Re: [lemonade] SASL DIGEST MD5 issue

What Dovecot version is this? Is the password stored as DIGEST-MD5 hash or as plaintext? If as DIGEST-MD5, maybe it was generated wrong. If as plaintext, maybe Dovecot has a bug related to generating the DIGEST-MD5 hash, I remember there used to be some bug related to that. And in general the problem might be something completely different, Dovecot logs with auth_debug=yes could show something useful.

On 15.4.2014, at 18.56, Jayantheesh S B <j.sb@sta.samsung.com> wrote:

> Kindly clarify our query related to DIGEST MD5 implementation. We always getting Authentication failed with Dovecot server.
>  
> Same implementation is working fine with “Isode.com” server.  Please find the transaction snippet below. By decoding the base64 We see realm is empty.
>  
> As per RFC 2831, this directive is optional. Since, server is not sending the realm, client populates the realm as per the below quotes. Still dovecot server rejects it.
>  
> We are clue less and we are not sure why server is rejecting the request, kindly throw some light on this issue.
>  
> RFC 2831 Quotes:
>    realm
>       Mechanistically, a string which can enable users to know which
>       username and password to use, in case they might have different
>       ones for different servers. Conceptually, it is the name of a
>       collection of accounts that might include the user's account. This
>       string should contain at least the name of the host performing the
>       authentication and might additionally indicate the collection of
>       users who might have access. An example might be
>       "registered_users@gotham.news.example.com".  This directive is
>       optional; if not present, the client SHOULD solicit it from the
>       user or be able to compute a default; a plausible default might be
>       the realm supplied by the user when they logged in to the client
>       system. Multiple realm directives are allowed, in which case the
>       user or client must choose one as the realm for which to supply to
>       username and password
>  
>  
>  
> Transaction Snippet:
> 04-15 12:07:18.654 22363 22859 D Email   : <<< +OK Dovecot ready.
> 04-15 12:07:18.724 22363 22859 D Email   : >>> CAPA
> 04-15 12:07:19.034 22363 22859 D Email   : <<< +OK
> 04-15 12:07:19.084 22363 22859 D Email   : <<< CAPA
> 04-15 12:07:19.124 22363 22859 D Email   : <<< TOP
> 04-15 12:07:19.194 22363 22859 D Email   : <<< UIDL
> 04-15 12:07:19.234 22363 22859 D Email   : <<< RESP-CODES
> 04-15 12:07:19.334 22363 22859 D Email   : <<< PIPELINING
> 04-15 12:07:19.384 22363 22859 D Email   : <<< STLS
> 04-15 12:07:19.454 22363 22859 D Email   : <<< USER
> 04-15 12:07:19.514 22363 22859 D Email   : <<< SASL PLAIN LOGIN DIGEST-MD5
> 04-15 12:07:19.574 22363 22859 D Email   : <<< .
> 04-15 12:07:33.574 22363 22859 D Email   : >>> AUTH DIGEST-MD5
> 04-15 12:07:33.754 22363 22859 D Email   : <<< + cmVhbG09IiIsbm9uY2U9Ind1NjBDdWJqenBObEw4Uk9xUlhtUnc9PSIscW9wPSJhdXRoIixjaGFyc2V0PSJ1dGYtOCIsYWxnb3JpdGhtPSJtZDUtc2VzcyI=
>  
> 04-15 12:07:33.784 22363 22859 D Pop3Store: digestChallenge=cmVhbG09IiIsbm9uY2U9Ind1NjBDdWJqenBObEw4Uk9xUlhtUnc9PSIscW9wPSJhdXRoIixjaGFyc2V0PSJ1dGYtOCIsYWxnb3JpdGhtPSJtZDUtc2VzcyI=
> 04-15 12:07:33.844 22363 22859 D DigestAuth: generateDigestResponse
> 04-15 12:07:33.884 22363 22859 D DigestAuth: index=5 key=realm value=""
> 04-15 12:07:33.934 22363 22859 D DigestAuth: index=5 key=nonce value="wu60CubjzpNlL8ROqRXmRw=="
> 04-15 12:07:33.954 22363 22859 D DigestAuth: index=3 key=qop value="auth"
> 04-15 12:07:34.014 22363 22859 D DigestAuth: index=7 key=charset value="utf-8"
> 04-15 12:07:34.064 22363 22859 D DigestAuth: index=9 key=algorithm value="md5-sess"
> 04-15 12:07:34.094 22363 22859 E DigestAuth: realm=""
> 04-15 12:07:34.114 22363 22859 E DigestAuth: charset="utf-8"
> 04-15 12:07:34.154 22363 22859 E DigestAuth: qop="auth"
> 04-15 12:07:34.194 22363 22859 E DigestAuth: algorithm="md5-sess"
> 04-15 12:07:34.224 22363 22859 E DigestAuth: nonce="wu60CubjzpNlL8ROqRXmRw=="
>  
> 04-15 12:09:04.044 22363 22859 D Email   : >>> Y2hhcnNldD11dGYtOCx1c2VybmFtZT0iSmVucy5qZW5zZW5AZW1haWwuZGsiLHJlYWxtPSJtYWlsLnRlbGVub3IuZGsiLG5vbmNlPSJ3dTYwQ3VianpwTmxMOFJPcVJYbVJ3PT0iLG5jPTAwMDAwMDAxLGNub25jZT0iMzQzNTU3NTU2NzI2ODYzNzAzMyIsZGlnZXN0LXVyaT0icG9wL21haWwudGVsZW5vci5kayIscmVzcG9uc2U9NzU0NDMwN2VmMDQyNzE3MTNhZDUzN2FlMWQxZDRjMGMscW9wPWF1dGg=
> 04-15 12:09:05.744 22363 22859 D Email   : <<< -ERR Authentication failed.
> 04-15 12:09:21.594 22363 22859 D Email   : >>> QUIT
> 04-15 12:09:21.924 22363 22859 D Email   : <<< +OK Logging out.
>  
> Regards,
> Jay
> _______________________________________________
> lemonade mailing list
> lemonade@ietf.org
> https://www.ietf.org/mailman/listinfo/lemonade
> Supplemental Web Site:
> http://www.standardstrack.com/ietf/lemonade