?i)/autodiscover/autodiscover.xml
https://mail.example.com/autodiscover/autodiscover.xml
+RedirectMatch 302 (?i)^(/autodiscover/autodiscover\.json.*)$
https://mail.example.com$1
+```
+
+Autodiscover clients follow the redirect and re-send the request. If
a client drops the POST body on `302`, use `Redirect 307` instead.
+
+Port 80 redirect for step 4 above:
+
+```
<VirtualHost *:80>
ServerName autodiscover.example.com
- DocumentRoot /var/www/html
RedirectMatch 302 (?i)/autodiscover/autodiscover.xml
https://mail.example.com/autodiscover/autodiscover.xml
</VirtualHost>
-
-# Obviously, you can't use a wildcard 443 here, but you get the
idea...basically you
-# need to set these Alias entries for
https://mail.example.com/autodiscover/autodiscover.xml
-<VirtualHost *:443>
- ServerName mail.example.com
- Alias /autodiscover/autodiscover.xml /var/www/html/groupware/rpc.php
- Alias /Autodiscover/Autodiscover.xml /var/www/html/groupware/rpc.php
- Alias /AutoDiscover/AutoDiscover.xml /var/www/html/groupware/rpc.php
-
- ## Rest of config....
-</VirtualHost>
-```
-### Basic example for lighttpd:
-```
-
-$HTTP["host"] =~ "(^|www\.)example\.com$" {
- url.redirect = ("^/(?i)autodiscover/autodiscover.xml$" =>
"https://horde.example.com/autodiscover/autodiscover.xml")
-}
-
-alias.url = ("/Microsoft-Server-ActiveSync" => "/var/www/horde/rpc.php",
- "/autodiscover/autodiscover.xml" => "/var/www/horde/rpc.php");
-```
-
-It should also be noted that the protocol documentation explicitly
lists the autodiscover url as all lowercase, some clients actually
request it as *\!AutoDiscover/AutoDiscover.xml* so if you are having
problems, you should adjust your alias/rewrite rules accordingly.
-
-### Setting up Horde ActiveSync behind a Reverse Proxy Server
-
-
-Since Horde ActiveSync connections are held open for a period of time
up to 3540 seconds \(depending on client and
$conf[activesync](activesync)[ping](ping)[heartbeatmax](heartbeatmax)
setting, if using a proxy server you need to ensure it does not time
out before the request is complete. Failure to do this will result in
errors like this in your proxy server's web server log:
-
-```
-
-[Mon Jun 10 22:24:56 2013] [error] [client 101.169.127.248]
(70007)The timeout specified has expired: proxy: error reading status
line from remote server 192.168.1.230
-[Mon Jun 10 22:24:56 2013] [error] [client 101.169.127.248] proxy:
Error reading from remote server returned by
/Microsoft-Server-ActiveSync
```
-For an Apache proxy:
+**Important:** Do **not** install ActiveSync rewrite rules on vhosts
that are **not** the Horde document root. If a non-Horde vhost
rewrites Autodiscover to `/horde/rpc.php` but has no `horde/`
directory, requests return **404** and any `RedirectMatch` on the same
vhost will not run \(`mod_rewrite` is evaluated before `mod_alias`\).
Email-domain vhosts should only **redirect** to the Horde host; the
Horde host vhost carries the `rpc.php` rewrites.
-```
-
- ProxyPass / https://192.168.1.230/ connectiontimeout=600
timeout=4000
- ProxyPassReverse / https://192.168.1.230/
-```
-
-That allows for up to 600 seconds for a connection to be established
\(should cover ALL possibilities\) and then holds that connection open
for up to 4000 seconds. This should be adjusted for you specific
needs/environment.
-
-### Horde
-
-
-You should make sure that the max\_execution time is either set to 0
or at least twice the maximum heartbeat interval. This can be set in
Horde's general configuration tab.
-
-
-## Application Configuration
-
-No additional steps are normally necessary for synchronization of the
supported applications. However, each application that supports
synchronization also has user preferences to determine which shares
will be synchronized. For example, in Kronolith the user's default
calendar is **always** synchronized, but the user can choose to add
any additional calendars he/she owns.
-
-### Multiple sources in the same collection
-
-
-Prior to Horde 5.2, all non-email sources would be "multiplexed"
together so they appear as a single source on the client. For example,
all user calendars would appear as a single, combined calendar on the
client and any new events would always be added to the user's default
calendar. Starting with Horde 5.2, applications can be configured to
provide all user sources as discrete sources on the client. Since not
all EAS clients support this, there are a number of ways to control
this.
-- By enabling/disabling the discrete sources preference per
application. This, of course, affects all of a user's devices, so must
be set to the lowest common denominator. If it is desired to always
force the multiplexed collections, you can lock the preference. When
this pref is activated, the [ActiveSync](ActiveSync) library a tries
to sniff out the client's capability and disables this if the client
is unable to honor it.
-- By implementing the activesync\_device\_modify hook \(see
*horde/config/hooks.php.dist*\). There is a sample hook already
defined that performs some basic device sniffing to determine which
collections do not support discrete sources.
-
-Note: that all sync-able sources **MUST** be writable by the user.
-
-The following chart is meant to provide a general idea of what device
class supports this, not a listing of all devices and capabilities:
-| Device | Calendars | Contacts | Tasks | Memos | Creating new
sources | Notes |
-| --- | --- | --- | --- | --- | --- | --- |
-| Android |
-| Blackberry | Yes | Yes | Yes | Yes | Yes, for Tasks and Notes |
Creating a new Notes source from 10.3.x only |
-| iOS | Yes | Yes | Yes | Yes, for Calendars and Tasks |
-| Outlook | Yes | No | Yes | n/a |
-| Windows Phone | Yes |
+#### Horde Autodiscover configuration
-Users can also view all their paired ActiveSync devices by visiting
their *ActiveSync Devices* preferences. This is located within Horde's
*Global Preferences*. From here, it is possible to force a complete
re-sync, or to request a remote wipe of a provisioned device \(see
below\).
+Horde must map the email address from the Autodiscover request to a
Horde username. Configure this on the ActiveSync tab \(`autodiscovery`
settings\). Hooks are available for custom logic -- see
`horde/config/hooks.php.dist`
\(`activesync_get_autodiscover_username`,
`activesync_autodiscover_xml`, `activesync_autodiscover_parameters`\).
-## Email Support
+If Autodiscover authentication fails, the device falls back to manual setup.
+
+#### Verifying Autodiscover
+
+| Test | Expected result |
+| --- | --- |
+| `POST https://mail.example.com/autodiscover/autodiscover.xml` \(no
credentials\) | **401** -- Horde asks for auth; routing works |
+| Same request | **404** -- routing broken \(check rewrite rules and
vhost\) |
+| `GET
.../autodiscover.json/v1.0/user at example.com?Protocol=ActiveSync` |
**200** JSON with ActiveSync URL \(if v2 routed\) |
+| Valid credentials on v1 POST | **200** XML with server URLs |
+
+Example:
+
+```
+curl -ks -o /dev/null -w "%{http_code}\n" \
+ -X POST -H "Content-Type: text/xml" --data "<x/>" \
+ https://mail.example.com/autodiscover/autodiscover.xml
+```
+
+A `401` response with realm "Horde ActiveSync" means the request
reached `rpc.php` correctly.
