<div><span class="gmail_quote">On 10/23/07, <b class="gmail_sendername">Dave Cridland</b> <<a href="mailto:dave@cridland.net">dave@cridland.net</a>> wrote:</span><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
On Tue Oct 23 08:25:59 2007, Jacob Wright wrote:<br>> I'm working on the DIGEST-MD5 SASL authentication and feel like I'm<br>> doing it<br>> perfectly, but my server is telling me I've got an incorrect auth
<br>> for the<br>> right username and password.<br><br>Now you know one of the reasons that the IETF is deprecating it. :-/</blockquote><div><br class="webkit-block-placeholder"></div><div>Deprecating it! After all this work I've done!? ;) What is going to be the preferred method in the future?
</div><br><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">> var dataStr:String = bytes.readUTFBytes(bytes.bytesAvailable);<br><br>Hmmm... DIGEST-MD5 isn't UTF-8, by default. (It's iso-8859-1, I
<br>think, due to HTTP-isms in it). This will probably work, though.<br><br><br><br>> // transcode the string into an object<br>><br>> var data:Object = stringToObject(dataStr);<br>><br>><br>What does this actually do?
</blockquote><div><br class="webkit-block-placeholder"></div><div>This takes the comma-delim string and creates a hash object out of it. </div><div><br class="webkit-block-placeholder"></div><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
> if (data.algorithm)<br>><br>> obj.algorithm = data.algorithm;<br>><br>><br>It doesn't seem very likely that you want to be messing with<br>algorithm. It's not present in RFC2831, after all, and has no effect
<br>unless you're doing something other than qop=auth.</blockquote><div><br class="webkit-block-placeholder"></div><div>Ok. </div><br><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
> <a href="http://obj.nc">obj.nc</a> = "00000001";<br>><br>> if (data.qop)<br>><br>> obj.qop = "auth";<br>><br>><br>qop absent, or qop=auth, are the same thing. You don't need to be
<br>conditional on whether the remote end gives you a choice. (Unless<br>you're trying to do auth-int).</blockquote><div><br class="webkit-block-placeholder"></div><div>Good to know. </div><br><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
> obj.cnonce = conn.generateId();<br>><br>><br>This isn't secure enough, but it should still work, of course.</blockquote><div><br class="webkit-block-placeholder"></div><div>Again, good to know. </div><br><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">
> var a1:String, a2:String;<br>><br>><br>> a1 = MD5.hash(obj.username + ":" + obj.realm + ":" + password) +<br>> ":" +<br>> obj.nonce + ":" + obj.cnonce;<br>><br>
><br>Ooops - does MD5.hash() return a hex digest or a binary one? You want<br>a binary digest here.</blockquote><div><br class="webkit-block-placeholder"></div><div>AH! That was it! You are the best! I've spent hours on this. Thank you for your help, seriously.
</div><div><br class="webkit-block-placeholder"></div><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">> var resultStr:String = objectToString(obj);<br>>
<br>><br>And again, what is this doing? Bear in mind that if it's some<br>convenient built-in that produces output that's similar to<br>DIGEST-MD5's syntax, this may not be quite right.</blockquote><div><br class="webkit-block-placeholder">
</div><div>It is a convenience method. It takes the object I've been putting together and creates a key="value",key2="value2" string out of it. Is that bad to quote every value? I noticed in examples that several key-value pairs were not quoted (
e.g. charset, nc, etc.) but thought it didn't matter. </div><br><blockquote class="gmail_quote" style="margin:0;margin-left:0.8ex;border-left:1px #ccc solid;padding-left:1ex">Hope this gives you some pointers, anyway. I'm pretty sure it'll be
<br>down to the distinction between H() and HEX(H()).</blockquote><div><br class="webkit-block-placeholder"></div><div>You were right. Thank you thank you again. </div><div><br class="webkit-block-placeholder"></div><div>
Jacob Wright </div><br></div><br>