Re: [lemonade] SASL DIGEST MD5 issue

Hi Timo,

Thanks for your response.

We are not sure about the Devcot POP Server version, One of customer has reported this issue from the market.

Customer is having account with  email.dk (mail.telenar.uk) which uses Devcot POP server.  So, we do not have the control over POP server.

Please find the response sent by the client and its decoded version.
Y2hhcnNldD11dGYtOCx1c2VybmFtZT0iSmVucy5qZW5zZW5AZW1haWwuZGsiLHJlYWxtPSJtYWlsLnRlbGVub3IuZGsiLG5vbmNlPSJ3dTYwQ3VianpwTmxMOFJPcVJYbVJ3PT0iLG5jPTAwMDAwMDAxLGNub25jZT0iMzQzNTU3NTU2NzI2ODYzNzAzMyIsZGlnZXN0LXVyaT0icG9wL21haWwudGVsZW5vci5kayIscmVzcG9uc2U9NzU0NDMwN2VmMDQyNzE3MTNhZDUzN2FlMWQxZDRjMGMscW9wPWF1dGg=

charset=utf-8,username="Jens.jensen@email.dk",realm="mail.telenor.dk",nonce="wu60CubjzpNlL8ROqRXmRw==",nc=00000001,cnonce="3435575567268637033",digest-uri="pop/mail.telenor.dk",response=7544307ef04271713ad537ae1d1d4c0c,qop=auth

Regards,
Jay
From: Timo Sirainen [mailto:tss@iki.fi]
Sent: Wednesday, April 16, 2014 1:22 PM
To: Jayantheesh S B
Cc: lemonade@ietf.org
Subject: Re: [lemonade] SASL DIGEST MD5 issue

What Dovecot version is this? Is the password stored as DIGEST-MD5 hash or as plaintext? If as DIGEST-MD5, maybe it was generated wrong. If as plaintext, maybe Dovecot has a bug related to generating the DIGEST-MD5 hash, I remember there used to be some bug related to that. And in general the problem might be something completely different, Dovecot logs with auth_debug=yes could show something useful.

On 15.4.2014, at 18.56, Jayantheesh S B <j.sb@sta.samsung.com<mailto:j.sb@sta.samsung.com>> wrote:

Kindly clarify our query related to DIGEST MD5 implementation. We always getting Authentication failed with Dovecot server.

Same implementation is working fine with "Isode.com<http://isode.com/>" server.  Please find the transaction snippet below. By decoding the base64 We see realm is empty.

As per RFC 2831, this directive is optional. Since, server is not sending the realm, client populates the realm as per the below quotes. Still dovecot server rejects it.

We are clue less and we are not sure why server is rejecting the request, kindly throw some light on this issue.

RFC 2831 Quotes:
   realm
      Mechanistically, a string which can enable users to know which
      username and password to use, in case they might have different
      ones for different servers. Conceptually, it is the name of a
      collection of accounts that might include the user's account. This
      string should contain at least the name of the host performing the
      authentication and might additionally indicate the collection of
      users who might have access. An example might be
      "registered_users@gotham.news.example.com<mailto:registered_users@gotham.news.example.com>".  This directive is
      optional; if not present, the client SHOULD solicit it from the
      user or be able to compute a default; a plausible default might be
      the realm supplied by the user when they logged in to the client
      system. Multiple realm directives are allowed, in which case the
      user or client must choose one as the realm for which to supply to
      username and password