+
+### Reverse proxy
+
+ActiveSync `Ping` holds connections open for up to 3540 seconds
\(depending on client and
`$conf['activesync']['ping']['heartbeatmax']`\). Reverse proxies must
not time out sooner.
+
+Apache backend example:
+
+```
+ProxyPass / https://192.168.1.230/ connectiontimeout=600 timeout=4000
+ProxyPassReverse / https://192.168.1.230/
+ProxyTimeout 5400
+```
+
+Adjust timeouts for your environment. Similar `proxy_read_timeout` /
`fastcgi_read_timeout` settings apply for nginx.
+
+### PHP execution time
+
+Set `max_execution_time` to `0` or at least **twice** the maximum
heartbeat interval. Configure this in Horde's general configuration
tab or in `php.ini` / the PHP-FPM pool.
+
+## Administration
+
+Administrators manage ActiveSync under Horde administration ->
**ActiveSync** and **ActiveSync Devices**.
+
+Key options on the ActiveSync tab:
+
+| Setting | Purpose |
+| --- | --- |
+| Enable ActiveSync | Master switch |
+| Storage backend | `Sql` or `Nosql` \(MongoDB\) for device state |
+| Highest EAS version | Global protocol ceiling \(`2.5` ... `16.1`\) |
+| Email sync | Enable/disable mail collections |
+| Autodiscovery | Username mapping from email address |
+| Logging | Path, level, per-device log files |
+| Ping heartbeat min/max | Long-poll interval bounds |
+
+Per-user EAS version limits are set under **Permissions** ->
ActiveSync -> *Maximum ActiveSync protocol version* -- not in user
preferences. Per-device limits use the `activesync_device_version`
hook with `version_mode = device` in `conf.php`.
+
+Provisioning mode: **None**, **Allow**, or **Force** -- see
*Provisioning/Remote Wipe* below.
+
+Device management: administrators can view all paired devices,
request remote wipe, force re-provisioning, and block devices.
Per-device protocol log **files** are supported \(`logging.type =
perdevice`\); a per-device log toggle in the admin GUI is still on the
roadmap.
+
+[Microsoft documentation on EAS security
policies.](https://learn.microsoft.com/en-us/previous-versions/office/exchange-server-2010/bb123484\(v=exchg.141\))
+
+## Application Configuration
+
+No additional steps are normally required for synchronization of the
supported applications. Each application has user preferences for
which shares are synchronized. For example, in Kronolith the user's
default calendar is **always** synchronized; additional owned
calendars can be selected.
+
+### Multiple sources in the same collection
+
+Starting with Horde 5.2, applications can expose discrete calendars,
address books, task lists, and note pads on the client instead of
multiplexing them into a single collection. Not all EAS clients
support this.
+
+- Enable or disable the discrete-sources preference per application
\(affects all of a user's devices\).
+- Implement the `activesync_device_modify` hook
\(`horde/config/hooks.php.dist`\) for device-specific overrides.
+
+All sync-able sources **must** be writable by the user.
+Users manage paired devices under **Global Preferences** ->
*ActiveSync Devices* \(force re-sync, remote wipe\).
-Email synchronization has been added in Horde 5. Since in some
installs this may be undesirable, it is possible to deactivate email
support via Horde's configuration, on the ActiveSync tab.
+## Email Support
-ActiveSync email support requires an IMAP server. POP3 is not
supported. When used in the Horde groupware stack, it will use the
same server that IMP is configured to connect to. It is recommended
that this server support the QRESYNC server extension for performance
reasons, though it will work without this. It can also help
performance if an IMAP proxy is used. Some IMAP servers like older
Cyrus versions \(\< 2.4\) might support QRESYNC but do not enable per
mailbox MODSEQ by default. Enabling this on these servers will greatly
improve performance.
+Email synchronization can be disabled on the ActiveSync tab.
ActiveSync email requires IMAP; POP3 is not supported. In the Horde
stack, IMP's configured IMAP server is used.
-The only flags supported by ActiveSync are the *seen* and *flagged
for follow up* flags. Flag changes will be synchronized, but flag
changes alone will only trigger a SYNC if per mailbox MODSEQ is
supported on the server. Otherwise, the only thing that will trigger a
SYNC is the arrival of a new message \(technically, an increase in the
NEXTUID value\). Once this SYNC is triggered though, all message
changes are taken into account - including any flag changes.
+QRESYNC and per-mailbox MODSEQ on the IMAP server greatly improve
performance. An IMAP proxy can also help.
-Since ActiveSync does not support the *deleted* flag, messages in a
mailbox with this flag are ignored when syncing. Deleting a message
will produce the following actions:
+Supported mail flags: *seen* and *flagged for follow up*. Flag-only
changes trigger a sync when MODSEQ is available; otherwise a new
message arrival triggers sync and flag changes are picked up in the
same pass.
-- Deleting on the *device* will do one of two things; If the user has
enabled a Trash mailbox then the message will be moved to that
mailbox. Otherwise, the message is immediately expunged.
-- Deleting from a MUA: If the MUA is not configured to move messages
to the trash, and instead just flags them as deleted, these message
deletions will NOT be synched to the ActiveSync client, as there is no
equivalent command in the protocol. These messages will only be
removed from the ActiveSync client once expunged from the mailbox.
This is in accordance with the ActiveSync protocol specs. If you wish
to ensure all message deletions are synched quickly to the device, you
should configure the use of a Trash folder.
-
-Forwarding a message will always attempt to put the main message text
body in-line and keep any original attachments. It seems that a number
of devices cannot view message/rfc822 attachments, so any messages
that have been forwarded as an attachment may not be viewable in the
ActiveSync mail client.
+ActiveSync does not support the IMAP `\Deleted` flag. Messages
flagged deleted in a desktop MUA are not removed on the device until
expunged. Configure a Trash folder in IMP for device-side deletes to
move messages instead of immediate expunge.
## S/MIME Support
-| Client | S/MIME support |
-| --- | --- |
-| iOS | Can sign and encrypt outgoing email and successfully
validate/decrypt received email. Some issues with validating
certificates on emails sent from iOS \> 6.1. |
-| Android | Most clients do not support this AT ALL. Some, such as
Samsung's proprietary client, can send encrypted/signed email but
cannot decrypt or validate received email. The third party client
Touchdown supports this well. |
-| [BlackBerry](BlackBerry) 10 | Can sign and encrypt outgoing email,
but has trouble validating/decrypting received and sent emails. Some
issues with validating chained certificates |
-## Autodiscover
-
-
-Some devices attempt to use Exchange's Autodiscover service to make
it easier for both the user to setup the account and for the
administrator to make drastic changes like moving the server to a new
URL. Horde attempts to support this as best it can. For this to work,
you must create the URL alias as described above, and Horde must be
able to figure out the Horde username based on the email address the
user provided to the device. The configuration screen provides
multiple options for this. In the worst case, if Horde cannot
authenticate based on the provided information from the Autodiscover
request, the device will fall back to requiring manual configuration.
