Digest Authenticator realm name is clear text right?

[Jalali, Alex]

Hi, Is this is a bug with tomcat or adobe Acrobat in digest auth?
 
I have created an Authenticator extending the AuthenticatorBase. 
 
When I send this in the header:
 
>>> WWW-Authenticate: Digest realm="My realm name", qop="auth",
nonce="...
 
Other clients return something like this with realm name in clear text.
 
 >>> Authorization: Digest username="user", realm=""My realm name""
...
 
But adobe Acrobat (using its upload review tool to publish to a webdav
server) returns with a response header that has, I guess encrypted the
realm name like this
 
>>> Authorization: Digest username="user",
realm=""f6b755878fd52d631b890b"" ...
 
I looked at the AuthenticatorBase in different functions and it seems
that it expects the realm name to be plain text and doesn't check for
anything like this. in fact if it can not parse the realm name it uses
the server to get that. 
 
At the end the calculation comparing server digestValue with client do
not match.
 
So I guess my question is should tomcat check this in its Authenticator?
should it do anything if the realm name returned by the client does not
match that of what's on the server? or this is just a bug with acrobat?
 
 
Thanks,
 
Alex
 
 
 

RE: Digest Authenticator realm name is clear text right?

[Jalali, Alex]

Actually I tracked down everywhere and it truns out that the problem is
in parsing the username and the rest of the stuff in the header inside
findPrincipal() method of DigestAuthenticator class.

Given the authorization header is: Digest
username="user",realm=""f6b755878fd52d631b890b"" ...

The method returns null. Because it parses the username to -->
user",realm=""f6b755878fd52d631b890b"" ...
And so there are no more tokens and the rest of the stuff is set to -->
null and the method returns null.



The bug fix in this method is doing that. and that is because of the
double quote in the realm=""bla bala"" I'm guessing. which is ok for it
to have double quote per RFC

When I changed this method back to the way it used to parse the header,
everything workes fine. 

I know this bug fix is trying to fix a special case where the url
contains ,?= etc but it is not concedering the double quote in the realm
name maybe??? I don't know too much about regular expressions to fix
this. so I'm just using the old code. I also don't have permission add
code to re-open this bug or send a fix. Do you have permission to
re-open and add this note?


protected static Principal findPrincipal(Request request,
 String authorization,
 Realm realm) {

//System.out.println("Authorization token : " + authorization);
// Validate the authorization credentials format
if (authorization == null)
return (null);
if (!authorization.startsWith("Digest "))
return (null);
authorization = authorization.substring(7).trim();

// Bugzilla 37132:
http://issues.apache.org/bugzilla/show_bug.cgi?id=37132
   String[] tokens =
authorization.split(",(?=(?:[^\"]*\"[^\"]*\")+$)");

 String userName = null;
String realmName = null;
String nOnce = null;
String nc = null;
String cnonce = null;
String qop = null;
String uri = null;
String response = null;
String method = request.getMethod();

for (int i = 0; i < tokens.length; i++) {
String currentToken = tokens[i];
if (currentToken.length() == 0)
continue;

int equalSign = currentToken.indexOf('=');
if (equalSign < 0)
return null;
String currentTokenName =
currentToken.substring(0, equalSign).trim();
String currentTokenValue =
currentToken.substring(equalSign + 1).trim();
if ("username".equals(currentTokenName))
userName = removeQuotes(currentTokenValue);
if ("realm".equals(currentTokenName))
realmName = removeQuotes(currentTokenValue, true);
if ("nonce".equals(currentTokenName))
nOnce = removeQuotes(currentTokenValue);
if ("nc".equals(currentTokenName))
nc = removeQuotes(currentTokenValue);
if ("cnonce".equals(currentTokenName))
cnonce = removeQuotes(currentTokenValue);
if ("qop".equals(currentTokenName))
qop = removeQuotes(currentTokenValue);
if ("uri".equals(currentTokenName))
uri = removeQuotes(currentTokenValue);
if ("response".equals(currentTokenName))
response = removeQuotes(currentTokenValue);
}

if ( (userName == null) || (realmName == null) || (nOnce ==
null)
 || (uri == null) || (response == null) )
return null;

// Second MD5 digest used to calculate the digest :
// MD5(Method + ":" + uri)
String a2 = method + ":" + uri;
//System.out.println("A2:" + a2);

byte[] buffer = null;
synchronized (md5Helper) {
buffer = md5Helper.digest(a2.getBytes());
}
String md5a2 = md5Encoder.encode(buffer);

return (realm.authenticate(userName, response, nOnce, nc,
cnonce, qop,
   realmName, md5a2));

}

 the realm has two qoutes "" which is ok but the

-Original Message-
From: Tino Schwarze [mailto:[EMAIL PROTECTED] 
Sent: Friday, August 11, 2006 8:46 AM
To: dev@tomcat.apache.org
Subject: Re: Digest Authenticator realm name is clear text right?

On Thu, Aug 10, 2006 at 12:39:48PM -0700, Jalali, Alex wrote:
> Hi, Is this is a bug with tomcat or adobe Acrobat in digest auth?

I suppose neither. The real is clear text.

> But adobe Acrobat (using its upload review tool to publish to a webdav
> server) returns with a response header that has, I guess encrypted the