5 Dec
2006
5 Dec
'06
3:12 p.m.
Hi!
Reading openser's docs about qop, it looks like openser supports qop.
turning qop on with www_challenge("", "1") activates the qop
parameter:
WWW-Authenticate: Digest realm="foo.bar",
nonce="457553154ed7b9d93effa4118b4fe21f11b7f887", qop="auth".
Openser advertises only qop=auth. Looking at the source code I get the
impression that auth-int is supported too. How can this be activated?
regards
klaus
--
Klaus Darilion
nic.at
5 Dec
5 Dec
3:26 p.m.
Klaus Darilion wrote:
Hi!
Reading openser's docs about qop, it looks like openser supports qop.
turning qop on with www_challenge("", "1") activates the qop
parameter:
WWW-Authenticate: Digest realm="foo.bar",
nonce="457553154ed7b9d93effa4118b4fe21f11b7f887", qop="auth".
Openser advertises only qop=auth. Looking at the source code I get the
impression that auth-int is supported too. How can this be activated?
From Rfc 3261 how it looks like:
WWW-Authenticate: Digest
realm="biloxi.com",
qop="auth,auth-int",
nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
opaque="5ccc069c403ebaf9f0171e9517f40e41"
I guess it should be easy to add this to the auth module. I think it
will be useful to allow exact specification of the qop parameter with a
bitmask, e.g:
www_challenge("", "1"): qop="auth"
www_challenge("", "2"): qop="auth-int"
www_challenge("", "3"): qop="auth,auth-int"
Further, I think it can be useful to extend www_authorize (and the
radius functions) to return different return codes depending on the
authentication problem (e.g. cnonce counter problem, ....).
Further, does someone have any experience how clients handle qop=auth
and qop=auth-int?
regards
klaus
--
Klaus Darilion
nic.at
3:29 p.m.
One more :-)
It moght be useful to force qop during authentication - e.g. reject
clients which do not support qop as it enables replay attacks.
I think this breaks compatibility with rfc2543 clients, but IMO it would
be good if this can be configured.
regards
klaus
Klaus Darilion wrote:
Klaus Darilion wrote:
--
Klaus Darilion
nic.at
Hi!
Reading openser's docs about qop, it looks like openser supports qop.
turning qop on with www_challenge("", "1") activates the qop
parameter:
WWW-Authenticate: Digest realm="foo.bar",
nonce="457553154ed7b9d93effa4118b4fe21f11b7f887", qop="auth".
Openser advertises only qop=auth. Looking at the source code I get the
impression that auth-int is supported too. How can this be activated?
From Rfc 3261 how it looks like:
WWW-Authenticate: Digest
realm="biloxi.com",
qop="auth,auth-int",
nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
opaque="5ccc069c403ebaf9f0171e9517f40e41"
I guess it should be easy to add this to the auth module. I think it
will be useful to allow exact specification of the qop parameter with a
bitmask, e.g:
www_challenge("", "1"): qop="auth"
www_challenge("", "2"): qop="auth-int"
www_challenge("", "3"): qop="auth,auth-int"
Further, I think it can be useful to extend www_authorize (and the
radius functions) to return different return codes depending on the
authentication problem (e.g. cnonce counter problem, ....).
Further, does someone have any experience how clients handle qop=auth
and qop=auth-int?
regards
klaus
6562
days inactive
6562
days old
2 comments
1 participants
participants (1)
-
Klaus Darilion