See the notes in the compatibility grid for any known information
regarding device support for this feature.
-
-## ActiveSync Versions
-
-
-See also: [Supported ActiveSync Features](ActiveSync/FeatureGrid).
-Horde 5 adds support for ActiveSync versions 12.0 and 12.1 - the
version shipped with Exchange Server 2007 and 2007sp1. This adds among
other things: HTML email support, flagged for followup, more atomic
policy settings, additional search sources, local wipe rules, and
WBXML based provisioning \(instead of the XML used in 2.5\).
-
-Horde 5.1 adds support for ActiveSync versions 14.0 and 14.1. These
versions are shipped with Exchange Server 2010sp1 and 2010sp2. This
allows MS Outlook synchronization \(with Outlook 2013 or newer\),
since Outlook requires at least ActiveSync protocol version 14.0. See
the [Supported ActiveSync Features](ActiveSync/FeatureGrid) for the
full list of features.
-
-## Administration
-
-Administrators can view all of the ActiveSync devices paired with the
server. This is the *ActiveSync Devices* link located under the
Administration menu. From here an administrator can request a remote
wipe, or force a re-provisioning of any device.
-
- at TODO: Explain various setup configuration options and security
policies \(heartbeat etc...\)
-
-[An explanation of the EAS security
policies.](http://technet.microsoft.com/en-us/library/bb123484%28v=exchg.141%29.aspx)
-## Provisioning/RemoteWipe
-
-Provisioning allows devices to be more tightly registered with a
particular server. It enables the server to be able to send policy
settings to the device. These policy settings include things like
requiring a PIN to unlock the device, the complexity of the PIN
required, the number of failed login attempts allowed etc...
Additionally, it enables devices to be remotely wiped so that if a
device is lost or stolen, the user or administrator can request the
device to be wiped.
-
-As of Horde 5, provisioning is enabled via the permissions interface.
You must first add the *ActiveSync* permission as a child of the
*Horde* permission. The *Provisioning* permission is a child of
*ActiveSync* and all policies are children of *Provisioning*.
-
-In order to enforce any security policies on a device, it must be
provisioned. However, not all devices support this and some will
downright refuse to work if it's enabled. There are three choices for
provisioning support. *None*, *Force*, and *Allow*. Choosing *None*
will disable provisioning and any enforcement of security polices or
remote wipe. *Force* will only allow devices that are successfully
provisioned to connect to the server. This means devices that don't
properly support provisioning, such as some older Android versions,
will simply not work. The third choice, *Allow* will enforce
provisioning on the devices that support it, but will also allow
devices that don't support it to connect to the server. Once
provisioning support is added, security policies can also be added via
the permissions interface.
-
-Users can initiate a remote wipe, as well as view/manage their
partnered devices in the ActiveSync user preference.
-
-Clicking *Wipe* in the Horde interfaces for device management flags
the server to send the wipe command to the device the next time it
synchronizes. The next time the device attempts to request a command
other then PING or OPTIONS, it will be wiped. The ActiveSync
preference page shows the status of all the user's devices. If the
status is listed as *Pending*, and you wish to cancel the wipe
request, you may do this by clicking the *Cancel Wipe* button. You
should see the status be reset to *Provisioned*. After it is wiped,
the status will be shown as *Wiped*, if you wish to allow the device
to connect to your server again, you need to explicitly remove the
device as a sync partner by clicking the *Remove* button. If you do
not remove this entry, the device will continue to be wiped each time
it reconnects to the server.
-
-## What works
-
-
-Contacts, Calendar, Task, Notes and Email syncing are all working.
Note that not all devices support Tasks or Notes. Of the tested
devices, iOS \(versions \< 5.0\) and Android are lacking native Task
applications. The TouchDown client, Moxier Mail, and Windows Mobile
both support Tasks. Windows Mobile, and iOS 7+ are the only clients
I've found so far that support Notes.
-
-For the complete feature set, sorted by [ActiveSync](ActiveSync)
version, see [Supported ActiveSync Features](ActiveSync/FeatureGrid).
-
-This following devices have been tested:
-| Device | Version\(s\) | Provisioning | GAL Searching | Notes |
Verified EAS Versions | Autodiscover |
-| --- | --- | --- | --- | --- | --- | --- |
-| Android Emulator | 6.0.0 | Yes, **required** | ? | Android 6.0
seems to **require** provisioning to be enforced on the server.
Otherwise, it enters into a FOLDERSYNC loop, where it keeps resetting
the sync state. There also appears to be **major** issues with the
native [ActiveSync](ActiveSync) implementation which leads to the
client constantly resetting the state making it pretty much unusable.
| 14.1 | ? |
-| BlackBerry PlayBook | 2.1.0.1088 | ? | ? | Emails, contacts and
calendars are synced, but the PlayBook often resets the sync when
connecting to 2 accounts | 12.1 |
-| BlackBerry 10 \(Simulator\) | 10.1 | Yes | Yes | Email, Contacts,
Calendars, Tasks, Notes | 14.1 | ? |
-| BlackBerry Z10, Q5, Q10, Z30 | 10.0, 10.1, 10.2, 10.2.1 | Yes | Yes
| Email, Contacts, Calendars, Tasks, Notes | 14.1 | Yes |
-| Google Nexus 4 | 4.2, 4.3 | ? | ? | Emails, contacts and calendars.
Android 4.4.2 has broken EAS support. | 14.1 |
-| Google Nexus 7 | 4.2, 4.3 | ? | ? | Emails, contacts and calendars.
Android 4.4.2 has broken EAS support. | 14.1 |
-| HP WebOS | 2.1.0 | Yes | ? | Contacts, Calendar, Tasks are working,
for SSL with a private certificate you have to trust the certificate
in the browser | 2.5 |
-| HTC Desire Z / HTC Desire HD | 2.2 | Yes | Yes | Contacts and
Calendar via native ActiveSync, SSL ok | 2.5 |
-| HTC Desire S | 2.3.3 | ? | ? | Contacts and Calendar via native
ActiveSync, SSL ok | 2.5 |
-| HTC Magic | Android 2.2.1 unbranded | ? | ? | Contacts, Calendars | 2.5 |
-| iOS Devices \(iPhone, iPad, iPod\) | 3.1.3 -\> 4.3.5 | Yes, with
Bugs. Certain versions of iOS - 4.3\(8F190\) for one, go into a
provisioning loop due to a bug in iOS \(it continues to send the OLD
X-Ms-Policykey value after it receives a new one\). | Yes | Contacts,
Calendar and Email | 2.5, 12.1 |
-| iOS Devices \(iPhone, iPad, iPod\) | 5.x | Yes | Yes | Contacts,
Calendar, Email, and basic support for Tasks via the Reminders App. |
2.5, 12.1 | Yes. |
-| iOS Devices \(iPhone, iPad, iPod\) | 6.0 | Yes | Yes | Broken email
push, issues with meeting invitations and responses. These have been
reported fixed in 6.0.1. Major issues with recurring events and
exceptions. See [known issues](ActiveSync/KnownIssues) for more info.
| 2.5, 12.1 | Yes. |
-| iOS Devices | 7.0.x | Yes | Yes | Contacts, Calendar, Email, Tasks,
and Notes. Major issues with recurring events and exceptions. See
[known issues](ActiveSync/KnownIssues) for more info. | 2.5, 12.0,
12.1, 14.0, 14.1 | Yes |
-| iOS Devices | 8.1.x | ? | ? | Contacts, Calendar, Email \(?\),
Tasks, and Notes. Major issues with recurring events and exceptions.
