SASLAuthentication Problems: Nonexistent realm?

anthony4 · March 17, 2007, 8:17pm

I’'m running 3.2.2, can connect fine from spark localhost, but when I try to connect my CF event gateway it wont connect. The debug log says this (below) any idea where to start?

2007.03.17 14:11:32 SaslException

javax.security.sasl.SaslException: DIGEST-MD5: digest response format violation. Nonexistent realm:

at com.sun.security.sasl.digest.DigestMD5Server.validateClientResponse(Unknown Source)

at com.sun.security.sasl.digest.DigestMD5Server.evaluateResponse(Unknown Source)

at org.jivesoftware.wildfire.net.SASLAuthentication.handle(SASLAuthentication.java :312)

at org.jivesoftware.wildfire.net.StanzaHandler.process(StanzaHandler.java:138)

at org.jivesoftware.wildfire.nio.ConnectionHandler.messageReceived(ConnectionHandl er.java:131)

at org.apache.mina.common.support.AbstractIoFilterChain$TailFilter.messageReceived (AbstractIoFilterChain.java:703)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.codec.support.SimpleProtocolDecoderOutput.flush(SimplePr otocolDecoderOutput.java:62)

at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecF ilter.java:192)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.executor.ExecutorFilter.processEvent(ExecutorFilter.java :250)

at org.apache.mina.filter.executor.ExecutorFilter$ProcessEventsRunnable.run(Execut orFilter.java:305)

at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

at java.lang.Thread.run(Unknown Source)

anthony4 · March 18, 2007, 7:49am

Looks as if CF event gateways worked at some point with and older version of Jive Messenger. Here is the link: http://www.adobe.com/devnet/coldfusion/articles/imgateway_03.html

Gaston_Dombiak · March 22, 2007, 6:06pm

Hey Anthony,

Which client are you using? It seems that your client sent an empty realm in the response to the SASL challenge. Below you will see the relevant code used by Java 6 when validating DIGEST-MD5 response:

/* realm: exactly once if sent by server */
     negotiatedRealm = ((responseVal[REALM] != null) ?
         new String(responseVal[REALM], encoding) : "");
     logger.log(Level.FINE, "DIGEST83:Client negotiated realm: {0}",          negotiatedRealm);      if (!serverRealms.contains(negotiatedRealm)) {
         // Server had sent at least one realm
         // Check that response is one of these
         throw new SaslException("DIGEST-MD5: digest response format " +
          "violation. Nonexistent realm: " + negotiatedRealm);
     }

I’‘ve been trying to enable the log in Java 6 to print supported realms and also see realm sent by client during the challenge (although we know that it is an empty string or null value) but couldn’'t find a way to enable it.

Regards,

– Gato

Message was edited by: dombiak_gaston

anthony4 · March 22, 2007, 7:14pm

Thanks for the reply Gato. We are trying to log in using coldfusion event gateways. (see link above)

One note about this issue which has be baffled is that I can log into the openfire server using the spark client localhost no problem. Connecting using CF localhost gives the SASL authentication error. BUT I can log on using CF if I am logging in using a CF server that is outside the LAN.

If this is an issue with CF I can maybe get someone over at adobe to look into this, of course the more verbose the info the better. But I am just puzzled that it would working using CF from outside the network, but inside it doesnt.

Can you maybe explain the process of “sending realms”, I’'m not even sure what realms even are.

Thanks,

Anthony

Gaston_Dombiak · March 22, 2007, 7:24pm

Hey Anthony,

My current understanding of this situation is that this is a CF problem. DIGEST-MD5 requires the client to present certain data to the sever so the server can authenticate the identity of the client. During this process the server will issue a challenge to the client and the client should reply with a response. Below you will find a copy of the format of the response:

