MD5 digest authentication fails against jabberd2 server
"David Johnson" <parsley1999-gM/[email protected]> Mon, 12 Nov 2007 13:42:22 +0000
| Newsgroups | gmane.network.jabber.exodus.user |
|---|---|
| Message-ID | <[email protected]> |
--===============1129654859==
Content-Type: multipart/alternative;
boundary="----=_Part_2519_9828330.1194874942530"
------=_Part_2519_9828330.1194874942530
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
I am using Exodus 0.9.1.0 (installed from a pre-built binary distribution)
on Windows XP and jabberd2 server (2.1.19, built using GCC on Solaris 8)
using mySQL backend authentication.
Each time I try to log in to the server, I get the message: "There was an
error trying to authenticate you. Either you used the wrong password, or
this account is already in use by someone else." The account in question
was created by the same Exodus client, and the password is correct. Several
other IM clients can connect successfully from Windows and other platforms
(Psi, Emacs, SamePlace for FireFox, Ciccinella, Kopete [Gentoo Linux]): this
problem appears to be confined to Exodus as client.
I did some digging using the debug XML facility (what a great idea!). It
seems that the MD5 challenge/response sequence goes like this (after Base64
decoding):
CHALLENGE: realm="bart.uk.mdli.com", nonce="GOxr5NcTcIW+lFSJ+4j2uQ==",
qop="auth, auth-int", charset=utf-8, algorithm=md5-sess
RESPONSE: username="dave",realm="bart.uk.mdli.com",nonce="",cnonce="6ac4f3d451b727fb9a0af6084368583a",nc=00000001,qop=auth,digest-uri="xmpp/bart.uk.mdli.com",charset=utf-8,response=7deda0f1fc02c8e3400a150a4eaec1da
This response triggers an authentication failure with a <malformed-request/>
tag. I suspect that the empty "nonce" value is the reason for the problem.
When I point Exodus at jabber.org, everything seems to work Ok. The
successful authentication sequence looks like this:
CHALLENGE: nonce="3649749743",qop="auth",charset=utf-8,algorithm=md5-sess
RESPONSE:
username="parsley1999",realm="",nonce="3649749743",cnonce="1dc87dd4a9f7e276aec23fc63ae019e8",nc=00000001,qop=auth,digest-uri="xmpp/jabber.org",charset=utf-8,response=78052535285555e8dc0a0e2298363c1b
The nonce, in this case, is repeated back to the server. I don't know why:
could it be because the jabber.org server doesn't provide a realm? Or is it
the auth-int option in qop?
Has anybody out there seen this problem before? Or successfully connected
Exodus to jabberd2? I'm seriously considering changing clients.
Who knows enough about the protocol and SASL to determine whether this is a
bug in Exodus or a bug in the server?
Thanks!
Dave
------=_Part_2519_9828330.1194874942530
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
<span class="gmail_quote"><br></span>I am using Exodus <a href="http://0.9.1.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">0.9.1.0</a> (installed from a pre-built binary distribution) on Windows XP and jabberd2 server (
2.1.19, built using GCC on Solaris 8) using mySQL backend authentication.<br><br>Each time I try to log in to the server, I get the message: "There was an error trying to authenticate you. Either you used the wrong password, or this account is already in use by someone else." The account in question was created by the same Exodus client, and the password is correct. Several other IM clients can connect successfully from Windows and other platforms (Psi, Emacs, SamePlace for FireFox, Ciccinella, Kopete [Gentoo Linux]): this problem appears to be confined to Exodus as client.
<br><br>I did some digging using the debug XML facility (what a great idea!). It seems that the MD5 challenge/response sequence goes like this (after Base64 decoding):<br><br><div><span><font face="Courier New" size="2">
CHALLENGE: realm="<a href="http://bart.uk.mdli.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bart.uk.mdli.com</a>", nonce="GOxr5NcTcIW+lFSJ+4j2uQ==",
qop="auth, auth-int", charset=utf-8, algorithm=md5-sess</font></span></div>
<div> </div>
<div><span><font face="Courier New" size="2"> RESPONSE: username="dave",realm="<a href="http://bart.uk.mdli.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bart.uk.mdli.com</a>
",nonce="",cnonce="6ac4f3d451b727fb9a0af6084368583a",nc=00000001,qop=auth,digest-uri="xmpp/bart.uk.mdli.com",charset=utf-8,response=7deda0f1fc02c8e3400a150a4eaec1da
</font></span></div>
<div> </div>This response triggers an authentication failure with a <malformed-request/> tag. I suspect that the empty "nonce" value is the reason for the problem.<br><br>When I point Exodus at <a href="http://jabber.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
jabber.org</a>, everything seems to work Ok. The successful authentication sequence looks like this:<br><br><div><font><font face="Courier New"> CHALLENGE: nonce="3649749743",qop="auth",charset=utf-8,algorithm=md5-sess
</font></font></div>
<div><font> </font></div>
<div><font><font face="Courier New"> RESPONSE: username="parsley1999",realm="",nonce="3649749743",cnonce="1dc87dd4a9f7e276aec23fc63ae019e8",nc=00000001,qop=auth,digest-uri="xmpp/jabber.org",charset=utf-8,response=78052535285555e8dc0a0e2298363c1b
</font></font></div>
<div><font> </font></div><br>The nonce, in this case, is repeated back to the server. I don't know why: could it be because the <a href="http://jabber.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
jabber.org</a> server doesn't provide a realm? Or is it the auth-int option in qop?
<br><br>Has anybody out there seen this problem before? Or successfully connected Exodus to jabberd2? I'm seriously considering changing clients.<br><br>Who knows enough about the protocol and SASL to determine whether this is a bug in Exodus or a bug in the server?
<br><br>Thanks!<br> Dave<br><br><br>
------=_Part_2519_9828330.1194874942530--
--===============1129654859==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Exodus mailing list
[email protected]
http://mail.jabber.org/mailman/listinfo/exodus
--===============1129654859==--