See [known issues](ActiveSync/KnownIssues) for more info. | ?,?,?,?,
14.1 | Yes |
-| Motorola Moto G | Android 4.4.4 | Yes | Yes | Mail, contacts,
calendar and remote wipe work. SSL works as well. | ? |
-| Motorola Razr i XT890 | Android 4.1.2 | Yes | Yes | Mail, contacts,
calendar and remote wipe work. SSL works as well. | ? |
-| Motorola Razr XT910 | Android 2.3.6, 4.1.2 | Yes | Yes | Mail,
contacts, calendar data tasks and remote wipe work. SSL works as well.
| ? |
-| Motorola Droid | 2.0.1, 2.1, 2.2, 2.3 | Broken support before 2.2,
works with 2.2 and above. | Native support in 2.2 and later, earlier
versions can use the *Corporate Directory* app in the Marketplace. |
Contacts, Calendar and Email. On Froyo/2.2 SSL connections will NOT
work with a self signed certificate even if the "Accept All
Certificates" checkbox is selected. See
http://www.google.com/support/forum/p/android/thread?tid=45e6836618212fdf\&hl=en \(A \(Free\) Level One certificate from http://www.startssl.com/ seems to work well here\). | 2.5, 12.0
|
-| Motorola Milestone | 2.1, 2.2 | See Motorola Droid above. | See
Motorola Droid above. | Contacts, Calendar, and Email | 2.5, 12.0 |
-| Moxier Mail | 2.15.1 \(Android\) | Yes | Yes | Contacts, Calendar
with minimal recurrence support and Email. DOES NOT RESPECT SERVER
SIDE STATE RESETS - so changing sync prefs, clearing state on server
will require a manual resync on the device\! | 2.5, 12.0 |
-| Nine | 1.5.0 | Yes | Yes | Mail, Contacts, Calendar, Tasks and
Notes. | 2.5 - 14.1 | Yes - As of 2019, Nine strictly needs
autodiscover and will not work without it. |
-| Nokia E5-00 | ? | ? | ? | Contacts \& calendar via RoadSync.
Calendar works native client but contacts do not seem to work. | 2.5 |
-| Nokia E90 | MfE 3.0 | ? | ? | Contacts verified to work. | 2.5 |
-| Nokia N900 | Maemo 1.3 | No | Yes, in the "contacts" app | Emails,
events, contacts and tasks work. Earlier versions of firmware are
either broken, or only support ActiveSync version 12.1. Sent messages
are only stored locally. The device always "pings" all folders by
default on the server, it might cause higher server load with a lot of
folders. You can adjust which folders to sync with the mfefolders
\(http://mfefolders.garage.maemo.org/\) app. | 2.5, 12.1 |
-| Samsung Galaxy Gio | 2.3.6 | Yes | Yes | Contacts and calendar data
works. SSL works as well. | 2.5 |
-| Samsung Galaxy Nexus | 4.0.2 \(ICS\), 4.1.2, 4.2.x, 4.3.x \(Jelly
Bean\) | Yes, full support. | Yes, native support via the search
functionality. | Calendar, Contacts, and Email works. Be sure to
ENABLE email syncing. Disabling email syncing - even if enabling
calendar and contacts - seems to prevent the initial folder sync
required for the account to be initially set up on the phone. | 2.5,
12.0, 12.1 | Yes, though the device defaults to using the email
address as the horde login and must be changed by the user if this is
not the case. |
-| Samsung Galaxy S2 | 2.3.4 | ? | ? | GT-I9100 - Contacts and
calendar data works. SSL works as well \(self-signed certificates
also\). | 2.5 |
-| Samsung Galaxy S2 | 4.0.3 \(ICS\) | Yes, full support. | Yes,
native support via the search functionality. | GT-I9100 - Calendar,
Contacts and Email works. Be sure to ENABLE email syncing. Disabling
email syncing - even if enabling calendar and contacts - seems to
prevent the initial folder sync required for the account to be
initially set up on the phone. SSL works as well \(self-signed
certificates also\). | 2.5, 12.0 |
-| Samsung Galaxy S2 | 4.1.2 \(JB\) | Yes, full support. | Yes, native
support via the search functionality. | GT-I9100 - Calendar, Tasks,
Contacts and Email works. Be sure to ENABLE email syncing. Disabling
email syncing - even if enabling calendar, tasks and contacts - seems
to prevent the initial folder sync required for the account to be
initially set up on the phone. SSL works as well \(self-signed
certificates also\). | 2.5, 12.1 |
-| Samsung Galaxy S3 LTE | 4.3 | Yes | ? | GT-I9305 - Calendar and
Email works. | 14.1 |
-| Samsung Galaxy Note 3 | 4.3 | Yes | Yes | Calendar, Contacts,
Email, Notes. | 14.1 |
-| Samsung Galaxy S4 | 4.3 | Yes | Yes | GT-I9505 - Calendar,
Contacts, Email, Notes. | 14.1 |
-| "Tasks and Notes" for Android | ? | ? | N/A | Requires Horde \>=
5.1.0. Available via the Android App store:
https://play.google.com/store/apps/details?id=org.myklos.inote | 12.0,
12.1, 14.1 | No |
-| TouchDown for Android | Version 6.5.0002 | Yes | Yes | Contacts,
Calendar \(recurrence/exceptions mostly work - minor bugs still being
worked out\), Tasks, and Email. | 2.5, 12.1 |
-| Windows 8 Mail | 8.1 | **required** \(see notes\) | Yes | Contacts,
Calendar, Email. Will not work if provisioning is completely disabled.
