<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 23/04/14 08:06, Yoann Gini wrote:<br>
</div>
<blockquote
cite="mid:F7A11F77-B76A-4D3D-94DF-E0E75E643DD1@gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<br>
<div>
<div>Le 22 avr. 2014 à 11:03, Daniel-Constantin Mierla <<a
moz-do-not-send="true" href="mailto:miconda@gmail.com">miconda@gmail.com</a>>
a écrit :</div>
<br class="Apple-interchange-newline">
<blockquote type="cite"><span style="font-family: Georgia;
font-size: 13px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
normal; orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); float: none; display:
inline !important;">the constraint to have access to text
password or HA1 format (md5 over username, password, realm)
comes from WWW Authentication mechanism which is used by
SIP.</span><br style="font-family: Georgia; font-size: 13px;
font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: normal;
orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br style="font-family: Georgia; font-size: 13px; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: auto;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px;">
<span style="font-family: Georgia; font-size: 13px;
font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: normal;
orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); float: none; display:
inline !important;">Writing something different in kamailio
would be possible (it is open source), but you don't have
phones able to do it and provide the adequate details.</span><br
style="font-family: Georgia; font-size: 13px; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: auto;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: auto; word-spacing: 0px;
-webkit-text-stroke-width: 0px;">
</blockquote>
<br>
</div>
<div>Are you sure?</div>
</blockquote>
Sure you can't be sure of anything but this one.<br>
<br>
<blockquote
cite="mid:F7A11F77-B76A-4D3D-94DF-E0E75E643DD1@gmail.com"
type="cite">
<div> You’ve a Radius backend for example, Radius don’t allow you
to access to clear text password, it isn’t?</div>
</blockquote>
Look at digest module for (free)radius, if there is something like
that for ldap, then you may get it working with some patch. But it
still requires access to plain text password or HA1.<br>
<blockquote
cite="mid:F7A11F77-B76A-4D3D-94DF-E0E75E643DD1@gmail.com"
type="cite">
<div><br>
</div>
<div><br>
</div>
The only www authentication mechanism who must have access to
clear text password is the DIGEST auth. But if we consider using
SIP over TLS, we may be able to use BASIC authentication…
<div><br>
</div>
<div>What do you think ? Does the authentication kind is
negotiated during the communication?</div>
</blockquote>
If you use tls and give a signed certificate to client, then you can
simply authenticate it by trusting the certificate and checking the
owner fields to match sip headers.<br>
<br>
If you control the client and develop it, you can add any
authentication mechanism. You will eventually have to add to
kamailio appropriate authentication support, but that's easy, it's
open source.<br>
<br>
However, SIP RFC enforces www digest authentication and it is what
all the phones I am aware of in the wild support now.<br>
<br>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla - <a class="moz-txt-link-freetext" href="http://www.asipto.com">http://www.asipto.com</a>
<a class="moz-txt-link-freetext" href="http://twitter.com/#!/miconda">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda">http://www.linkedin.com/in/miconda</a></pre>
</body>
</html>