Transaction Snippet:
04-15 12:07:18.654 22363 22859 D Email   : <<< +OK Dovecot ready.
04-15 12:07:18.724 22363 22859 D Email   : >>> CAPA
04-15 12:07:19.034 22363 22859 D Email   : <<< +OK
04-15 12:07:19.084 22363 22859 D Email   : <<< CAPA
04-15 12:07:19.124 22363 22859 D Email   : <<< TOP
04-15 12:07:19.194 22363 22859 D Email   : <<< UIDL
04-15 12:07:19.234 22363 22859 D Email   : <<< RESP-CODES
04-15 12:07:19.334 22363 22859 D Email   : <<< PIPELINING
04-15 12:07:19.384 22363 22859 D Email   : <<< STLS
04-15 12:07:19.454 22363 22859 D Email   : <<< USER
04-15 12:07:19.514 22363 22859 D Email   : <<< SASL PLAIN LOGIN DIGEST-MD5
04-15 12:07:19.574 22363 22859 D Email   : <<< .
04-15 12:07:33.574 22363 22859 D Email   : >>> AUTH DIGEST-MD5
04-15 12:07:33.754 22363 22859 D Email   : <<< + cmVhbG09IiIsbm9uY2U9Ind1NjBDdWJqenBObEw4Uk9xUlhtUnc9PSIscW9wPSJhdXRoIixjaGFyc2V0PSJ1dGYtOCIsYWxnb3JpdGhtPSJtZDUtc2VzcyI=

04-15 12:07:33.784 22363 22859 D Pop3Store: digestChallenge=cmVhbG09IiIsbm9uY2U9Ind1NjBDdWJqenBObEw4Uk9xUlhtUnc9PSIscW9wPSJhdXRoIixjaGFyc2V0PSJ1dGYtOCIsYWxnb3JpdGhtPSJtZDUtc2VzcyI=
04-15 12:07:33.844 22363 22859 D DigestAuth: generateDigestResponse
04-15 12:07:33.884 22363 22859 D DigestAuth: index=5 key=realm value=""
04-15 12:07:33.934 22363 22859 D DigestAuth: index=5 key=nonce value="wu60CubjzpNlL8ROqRXmRw=="
04-15 12:07:33.954 22363 22859 D DigestAuth: index=3 key=qop value="auth"
04-15 12:07:34.014 22363 22859 D DigestAuth: index=7 key=charset value="utf-8"
04-15 12:07:34.064 22363 22859 D DigestAuth: index=9 key=algorithm value="md5-sess"
04-15 12:07:34.094 22363 22859 E DigestAuth: realm=""
04-15 12:07:34.114 22363 22859 E DigestAuth: charset="utf-8"
04-15 12:07:34.154 22363 22859 E DigestAuth: qop="auth"
04-15 12:07:34.194 22363 22859 E DigestAuth: algorithm="md5-sess"
04-15 12:07:34.224 22363 22859 E DigestAuth: nonce="wu60CubjzpNlL8ROqRXmRw=="

04-15 12:09:04.044 22363 22859 D Email   : >>> Y2hhcnNldD11dGYtOCx1c2VybmFtZT0iSmVucy5qZW5zZW5AZW1haWwuZGsiLHJlYWxtPSJtYWlsLnRlbGVub3IuZGsiLG5vbmNlPSJ3dTYwQ3VianpwTmxMOFJPcVJYbVJ3PT0iLG5jPTAwMDAwMDAxLGNub25jZT0iMzQzNTU3NTU2NzI2ODYzNzAzMyIsZGlnZXN0LXVyaT0icG9wL21haWwudGVsZW5vci5kayIscmVzcG9uc2U9NzU0NDMwN2VmMDQyNzE3MTNhZDUzN2FlMWQxZDRjMGMscW9wPWF1dGg=
04-15 12:09:05.744 22363 22859 D Email   : <<< -ERR Authentication failed.
04-15 12:09:21.594 22363 22859 D Email   : >>> QUIT
04-15 12:09:21.924 22363 22859 D Email   : <<< +OK Logging out.

Regards,
Jay
_______________________________________________
lemonade mailing list
lemonade@ietf.org<mailto:lemonade@ietf.org>
https://www.ietf.org/mailman/listinfo/lemonade
Supplemental Web Site:
http://www.standardstrack.com/ietf/lemonade