| 14.1 | Yes |
-| Windows Mobile | 6.1 | ? | ? | Contacts, Email | 2.5 |
-| Windows Mobile | 6.5 | Yes, full support. | Yes | Contacts,
Calendar, Tasks, Email. | 2.5, 12.0, 12.1 |
-| Windows Phone | 7.0 | Yes, with limited security policy support. |
Yes | Contacts, Calendar, Tasks, Email | 2.5, 12.0, 12.1 |
-| Windows Phone | 7.5 | Yes, with limited security policy support. |
Yes | Contacts, Calendar, Tasks, Email. Some devices may require a
Deleted items folder to be enabled. If error 8004010F is displayed on
the device, this is the likely culprit. See
http://social.msdn.microsoft.com/Forums/en/os\_exchangeprotocols/thread/86e10e2d-bc4d-43dc-b6b7-f02630ff052b for more info. | 2.5, 12.0, 12.1
|
-| Windows Phone | 8 | Yes | Yes | Contacts, Calendar, Tasks, Email |
12.1, 14.0, 14.1 | Yes |
-## Setting up the device
-
-
-It's beyond the scope of this page to go into detail for each
individual device. In general, you will need to create a new account
on the device. The account type should be something like *Microsoft
Exchange* or *ActiveSync*. Some devices use *Corporate*. You will need
to enter your normal Horde username and password in the appropriate
fields. In the field for the server address, you should enter the
**root** of the webserver or virtual host that hosts Horde. For
example, if you host horde at http://host.example.com/horde then you
should enter *host.example.com*. You can ignore any reference to a
*domain* entry. If the device **requires** the domain entry \(some
Windows Mobile devices do this\) you may safely enter any value.
-
-A special note for the iPhone/iPod \(and possibly others\) - if you
do not use a SSL enabled site you may receive errors about not being
able to find the ActiveSync server. If this happens, just continue, or
save, or whatever your option is to continue. On the iPhone, after
everything is completely set up, you must go back into the account
settings and disable SSL.
-
-After the connection particulars are entered, you should choose to
enable the folders that you want synchronized.
-
-## Outlook Connectivity
-
-
-Starting with Outlook 2013, Outlook has the ability to synchronize
via Exchange ActiveSync. This requires at least version 14.0 of the
EAS protocol, which Horde supports starting with Horde 5.1 \(the
[ActiveSync](ActiveSync) library supports this starting with 2.4.0 if
you are not using it with Horde\). It's important to remember that
connecting via [ActiveSync](ActiveSync) does not provide all the same
functionality of Outlook as you would get when connecting directly to
an Exchange server.
-
-If you have correctly setup your server to handle Autodiscover
requests, you should be able to create the Outlook account using the
basic "Email Account" screen. If you have trouble, or you don't have
Autodiscover setup, you should select manual setup and then
"Outlook.com or Exchange ActiveSync compatible service". Do **NOT**
select "Microsoft Exchange Server or compatible service".
-
-### Issues/Workarounds
-
-
-For some reason, Outlook 2013 doesn't use EAS to provide Free/Busy
lookup, even though the version of the EAS protocol it uses supports
it. If you want Outlook to be able to lookup Free/Busy information
using Horde/Kronolith you need to provide it with the Free/Busy URL.
Under *File -\> Options -\> Calendar Options* select the "Free/Busy
Options" button. Enter Kronolith's Free/Busy URL:
http://example.com/horde/kronolith/fb.php?u=%NAME%. The %NAME% string
will be replaced by the user portion of the SMTP mailing address used
in the meeting request.
-
-## What to do if you have problems \(or How to help us help you\)
-**First off, you should check the list of [known
issues](ActiveSync/KnownIssues) to see if your problem is expected or
not**. You can also check the Horde bug tracker to see if your issue
has been reported already.
-
-**If you are not even able to get past the initial setup page on your
phone**: you should first check to be sure you do not have SSL enabled
on the phone when you're server is not serving SSL. The iPhone/iPod
will not let you turn this off until after you save the configuration,
so you must continue through all the errors and go back into the
settings to disable SSL. You should also make sure that you have not
enabled Provisioning support if your phone does not support it.
-
-**If the configuration went well, but you are not seeing any
contacts/calendar items appear on the device:** Some clients require a
manual refresh or folder selection after setup when not using the
"Automatic Discovery" facility of Exchange. With TouchDown, for
example, after setup you must select the folders you want sync'd under
the Advanced settings tab.
-
-If all else fails and you can't figure out the issue, we will be
happy to try to help you work it out, but you should be able to
check/provide us with the following:
-
-- Be sure to check the notes in the chart above for your specific
device. This might be a known issue, or a workaround may be known.
-- Check the web server error logs and see if there are any PHP errors
being logged.
-- **Configure Horde to send ActiveSync log messages to a separate
logfile. This is configured on the ActiveSync tab of Horde's
configuration screen.**
-- If you are able to, it would also be useful to run a wireshark
session to capture the network communication.
-- In some cases, it might be useful for us to see the affected
device's state records in the database.
-#### Using tshark \(command line wireshark\) to obtain a network capture
-
-If you want to sniff the traffic on your server, and wireshark is not
available becuase there is no windowing system, you can use the tshark
application instead. The following command will capture http traffic
on port 80, and will ignore most requests we are not interested in.
It's worth mentioning that for the capture to be useful, you MUST not
setup SSL on the device. Depending on your user's rights, you may need
to run this as sudo:
+S/MIME signing and encryption work when IMP S/MIME is configured.
Native iOS and Outlook clients generally support S/MIME over
ActiveSync. Most Android native mail clients do **not** support
S/MIME; third-party clients may.
-```
-
-tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) -
((tcp[12]&0xf0)>>2)) != 0)' -w /path/to/capture/file
-```
-**A note to developers attempting to use wireshark/tshark over ssl
connections**: Some clients \(like Outlook\) REQUIRE a SSL connection
and as such, make it more difficult to trace. Wireshark is able to
dissect SSL communication if it is given the server's private RSA key.
The only caveat here is that it will NOT work with so called
forward-secure ciphers like Diffie-Hellman since the server's key is
not enough to decode the data. If you find yourself needing to trace
[ActiveSync](ActiveSync) traffic over SSL connections you must make
sure you configure the webserver to use a less secure cipher.
Obviously you only want to do this on test systems with non-production
private keys. For lighttpd, this can be done using something like:
-
-```
-
-ssl.cipher-list = "AES256-SHA AES128-SHA RC4-SHA RC4-MD5"
-```
-#### Debug logging on device.
-
-
-On Android devices, it is possible to enable debug level logging of
the ActiveSync conversation as well:
+## ActiveSync Versions
+
+Horde 6 supports EAS **2.5** through **16.1**. See [Supported
ActiveSync Features](ActiveSync/FeatureGrid) for the full matrix.
+
+Notable version milestones:
+
+| EAS version | Exchange equivalent | Highlights |
+| --- | --- | --- |
+| 12.0 / 12.1 | 2007 | HTML mail, follow-up flags, WBXML provisioning |
+| 14.0 / 14.1 | 2010 | Outlook 2013+ sync, extended search |
+| 16.0 | 2016 | Calendar instance model, draft sync, mailbox Find/KQL |
+| 16.1 | 2016+ | Propose-new-time \(COUNTER\), account-only remote wipe |
+
+Version negotiation: the server advertises a ceiling
\(`conf['activesync']['version']`\); the client sends
`MS-ASProtocolVersion` per request. Per-user permissions and
per-device hooks can lower \(or in some cases raise\) the ceiling for
individual accounts or devices.
