How to federate openfire with cisco IM&P (imp)

Openfire
1

i found a few questions in the past here about using the cisco Jabber client to log on to openfire. my question is about connecting/federating Openfire with Cisco Instant Messaging & Presence server which is, from what i understand, a proprietary implementation of XMPP, so in theory it should work.

The issue is that if I use Spark or Pidgin, I can send a message but a reply gets rejected. The message inside the Jabber client is : Message to openfireJID cannot be delivered.

it’s a Microsoft Windows environment and the Windows domain is win.maindom.com

When Cisco IMP was installed, they “integrated” with Microsoft Active Directory so their XMPP domain is the same, win.maindom.com

Openfire was installed in this environment and the XMPP domain is sub2.sub1.win.maindom.com

The SRV records for both XMPP domains exist, i.e. _xmpp-server._tcp.etceterra

When I use “S2S Connection Test” from within the Openfire console, the connection appears to establish OK, these are the last 4 lines in the log.

Creating new session with stream ID ‘stream-id’ for local 'sub2.sub1.win.maindom.com to peer 'win.maindom.com’

Unexpected packet tag (not message,iq,presence). Closing session: LocalIncomingServerSession{address=sub2.sub1.win.maindom.com/<longGUID>, streamID=stream-id, status=CONNECTED, isEncrypted=true, isDetached=false, authenticationMethod=null, localDomain=sub2.sub1.win.maindom.com, defaultIdentity=win.maindom.com, validatedDomains={}}

Session is AUTHENTICATED.

Successfully negotiated TLS connection.

Thank you all!

2

I have no experience with Cisco’s products. I once heard through the grapevine that some of their projects are/were based on Openfire, but that’s hear-say. I’d actually love getting in touch with them, to see if there’s interest in getting XMPP interop happen.

The error message that you’re sharing suggests that their server (sub2.sub1.win.maindom.com) is sending data to Openfire that is not valid XMPP - which then gets rejected b Openfire. This appears to happen before authentication has finished.

Without seeing an actual dump of the traffic, this is mostly guessing, but my first thought is that in Cisco’s product, there’s some non-standard / proprietary data that doesn’t conform with the XMPP standard, or at least Openfire’s implementation of those.

3

Thank you!

the Openfire domain is the one that starts with sub2. I specifically entered both domains because I was curious if someone might say ( however unlikely ), “you can’t have your Openfire domain as a subdomain of the Cisco/Active Directory domain”

So, the log says “unexpected packet tag”. Any chance I can see what Openfire received that was so unexpected? I tried “trace logging” but didn’t get much. Will Wireshark help? I know i need to disable TLS on both sides before I can try this

Thanks

4

You could try with the XML Debugger plugin for Openfire, but a packet dump (unencrypted) may be your best bet.

5

for anyone who might be exploring this (however unlikely), we went through a number of scenarios incl. no TLS at all but in the end, what worked was set the Cisco device as follows:

Security Mode: TLS Required

Enable SASL EXTERNAL on all incoming connections: checked

Enable SASL EXTERNAL on all outgoing connections: unchecked

On the Openfire side, STARTTLS Policy (port 5269) should be set to Optional.

This way, the Incoming connection (from Openfire’s perspective) is “dialback-authenticated” and the Outgoing one is “SASL External”.

if we set “STARTTLS Policy” to Required and the second SASL option on the Cisco side to Checked produces the result I described in the first post. But, overall, that should be the desired configuration and we will keep trying to figure it out.