Comment #8 on issue 690 by volkov.rodion: password sent in plain text during user auth http://code.google.com/p/openmeetings/issues/detail?id=690
I am sorry, but I cannot implement MD5 authentication right now, the problem is in Active Directory - many hours spent on the subject still haven't answered the main question - whether it is possible to authenticate client on an AD server having only his hash, but not password. This is the main question and without an answer to it the encryption on the client side is not possible. Though, I have looked in the other direction - using the encoded stream (rtmps) to transfer all the data, and fortunately, OpenMeetings allows to do that. Patch enabling rtmps is attached, currently it uses port 8443, because in my Red5 root/conf/red5.properties the line says rtmps.port=8443. If it says something other than that in yours you should change the patch accordingly. I have also noticed, that rtmps only starts to work if you restart the red5 server and clear the cache of your browser at the same time. Sebastian has already underlined the main minus of this solution - rtmps does not work on Linux Flash player out of the box, but I have found some articles like this one - http://labs.adobe.com/wiki/index.php/Flash_Player:Additional_Interface_Support_for_Li nux#Source_code And they say, they can make flash player 9 to work with rtmps on linux, it should mean that there should be the same or similar way to enable it under flash payer 10. So I am currently looking in this direction, if we can enable rtmps in linux, we don't need to crypt the password on the client side anymore, therefore we don't have much problems with LDAP authentication using hashes. But, still, there is one more way, just in case - there are some articles on AD authentication in java, which suggest talking to AD seperately, to consider it as something different than just an LDAP server. Because, actually, AD being a decent stuff itself isn't so good as a LDAP server at all. So here are the links on the articles: http://weblogs.java.net/blog/kohsuke/archive/2008/01/active_director.html http://weblogs.java.net/blog/kohsuke/archive/2008/06/more_active_dir.html Attachments: enable_rtmps_8443.patch 625 bytes -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "OpenMeetings developers" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/openmeetings-dev?hl=en -~----------~----~----~----~------~----~------~--~---