+
+## Provisioning / Remote Wipe
+
+Provisioning registers devices with the server and enables policy
enforcement \(PIN, complexity, failed-attempt limits\) and remote wipe.
+
+Enable provisioning via the permissions tree: *Horde* -> *ActiveSync*
-> *Provisioning* -> individual policies.
+
+| Mode | Behavior |
+| --- | --- |
+| **None** | No provisioning; remote wipe disabled |
+| **Allow** | Provision devices that support it; others may still connect |
+| **Force** | Only provisioned devices may connect |
+
+EAS 16.1 adds **account-only remote wipe** for devices negotiating >= 16.1.
+
+Users and administrators initiate wipe from the device management UI.
The wipe command is sent on the device's next non-PING request. Status
*Pending* can be cancelled; status *Wiped* requires removing the
device entry before it can pair again.
+
+## Client Compatibility
+
+Contacts, calendar, tasks, notes, and email all sync through Horde
ActiveSync. Current iOS Mail, Android \(Gmail, Samsung\), Outlook
2013+, and Windows Mail generally work with EAS 14.1+. EAS 16.x
features require clients and server configuration that negotiate 16.0
or 16.1.
+
+Not all devices support tasks or notes natively. Check [known
issues](ActiveSync/KnownIssues) and [broken client
behavior](ActiveSync/BrokenClientBehavior) before troubleshooting a
specific client.
+
+For the complete feature set by protocol version, see [Supported
ActiveSync Features](ActiveSync/FeatureGrid).
+
+## Setting up the device
+
+Create a new account of type *Microsoft Exchange*, *Exchange*, or
*Corporate*. Enter the Horde username and password.
+
+With Autodiscover configured, enter only the email address and
password -- the device discovers the server. Without Autodiscover, set
the server to the hostname of the vhost that serves Horde \(e.g.
`mail.example.com`\), not the full URL path. The ActiveSync path
`/Microsoft-Server-ActiveSync` is implied.
+
+SSL should be enabled for production. Self-signed certificates must
be trusted on the device.
+
+After setup, select which folders/collections to synchronize. Some
clients require a manual folder refresh after the initial sync.
+
+## Outlook Connectivity
+
+Outlook 2013 and later can sync via ActiveSync \(requires EAS >=
14.0\). ActiveSync does not provide full Exchange functionality in
Outlook.
+
+With Autodiscover working, use the standard email account wizard. For
manual setup, choose *Outlook.com or Exchange ActiveSync compatible
service* -- **not** *Microsoft Exchange Server or compatible service*.
+
+Outlook does not use EAS for Free/Busy lookup. Provide Kronolith's
Free/Busy URL under *File -> Options -> Calendar -> Free/Busy Options*:
+
+```
+https://example.com/horde/kronolith/fb.php?u=%NAME%
+```
+
+`%NAME%` is replaced with the mailbox user portion of the meeting address.
+
+## Troubleshooting
+
+**First**, check [known issues](ActiveSync/KnownIssues) and the [bug
tracker](http://bugs.horde.org/queue/sync).
+
+**Autodiscover fails / account setup loops:**
+
+- Verify Autodiscover routing \(`POST .../autodiscover.xml` -> 401
without credentials\).
+- Confirm the email-domain vhost redirects to the Horde host when
Horde is on a separate hostname.
+- Check that non-Horde vhosts do not rewrite Autodiscover to a
non-existent `/horde/rpc.php`.
+- Verify `[NC]` on Autodiscover rewrite rules \(path case\).
+- Check DNS: A/AAAA for `example.com` / `autodiscover.example.com`,
optional SRV record.
+
+**Setup succeeds but no data appears:**
+
+- Some clients need a manual folder selection after setup.
+- Confirm the user has the ActiveSync permission.
+- Check provisioning mode -- some clients require *Allow* or *Force*.
+
+**Collecting diagnostics:**
+
+- Web server and PHP error logs.
+- ActiveSync log file -- configured on the ActiveSync tab; per-device
log files when `logging.type = perdevice`.
+- WBXML protocol log at higher verbosity for command-level detail.
+
+#### tshark capture
+
+For unencrypted HTTP debugging:
+
+```
+tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) -
((tcp[12]&0xf0)>>2)) != 0)' -w /path/to/capture.pcap
+```
-To reach the Debug logging screen:
-pre-Honeycomb: Go to the Account screen in the Email application and
type *debug*.
-Honeycomb \(tablet\): Go to the *Account Settings* screen using the
action bar, then tap *Email Preferences* repeatedly until *Debug*
appears in the account list. Tap *Debug*.
-All phones: From the dialer, dial \*#\*#36245#\*#\* \(the numbers
correspond to *EMAIL*\)
-All devices: Go to the account creation screen \(method differs
depending on OS version\) and enter *d at d.d* for email address and
*debug* for password.
-All devices \(adb\): $ adb shell am broadcast -a
android.provider.Telephony.SECRET\_CODE android\_secret\_code://36245
+SSL capture requires the server's RSA private key and
non-forward-secret ciphers -- use only on test systems.
-Here's what the checkboxes mean:
-- "Enable extra debug logging" - If checked, this turns on basic
logging \(no passwords or other content is logged\); most useful for
debugging crashes.
-- "Enable sensitive information debugging" - If checked, this causes
POP/IMAP passwords to be logged. Exchange passwords are NEVER logged.
-- "Enable Exchange parser logging" - If checked, logs a great deal of
the CONTENT of mail, contacts, and calendar entries \(excluding the
text of emails other than perhaps the first line\). This information
helpful for debugging things like missing folders, missing calendar
entries, etc.
-- "Enable Exchange SD card logging" - If checked, puts all of the
Exchange related logging onto SD card in a file named emaillog.txt.
This file grows continuously until deleted \(or the checkbox is
unchecked\). This can be helpful in finding issues that are sporadic,
as the log is essentially unlimited in size.
## Roadmap
+
+Historical milestones and current Horde 6 work. For protocol-level
detail on EAS 16, see the [horde/activesync
README](https://github.com/horde/activesync/blob/FRAMEWORK_6_0/README.md).
Open library refactor items are tracked in the package `doc/todo.md`.
