view release on metacpan or  search on metacpan

doc/rfc3920-notes.txt  view on Meta::CPAN

      reply to a <response/> element or an <auth/> element with initial
      response data.

   o  <temporary-auth-failure/> -- The authentication failed because of
      a temporary error condition within the receiving entity; sent in
      reply to an <auth/> element or <response/> element.

6.5.  Client-to-Server Example

   The following example shows the data flow for a client authenticating
   with a server using SASL, normally after successful TLS negotiation
   (note: the alternate steps shown below are provided to illustrate the
   protocol for failure cases; they are not exhaustive and would not
   necessarily be triggered by the data sent in the example).

   Step 1: Client initiates stream to server:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 2: Server responds with a stream tag sent to client:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       id='c2s_234'
       from='example.com'
       version='1.0'>

   Step 3: Server informs client of available authentication mechanisms:

   <stream:features>
     <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
       <mechanism>DIGEST-MD5</mechanism>
       <mechanism>PLAIN</mechanism>
     </mechanisms>
   </stream:features>



Saint-Andre, Ed.            Standards Track                    [Page 32]

RFC 3920                       XMPP Core                    October 2004


   Step 4: Client selects an authentication mechanism:

   <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl'
         mechanism='DIGEST-MD5'/>

   Step 5: Server sends a [BASE64] encoded challenge to client:

   <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   cmVhbG09InNvbWVyZWFsbSIsbm9uY2U9Ik9BNk1HOXRFUUdtMmhoIixxb3A9ImF1dGgi
   LGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNzCg==
   </challenge>

   The decoded challenge is:

   realm="somerealm",nonce="OA6MG9tEQGm2hh",\
   qop="auth",charset=utf-8,algorithm=md5-sess

   Step 5 (alt): Server returns error to client:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <incorrect-encoding/>
   </failure>
   </stream:stream>

   Step 6: Client sends a [BASE64] encoded response to the challenge:

   <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   dXNlcm5hbWU9InNvbWVub2RlIixyZWFsbT0ic29tZXJlYWxtIixub25jZT0i
   T0E2TUc5dEVRR20yaGgiLGNub25jZT0iT0E2TUhYaDZWcVRyUmsiLG5jPTAw
   MDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InhtcHAvZXhhbXBsZS5jb20i
   LHJlc3BvbnNlPWQzODhkYWQ5MGQ0YmJkNzYwYTE1MjMyMWYyMTQzYWY3LGNo
   YXJzZXQ9dXRmLTgK
   </response>

   The decoded response is:

   username="somenode",realm="somerealm",\
   nonce="OA6MG9tEQGm2hh",cnonce="OA6MHXh6VqTrRk",\
   nc=00000001,qop=auth,digest-uri="xmpp/example.com",\
   response=d388dad90d4bbd760a152321f2143af7,charset=utf-8

   Step 7: Server sends another [BASE64] encoded challenge to client:

   <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   cnNwYXV0aD1lYTQwZjYwMzM1YzQyN2I1NTI3Yjg0ZGJhYmNkZmZmZAo=
   </challenge>





Saint-Andre, Ed.            Standards Track                    [Page 33]

RFC 3920                       XMPP Core                    October 2004


   The decoded challenge is:

   rspauth=ea40f60335c427b5527b84dbabcdfffd

   Step 7 (alt): Server returns error to client:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <temporary-auth-failure/>
   </failure>
   </stream:stream>

   Step 8: Client responds to the challenge:

   <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

   Step 9: Server informs client of successful authentication:

   <success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

   Step 9 (alt): Server informs client of failed authentication:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <temporary-auth-failure/>
   </failure>
   </stream:stream>

   Step 10: Client initiates a new stream to server:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 11: Server responds by sending a stream header to client along
   with any additional features (or an empty features element):

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       id='c2s_345'
       from='example.com'
       version='1.0'>
   <stream:features>
     <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/>
     <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/>
   </stream:features>




Saint-Andre, Ed.            Standards Track                    [Page 34]

RFC 3920                       XMPP Core                    October 2004


6.6.  Server-to-Server Example

   The following example shows the data flow for a server authenticating
   with another server using SASL, normally after successful TLS
   negotiation (note: the alternate steps shown below are provided to
   illustrate the protocol for failure cases; they are not exhaustive
   and would not necessarily be triggered by the data sent in the
   example).