digest-response  = 1#( username | realm | nonce | cnonce |
                          nonce-count | qop | digest-uri | response |
                          maxbuf | charset | cipher | authzid |
                          auth-param )        username         = "username" "=" <"> username-value <">
       username-value   = qdstr-val
       cnonce           = "cnonce" "=" <"> cnonce-value <">
       cnonce-value     = qdstr-val
       nonce-count      = "nc" "=" nc-value
       nc-value         = 8LHEX
       qop              = "qop" "=" qop-value
       digest-uri       = "digest-uri" "=" <"> digest-uri-value <">
       digest-uri-value  = serv-type "/" host [ "/" serv-name ]
       serv-type        = 1*ALPHA
       host             = 1*( ALPHA | DIGIT | "-" | "." )
       serv-name        = host
       response         = "response" "=" response-value
       response-value   = 32LHEX
       LHEX             = "0" | "1" | "2" | "3" |
                          "4" | "5" | "6" | "7" |
                          "8" | "9" | "a" | "b" |
                          "c" | "d" | "e" | "f"
       cipher           = "cipher" "=" cipher-value
       authzid          = "authzid" "=" <"> authzid-value <">
       authzid-value    = qdstr-val    username
      The user''s name in the specified realm, encoded according to the
      value of the "charset" directive. This directive is required and
      MUST be present exactly once; otherwise, authentication fails.    realm
      The realm containing the user''s account. This directive is
      required if the server provided any realms in the
      "digest-challenge", in which case it may appear exactly once and
      its value SHOULD be one of those realms. If the directive is
      missing, "realm-value" will set to the empty string when computing
      A1 (see below for details).

This text was copied from the DIGEST-MD5 spec. I think that having someone from CF that could help you see what is being included in the challenge from the server and the response made by CF would be the way to go. I tried to get that info from Openfire but failed to instruct Java to print that info.

Regards,

– Gato

anthony4 · March 22, 2007, 11:12pm

Thanks gato, I have a request in at adobe to look at this issue. In the meantime are you aware of any way to watch that traffic as it happens to see the requests and responses as they happen? The CF server and OpenFire install are on the same box. I’'m just curious what exactly CF is returning.

Gaston_Dombiak · March 22, 2007, 11:18pm

Hey Anthony,

Sniffing traffic won’‘t be that easy since content will be encrypted. Easiest thing would be to either see DIGEST-MD5 traffic in Openfire or in CF. SASL logic is done by Java on our end so in order to see what Java is receiving and sending we would need to enable the log. I tried to do it today but couldn’'t find the correct setting to use. If CF devs can help you get that info then we should be fine. Otherwise, we can continue the hunt for the proper setting to use in Openfire to enable the log.

Regards,

– Gato

anthony4 · March 26, 2007, 10:33pm

Gato,

You are my last hope man. Not having much luck from the CF front. Hopefully you can find that setting with will log what this volley looks like so we can know for once and for all who is to blame.

Any help you have would be perfect.

-Anthony

Gaston_Dombiak · March 27, 2007, 5:42pm

Hey Anthony,

No worries. I will later try to find a way to enable the log of Java so we can print that info. Anyway, I’'m almost sure it will print the info we already mentioned (ie. no realm included in DIGEST-MD5 response) and if that is the case you will end up contacting CF devs again so they can study why response does not include that piece of info.

Regards,

– Gato

Duncan_Loxton · May 27, 2007, 10:49pm

I have been following this thread with Adobe too, and I have managed to get the following from the debug output in openFire 3.3.1 whilst trying to connect with ColdFusion.

2007.05.25 14:47:37 SaslException

javax.security.sasl.SaslException: DIGEST-MD5: digest response format violation. Nonexistent realm:

at com.sun.security.sasl.digest.DigestMD5Server.validateClientResponse(Unknown Source)

at com.sun.security.sasl.digest.DigestMD5Server.evaluateResponse(Unknown Source)

at org.jivesoftware.openfire.net.SASLAuthentication.handle(SASLAuthentication.java :281)

at org.jivesoftware.openfire.net.StanzaHandler.process(StanzaHandler.java:144)

at org.jivesoftware.openfire.nio.ConnectionHandler.messageReceived(ConnectionHandl er.java:132)

at org.apache.mina.common.support.AbstractIoFilterChain$TailFilter.messageReceived (AbstractIoFilterChain.java:703)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.codec.support.SimpleProtocolDecoderOutput.flush(SimplePr otocolDecoderOutput.java:62)

at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecF ilter.java:200)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.executor.ExecutorFilter.processEvent(ExecutorFilter.java :266)

at org.apache.mina.filter.executor.ExecutorFilter$ProcessEventsRunnable.run(Execut orFilter.java:326)

at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

at java.lang.Thread.run(Unknown Source)

Duncan_Loxton · June 1, 2007, 1:00am

I have upgraded to the release Candidate of ColdFusion 8 on labs.adobe.com and I now get the following errors:

I still get a SASL error from the OpenFire server:

2007.05.30 11:37:53 SaslException