how funny. I think that BW runs internally opensips :-)
Bogdan surely knows.
On 25/09/2020 16:13, Jeff Pyle wrote:
Johan,
I will definitely try that. Thank you!
Ben,
The problem is I have multiple destinations with the same realm. In
my case, several different Broadworks app servers. I haven't checked
them exhaustively but I think they all reply with realm="BroadWorks"
in their authentication headers. I've got some Asterisk boxes in
here, and I think they're all the domain of the SIP request URI in the
case of an INVITE. I think I'll have to choose ahead of time which
credentials go with which route, no? Unless I'm still not wrapping my
head around how this is supposed to work.
- Jeff
On Fri, Sep 25, 2020 at 9:22 AM Ben Newlin <[email protected]
<mailto:[email protected]>> wrote:
Jeff,
My point was that the uac_auth() is supposed to handle the realm
matching for you. If you simply load all of the auth data based on
the call target as you already plan to do, uac_auth() should look
through that data for you to find credentials with a matching
realm. You don’t need to do that part yourself in the script.
Ben Newlin
*From: *Users <[email protected]
<mailto:[email protected]>>
*Date: *Thursday, September 24, 2020 at 11:14 PM
*To: *OpenSIPS users mailling list <[email protected]
<mailto:[email protected]>>
*Subject: *Re: [OpenSIPS-Users] learning the realm from
authentication challenges
Good catch on Proxy-Authorization vs Proxy-Authenticate. I think
I've been looking at this too long. I checked the module and
that's exactly what it is.
My hope was to load the uac_auth user/pass AVPs ahead of time from
a DB based on where I knew I was sending the call, load the realm
one in the failure route based on what comes back in the header,
and then fire the uac_auth() function. It looks like I may have to
manually extract the realm from whichever header comes in. Not
ideal, but probably workable.
- Jeff
On Thu, Sep 24, 2020 at 9:58 PM Ben Newlin <[email protected]
<mailto:[email protected]>> wrote:
This does not appear to be documented, but I believe
uac_auth() looks through the AVPs configured in the UAC_AUTH
module and uses the first one whose realm matches the
challenge realm. So in order to authenticate any challenge,
you must load all of the possible credentials into those AVPs.
Ben Newlin
*From: *Users <[email protected]
<mailto:[email protected]>>
*Date: *Thursday, September 24, 2020 at 9:53 PM
*To: *OpenSIPS users mailling list <[email protected]
<mailto:[email protected]>>
*Subject: *Re: [OpenSIPS-Users] learning the realm from
authentication challenges
According to the docs, $ar provides the realm from the
“Authorization” or “Proxy-Authorization” headers. Not from the
”Proxy-Authenticate” header, which is what you have.
https://www.opensips.org/Documentation/Script-CoreVar-3-1#toc6
Ben Newlin
*From: *Users <[email protected]
<mailto:[email protected]>>
*Date: *Thursday, September 24, 2020 at 9:31 PM
*To: *OpenSIPS users mailling list <[email protected]
<mailto:[email protected]>>
*Subject: *[OpenSIPS-Users] learning the realm from
authentication challenges
I'm trying to recover the realm of an auth challenge to
OpenSIPS so I can respond to it with the uac_auth() function,
and that requires knowing the realm. The docs say that $ar
<https://www.opensips.org/Documentation/Script-CoreVar-3-1#toc6>
should provide that, perhaps written like $(<reply>ar) to get
it in the right context. I'm having some trouble getting the
data.
failure_route[relay_failure] {
...
if (t_check_status("407")) {
xlog("L_NOTICE", "[1] Proxy-Authenticate:
$(<reply>hdr(Proxy-Authenticate))\n");
xlog("L_NOTICE", "[2] Auth Realm:
$(<reply>ar)\n");
xlog("L_NOTICE", "[3] Auth Realm: $ar\n");
}
...
}
The logs show:
/usr/sbin/opensips[33044]: [1] Proxy-Authenticate: Digest
realm="asterisk",
nonce="5f6d42140000936ad820dbcd452e6bcd145777e458dd46dd",
qop="auth"
/usr/sbin/opensips[33044]: [2] Auth Realm reply: <null>
/usr/sbin/opensips[33044]: [3] Auth Realm: <null>
Is it possible to get the realm? Is it possible to build a
response with uac_auth() for an arbitrary authentication
challenge?
This is on 3.1.0~20200923~88f89e941.
- Jeff
_______________________________________________
Users mailing list
[email protected] <mailto:[email protected]>
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
_______________________________________________
Users mailing list
[email protected] <mailto:[email protected]>
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
_______________________________________________
Users mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
_______________________________________________
Users mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