+
### Horde 5.1
+
| Feature | Status |
| --- | --- |
| EAS 14\(.1\) support. | Complete. |
| Improved device management via hooks. | Complete. |
-| Support for SOFTDELETE | Complete. |
+| Support for SOFTDELETE. | Complete. |
+
### Horde 5.2
+
| Feature | Status |
| --- | --- |
| Improved email identity support. | Complete. |
-| Support for multiple sources per collection. E.g., Multiple
calendars, addressbooks etc... | Complete. |
+| Support for multiple sources per collection. E.g., multiple
calendars, addressbooks etc... | Complete. |
| Improved device management GUI. | Complete. |
+
### Horde 6.0
+
+#### Protocol and core stack
+
+| Feature | Status |
+| --- | --- |
+| EAS 16.0 support in applications. | **Complete** \(calendar
instance model, draft sync, Find/KQL, `ClientUid`, `Location`,
SmartForward `Forwardee`\). |
+| EAS 16.1 support. | **Complete** \(propose-new-time /
`METHOD=COUNTER`, `DisallowNewTimeProposal`, account-only remote
wipe\). |
+| Per-user EAS version ceiling via permissions. | **Complete**
\(`horde:activesync:version`\). |
+| Per-device EAS version ceiling via hook. | **Complete**
\(`activesync_device_version` with `version_mode = device`\). |
+| EAS 16.0 **Find** command \(mailbox/GAL search\). | **Complete** --
KQL parser in `horde/activesync`, IMP search backend in `horde/core`. |
+| Autodiscover v2 JSON \(`autodiscover.json`\). | **Complete** in
PHP; requires web server routing \(see *Autodiscover* above\). |
+| Autodiscover v2 JSON response hardening. | **Complete** \(Protocol
default, `json_encode`\). |
+| Multiplexed PIM folders \(multiple calendars, address books, task
lists, note pads\). | **Complete**. |
+
+#### Calendar, mail, and invitations \(2026\)
+
+| Feature | Status |
+| --- | --- |
+| EAS 16.0 recurring calendar instance sync. | **Complete** --
bound/modified instances, exception deletion \(`horde/kronolith`\). |
+| Meeting invitations in mail \(recurring RRULE / `RECURRENCE-ID` in
`MeetingRequest`\). | **Complete**. |
+| `MeetingResponse` RSVP and propose-new-time from device. |
**Complete** -- includes `InstanceId` -> `RECURRENCE-ID` mapping. |
+| IMP iTip RSVP UI above invitation mail body. | **Complete**. |
+| EAS 16.0 draft mail sync \(create/edit/send drafts on device\). |
**Complete**. |
+| `FILTERTYPE_INCOMPLETETASKS` for task collections. | **Complete**
\(`horde/core` / `horde/nag`\). |
+
+#### Stability and client compatibility \(2026\)
+
+| Feature | Status |
+| --- | --- |
+| SQL/Mongo row locks for parallel device state access. | **Complete**. |
+| Reject and repair corrupt collection `sync_data`. | **Complete**. |
+| Separate PING watermark from SYNC modseq \(iOS mail loop fix\). |
**Complete**. |
+| `FOLDERSYNC_REQUIRED` loop guard for broken clients. | **Complete**. |
+| Modern iOS Notes multiplexing behaviour. | **Complete**. |
+| PING orphan-collection and hierarchy-sync recovery. | **Complete**. |
+| `ItemOperations` fetch fixes \(deleted messages, folder type\). |
**Complete**. |
+
+#### Administration and operations
+
+| Feature | Status |
+| --- | --- |
+| Improved device management GUI \(grouped by user, collection
details, account wipe\). | **Complete**. |
+| Per-device protocol log **files** \(`logging.type = perdevice`\). |
**Complete**. |
+| Ability for admin to toggle sync log on/off **per device from GUI**
and view via GUI. | Planned. |
+| CLI admin tool. | If sponsored. |
+| EAS usage dashboard / live operator monitor. | Planned \(separate
admin tool; not in protocol library\). |
+
+#### Still open or deferred
+
| Feature | Status |
| --- | --- |
-| Ability for admin to toggle sync log on/off per device from GUI and
view via GUI. | Planned |
-| CLI admin tool. | If sponsored. |
-| SMS Synchronization - probably via a small separate app. | Planned,
but sponsoring would hasten. |
-| EAS 16.0 support in applications. | In progress. |
-*EAS 16.0 support is being added to the [ActiveSync](ActiveSync)
library prior to Horde 6, but in order to make full use of any new
features in the Horde Groupware stack, Horde 6 will be required. See
the [EAS 16.0](ActiveSync/EAS16) page for progress and further
information.*
-## Horde\_ActiveSync vs. Z-Push
+| SMS synchronization. | Planned -- today SMS collections are stubbed
so broken clients do not break mail sync; full backend support
targeted for Horde 6 refactor. |
+| `ItemOperations:Schema` requests. | Deferred -- no known client
requires this. |
+| HTTP 503 throttling \(`X-MS-Throttle`\). | Deferred -- relevant
only at high load. |
+| Task `Regenerate=1` \(Outlook post-completion regeneration\). | Not
supported -- Nag uses `completions[]`, not regenerated due dates. |
+| Horde 6 library refactor \(PSR-4 class names, `horde/http`
request/response, pluggable driver subsystems, storage layer rename\).
| Planned -- breaking changes; see `horde/activesync` `doc/todo.md`. |
+*EAS 16.0/16.1 application support shipped in the Horde 6 /
ActiveSync 3.x line on `FRAMEWORK_6_0`. See [Supported ActiveSync
Features](ActiveSync/FeatureGrid) for the version matrix.*
+
+## Horde\_ActiveSync vs. Z-Push
-The protocol handling in Horde\_ActiveSync was based on Z-Push. The
code that handles the protocol level is essentially the same, though
it has been heavily refactored and cleaned.
-
-Z-Push comes out of the box with a number of backends. The only one
that is really *fully* functional is the "ICS" backend which connects
to a Zarafa server. In addition to the ICS backend, Z-Push also
provides a number of other backends - all of which extend what they
call the "Diff" backend.
-
-The diff backend is a very inefficient way of determining what needs
to be synched. It uses file based storage - depending on the Z-Push
version it uses either a single file or a directory of files for each
device. These files contain, along with some basic device state
information, a list of every UID that is on the device.
-
-To determine what has changed, Z-Push essentially polls whatever
storage backend e.g., the IMAP server, every $timeout seconds to get
the **full** list of message IDs on the server. It then iterates over
all the UIDs that are known to be on the device and stats every single
one of these UIDs against the server to get the modification time,
flags etc.
-
-Like mentioned above, a number of backends are based on this Diff
backend. Out of the box, if you are not using a Zarafa server you have
the following options:
-
-- An IMAP backend - obviously only for syncing emails. This uses the
PHP IMAP functions for fetching the complete list of message IDs and
stating each and every UID - on each and every PING loop - by default
something like every 10 seconds or so.
-- A vCard backend that syncs contacts against a directory of vCards
on the server.
-- A Kolab backend - I'm not sure how complete this is, but this may
be the backend that's used by Kolab's ActiveSync support.
-- A Maildir backend that - from what I can tell - syncs email by
using filesystem based commands instead of going through an IMAP server.
-- A SearchLdap backend that - from what I can tell - is used as a
Global Address Book source for searching for individual contacts \(not
for syncing the entire address book\).
-
-As of the time Horde\_ActiveSync was written, you could only use
*one* backend at a time - so, unless you were using Zarafa \(or maybe
Kolab\) you could sync email *or* contacts. Since then they have
started a "combined" backend that is supposed to wrap any number of
backends. Last I checked it wasn't complete yet.
