[jdev] SASL debugging

[Matthias Wimmer]

Hi Yves!

Yves Goergen schrieb:

>>Yes, there are many characters above U+0100, that are allowed in 
>>usernames. What is allowed is defined by a stringprep profile called 
>>"nodeprep".
>>Same for the passwords, but using the SASLprep profile.
>>    
>>
>Umm... I followed that word and its references but stopped reading all
>of them because after a few lines each I realised I didn't understand a
>word. So I guess I simply assume full Unicode support... The relevant
>parts of the used protocols are UTF-8-encoded, so it should work fine
>anyway.
>  
>

I would not recommend this. If you do not want to implement stringprep 
yourself, than have a look for a library implementing stringprep on the 
platform you are using. (Typically you better find them, if you are 
looking for IDN, which used stringprep with the nameprep profile as well.)

As I wrote in my last mail, stringprep is more than just telling you 
which characters are allowed. It also maps some characters to other 
characters. If you get multiple messages, presences, or stanzas from the 
server, your client cannot know if they are from the same entity, if it 
does not stringprep the JID before comparing.
While you might not notice this when using your client against our 
present servers (that do pass JIDs in normalized form, but that is no 
requirement for the servers), you already might get into real problems, 
if you do not normalize passwords using the SASLprep profile. Consider 
the client user has a password containing the character “ℹ”. SASLprep 
normalizes this to “i”. So if you are using DIGEST-MD5 as the SASL 
mechanism, you have to calculate a hash of the password. This hash will 
be completely different, when you (incorrectly) calculate it for the 
password still containing “ℹ” instead of “i”. You will not be able to 
authenticate using this incorrect hash value.


Tot kijk
      Matthias