Blog Updates, tips and behind-the-scenes from the team

Cyberduck speaks to a lot of servers, and every server interprets a protocol slightly differently. To catch incompatibilities before you do, we have greatly extended the automated test coverage. Integration tests now run against disposable containers started with Testcontainers, instead of a handful of hosted accounts and embedded test servers.

Why Containers

Tests against hosted services depend on shared credentials, network access and the state of someone else's server. Containers are reproducible: each server is started on first use, shared for the lifetime of the test run and thrown away afterwards. Anyone can run the same tests on their own machine with Docker.

What Is Covered

• Amazon S3 and compatible storage. The S3 tests run against LocalStack, MinIO, Ceph RGW, RustFS, SeaweedFS and Scality CloudServer, in addition to AWS. See #18623.
• SFTP. OpenSSH, ProFTPD with mod_sftp and SFTPGo. See #18622.
• WebDAV. Apache httpd with mod_dav and SFTPGo. See #18622.
• Nextcloud, ownCloud and ownCloud Infinite Scale (OpenCloud), OpenStack Swift. See #18601.

The same test is run once per server implementation, and the Cryptomator vault tests additionally per vault version. Where a server legitimately does not implement a feature, such as server side copy, symbolic links or partial uploads, the test is skipped with a stated reason rather than silently passing.

Get Involved

The tests are part of the source code. If a server you rely on is missing, or you see a difference in behavior between implementations, open an issue or send a pull request.

Cyberduck 9.6 improves support for OpenCloud and ownCloud Infinite Scale. You can sign in using OpenID Connect and browse all the storage spaces available to your account.

Sign In with OpenID Connect

OpenID Connect is the default authentication scheme for OpenCloud. For deployments using the built-in identity provider, use the ready-made connection profile with the OAuth client registered by default.

1. Open Preferences… → Profiles in Cyberduck or Mountain Duck.
2. Enable the OpenCloud (OpenID Connect) connection profile.
3. Add a new bookmark and choose OpenCloud (OpenID Connect) in the protocol dropdown. Enter the hostname of your OpenCloud server in Server.
4. Connect to the bookmark and log in with your OpenCloud account in the web browser. Allow access for OpenCloud Desktop Client when prompted.

For deployments using Keycloak or Microsoft Entra ID as the identity provider, follow the step-by-step instructions to write a custom connection profile.

Storage Spaces

When connecting to OpenCloud or ownCloud Infinite Scale, the root folder lists virtual folders for the storage spaces available to your account:

• Personal. Your personal space. Not available to users with the role User Light.
• Spaces. Project spaces you are a member of, listed by name. Project spaces with clashing names are ignored.
• Shares. Files and folders shared with you by other users.

A bookmark with a default path opens relative to Personal, and quota is reported for the personal space. The virtual folders cannot be renamed or moved, and server side move is not supported between spaces.

Get Started

See the documentation for details.

Connecting to Amazon S3 no longer requires creating or storing access keys. With the new Amazon S3 (AWS Console Sign-In) connection profile in Cyberduck 9.6, you sign in with the same credentials you use for the AWS Management Console.

How It Works

Your web browser opens to authorize access and temporary credentials are issued for your IAM user, federated identity or root user. There are no long-lived secrets to copy, rotate or leak.

Connect in Cyberduck

1. Add a new bookmark and choose Amazon S3 (AWS Console Sign-In) in the protocol dropdown.
2. Choose Connect. The default web browser opens the AWS sign-in page. Sign in to AWS and approve the authorization request.

The web browser redirects to a local address to continue with the connection setup. You can close the browser window afterwards.

Set Up Permissions

The identity you sign in with must have a permissions policy granting access to S3, such as AmazonS3FullAccess or AmazonS3ReadOnlyAccess.

Get Started

See the S3 documentation for details.

Connecting to Azure Blob Storage no longer requires sharing storage account keys or Shared Access Signature tokens. With support for Microsoft Entra ID in Cyberduck 9.6, you sign in with your Microsoft account and access to blob data is authorized with Azure role-based access control (Azure RBAC).

Why Use Microsoft Entra ID?

Access keys grant full access to a storage account and are easily leaked or shared. Authenticating with Microsoft Entra ID instead gives you:

• No shared secrets: Nothing to copy, store or rotate. Cyberduck uses an OAuth 2.0 access token.
• Least privilege: Assign a read-only or read-write role to individual users or groups.
• Centralized management: Grant and revoke access in Azure, using the accounts and policies of your organization.

Connect in Cyberduck

1. Create a new bookmark and choose the Azure (Microsoft Entra ID) connection profile. It is bundled by default and can also be installed from Preferences → Profiles.
2. Edit the hostname to connect to your account in the format <account>.blob.core.windows.net.
3. Choose Connect and log in to your Microsoft account in your web browser. Allow to open Cyberduck to submit the authorization code.

Subsequent connections will not require authorization again, unless the refresh token expired due to inactivity. Tokens are saved in your keychain separately for every storage account.

Set Up Permissions

The signed-in user needs two permissions on the storage account:

• A data role such as Storage Blob Data Reader or Storage Blob Data Contributor for browsing and transferring files.
• The permission to read the account information, which Cyberduck uses to detect whether the account has a hierarchical namespace enabled. None of the built-in data roles include it, so grant it with a small custom role instead of the far more powerful Storage Account Contributor. Without it, connecting fails with AuthorizationPermissionMismatch.

Our tutorial Set Up Permissions for Microsoft Entra ID Authentication to Azure Blob Storage walks through creating the role and assigning both roles with the Azure CLI or the Azure portal, and lists troubleshooting steps.

Get Started

See the Azure Blob Storage documentation for details.

With Cyberduck 9.5 with have adopted the user interface for Liquid Glass, but the application icon with the duck objects tinted colours always remaining yellow and escapes the squircle jail imposed by default on application icons on macOS 26. We posted about this on @cyberduck back in September last year.

Post by @cyberduck@fosstodon.org

View on Mastodon

With the recent blog post Free the Icons from Paul Kafasis this has again gained some traction from other developers and we sure hope others join like the fine folks from Cryptomator. The application icon of Mountain Duck concedes we have to admit.

For the technically interested, this is implemented as a simplistic Dock Tile Plugin.