-
-The main differences between 1.5.x and 2 are the versions of EAS that
are supported. 1.5.x supports only up to Exchange 2003sp1 \(same as
Horde 4\). Version 2 is supposedly going to support up to EAS 14
\(Exchange 2010\) - though I believe only up to 12.1 \(Exchange 2007\)
is working...and I don't believe that is even fully functional.
-
-+++The main differences
-
-Some of these are specific to using Horde data as a backend to
Horde\_ActiveSync:
+Horde\_ActiveSync protocol handling was originally based on Z-Push
but has been heavily refactored. Key advantages of Horde's stack:
+
+1. **Modularity** -- pluggable `Horde_ActiveSync_Driver_Base`
backends; state and diff logic are separate.
+2. **Efficiency** -- Horde History-based change tracking instead of
Z-Push file-based UID polling.
+3. **Integrated groupware** -- calendar recurrence, timezone
handling, and appointment logic built in.
+4. **IMAP** -- uses `Horde_Imap_Client` with QRESYNC instead of the
PHP c-client extension.
+5. **Configuration** -- heartbeat, security policies, and
provisioning via Horde admin UI and permissions.
+6. **Protocol coverage** -- EAS 16.0/16.1 in Horde 6 vs Z-Push's more
limited Exchange-version support.
-1. Modularity. Separate classes for maintaining device state and for
obtaining message diffs. If not using Horde as a backend, all that is
needed is to write a new class that extends
Horde\_ActiveSync\_Driver\_Base. This allows the backend, itself, to
determine the best way to calculate diffs...like using Horde's History
system. In Z-Push, diff generation and state management are tightly
coupled.
-2. Efficiency. The history based diff engine is orders of magnitude
more efficient than Z-Push's file based diff backend.
-3. Unless using Zarafa, Z-Push contained no message-specific logic.
For example, no code for dealing with appointment related issues such
as timezones, recurrence series etc. Horde\_ActiveSync contains
support for these things out of the box.
-4. Horde's [ActiveSync](ActiveSync) library supports a larger set of
available EAS security policies.
-5. At least at the time of writing, Horde allowed better
configuration of things such as heartbeat/timeout intervals. We also
actually allow configuring available security policies. Z-Push had
basic support for provisioning and for turning on or off the
requirement for a device PIN - but contained no facility for
configuring any of the other options without editing code. Also, if
using Horde\_ActiveSync as part of a typical Horde install you get all
the ease of configuration that our administration interface provides.
-6. I don't have hard data on device compatibility as it compares to
Z-Push, but I do know that we have fixed some device specific issues
in the past that - at least at the time of this writing - were not
working with Z-Push. Certain Nokia devices come to mind that use MfE.
Z-Push lists these as "unknown" compatibility but they work, at least
for contacts/calendar with Horde. Remote wiping iOS devices is also
problematic in Z-Push.
-7. Email sync with Horde\_ActiveSync uses the vastly more efficient
Horde\_Imap\_Client library and takes full advantage of IMAP servers
with QRESYNC capabilities. Z-Push uses the very poor performing
c-client PHP extension.
-8. Horde's email support is more complete than Z-Push's IMAP based
implementation - with support for version 12.0 style email store
searching, follow-up flag synchronization, reply,forward history
synchronization, S/Mime signatures and encryption, and more.
-9. Horde\_ActiveSync currently supports almost the full feature set
up to Exchange 2010sp2 - Z-Push 2 works with Exchange 2007 has code in
development that works to some extent with 2010.
-10. Horde\_ActiveSync supports multiple users per device - when the
device supports it. AFAIK, Z-Push only supports a single user account
per device.
## Resources
-### Other implementations
-
-http://z-push.sourceforge.net
-https://developer.berlios.de/project/showfiles.php?group\_id=8963
-http://www.tine20.org/wiki/index.php/Developers/Getting\_Started/Working\_with\_GIT
-http://code.google.com/p/libeas/
-
-### Documentation
-http://www.scribd.com/doc/6601589/W11-Server-Active-Sync
-http://en.wikipedia.org/wiki/Exchange\_ActiveSync - Good description
of differences between AS versions.
-http://paulrobichaux.wordpress.com/2011/08/09/advice-to-exchange-activesync-developers/
-http://blogs.msdn.com/b/exchangedev/
-http://msdn.microsoft.com/en-us/library/dn144954%28v=exchg.140%29.aspx
+### Protocol documentation
-### Clients
-[TouchDown](http://www.nitrodesk.com/dk_touchdownFeatures.aspx)
-[Nine](https://play.google.com/store/apps/details?id=com.ninefolders.hd3) -
currently the best third party client available for Android, in my
opinion.
-#### Outlook 2013
-[Some links to articles describing issues with
OL2013](http://forums.smartertools.com/threads/eas-and-outlook-2013-issues.37079/)
-[Undocumented
Codepage](http://social.msdn.microsoft.com/Forums/en-US/75562e26-158c-45d3-b114-b2b82928c3a7/undocumented-activesync-codepage?forum=os_exchangeprotocols)
-#### Android:
+- [Microsoft Exchange ActiveSync protocol
docs](https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-ascntc30)
+- [Exchange ActiveSync
\(Wikipedia\)](http://en.wikipedia.org/wiki/Exchange_ActiveSync)
+- [horde/activesync
README](https://github.com/horde/activesync/blob/FRAMEWORK_6_0/README.md)
-http://developer.android.com/sdk/index.html
-https://android.googlesource.com/platform/packages/apps/Email/
-https://android.googlesource.com/platform/packages/apps/Exchange/
-https://android.googlesource.com/platform/packages/apps/Calendar/
+### Horde wiki
+
+- [ActiveSync Feature Grid](ActiveSync/FeatureGrid)
+- [Known Issues](ActiveSync/KnownIssues)
+- [Broken Client Behavior](ActiveSync/BrokenClientBehavior)
+
+### Other implementations
-#### iOS
-[Enterprise Deployment
Guide](http://images.apple.com/ie/iphone/business/docs/Enterprise_Deployment_Guide.pdf).
-[iPhone configuration utility](http://support.apple.com/kb/DL1465).
+- [Z-Push](https://github.com/Z-Hubo/Z-Push)
+- [z-push](http://z-push.sourceforge.net) \(legacy\)
-#### Windows Mobile \(very old, probably of little value\):
-[Cellular Network
Emulator](http://www.microsoft.com/downloads/info.aspx?na=47&p=2&SrcDisplayLang=en&SrcCategoryId=&SrcFamilyId=38c46aa8-1dd7-426f-a913-4f370a65a582&u=details.aspx%3ffamilyid%3dA6F6ADAF-12E3-4B2F-A394-356E2C2FB114%26displaylang%3den)
-[Device
Images](http://www.microsoft.com/downloads/details.aspx?familyid=38C46AA8-1DD7-426F-A913-4F370A65A582&displaylang=en)
-[Setup](http://www.devx.com/wireless/Article/40981/1954)
-#### BlackBerry simulators:
-[Blackberry
simulators](http://us.blackberry.com/sites/developers/resources/simulators.html)
More information about the commits
mailing list