<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>Le 23 avr. 2014 à 09:50, Daniel-Constantin Mierla <<a href="mailto:miconda@gmail.com">miconda@gmail.com</a>> a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Georgia; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">However, SIP RFC enforces www digest authentication and it is what all the phones I am aware of in the wild support now.</span><br style="font-family: Georgia; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote></div><br><div>Thanks for all this informations.</div><div><br></div><div>That explain me why all SIP product I see on the market have this really big issue of requiring a distinct PIN code for SIP account.</div><div><br></div><div>As a sys admin who maintain a unique identity for all enterprise services, it’s hard to accept to make an exception for SIP…</div><div><br></div><div>I don’t understand how it's possible to end up on a RFC like that…</div><div><br></div><div>The good point for me is, on OS X Server, I’ve a private API who can provide me DIGEST challenge, so something is possible. But for my FreeBSD based server, I’m stuck…</div><div><br></div><div><br></div><div><br></div><div>TLS authentication is harder to deploy in SMB. That mean a internal CA and a overhead to ensure that each client certificate are well secured.</div><div><br></div><div><br></div><div>The solution of BASIC authentication over TLS connection (with certificate only on the server) is widely used by HTTPS based software or event e-mail protocols to allow add-on services to be connected to existing directory services without requiring access to clear text password.</div><div><br></div><div><br></div><div>Cheers,</div><div>Yoann</div></body></html>