   Step 1: Server1 initiates stream to Server2:

   <stream:stream
       xmlns='jabber:server'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 2: Server2 responds with a stream tag sent to Server1:

   <stream:stream
       xmlns='jabber:server'
       xmlns:stream='http://etherx.jabber.org/streams'
       from='example.com'
       id='s2s_234'
       version='1.0'>

   Step 3: Server2 informs Server1 of available authentication
   mechanisms:

   <stream:features>
     <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
       <mechanism>DIGEST-MD5</mechanism>
       <mechanism>KERBEROS_V4</mechanism>
     </mechanisms>
   </stream:features>

   Step 4: Server1 selects an authentication mechanism:

   <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl'
         mechanism='DIGEST-MD5'/>

   Step 5: Server2 sends a [BASE64] encoded challenge to Server1:

   <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   cmVhbG09InNvbWVyZWFsbSIsbm9uY2U9Ik9BNk1HOXRFUUdtMmhoIixxb3A9
   ImF1dGgiLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNz
   </challenge>




Saint-Andre, Ed.            Standards Track                    [Page 35]

RFC 3920                       XMPP Core                    October 2004


   The decoded challenge is:

   realm="somerealm",nonce="OA6MG9tEQGm2hh",\
   qop="auth",charset=utf-8,algorithm=md5-sess

   Step 5 (alt): Server2 returns error to Server1:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <incorrect-encoding/>
   </failure>
   </stream:stream>

   Step 6: Server1 sends a [BASE64] encoded response to the challenge:

   <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   dXNlcm5hbWU9ImV4YW1wbGUub3JnIixyZWFsbT0ic29tZXJlYWxtIixub25j
   ZT0iT0E2TUc5dEVRR20yaGgiLGNub25jZT0iT0E2TUhYaDZWcVRyUmsiLG5j
   PTAwMDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InhtcHAvZXhhbXBsZS5v
   cmciLHJlc3BvbnNlPWQzODhkYWQ5MGQ0YmJkNzYwYTE1MjMyMWYyMTQzYWY3
   LGNoYXJzZXQ9dXRmLTgK
   </response>

   The decoded response is:

   username="example.org",realm="somerealm",\
   nonce="OA6MG9tEQGm2hh",cnonce="OA6MHXh6VqTrRk",\
   nc=00000001,qop=auth,digest-uri="xmpp/example.org",\
   response=d388dad90d4bbd760a152321f2143af7,charset=utf-8

   Step 7: Server2 sends another [BASE64] encoded challenge to Server1:

   <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
   cnNwYXV0aD1lYTQwZjYwMzM1YzQyN2I1NTI3Yjg0ZGJhYmNkZmZmZAo=
   </challenge>

   The decoded challenge is:

   rspauth=ea40f60335c427b5527b84dbabcdfffd

   Step 7 (alt): Server2 returns error to Server1:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <invalid-authzid/>
   </failure>
   </stream:stream>






Saint-Andre, Ed.            Standards Track                    [Page 36]

RFC 3920                       XMPP Core                    October 2004


   Step 8: Server1 responds to the challenge:

   <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

   Step 8 (alt): Server1 aborts negotiation:

   <abort xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

   Step 9: Server2 informs Server1 of successful authentication:

   <success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

   Step 9 (alt): Server2 informs Server1 of failed authentication:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
     <aborted/>
   </failure>
   </stream:stream>

   Step 10: Server1 initiates a new stream to Server2:

   <stream:stream
       xmlns='jabber:server'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 11: Server2 responds by sending a stream header to Server1 along
   with any additional features (or an empty features element):

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       from='example.com'
       id='s2s_345'
       version='1.0'>
   <stream:features/>

7.  Resource Binding