Hi Peter Dunkley or anyone else who can throw me some clue,

I'm interested in using the auth_ephemeral module to authenticate registrations with the help of an external web service.

But I'm reading and reading the documentation and I'm clearly missing something.

The document starts by describing how "the web service" should work. I understand fully that I must implement this web service.

But nowhere in the documentation with auth_ephemeral do you tell the module the URL where the service is found.

Whilst the Makefile includes libcurl when static linking is used, there are no calls to the curl library in the auth_ephemeral module, or to socket() or connect().

So I don't see that this module can act as a client to the documented web service?

What am I failing to understand?

Thanks, Steve

Hi Daniel,

On 17 January 2017 at 14:15, Daniel-Constantin Mierla miconda@gmail.com wrote:

I guess you can use other modules such as http_client to interact with the web service. The jansson module can be used to parse the result.

Also, it should be possible to do it without interacting with the web service, because you can compute the password using the shared secret key. So, in this case, Kamailio doesn't need to interact with the web service.

Thanks for that, and to Carsten who also sent explanation.

It seems like all that documentation about the web service is indeed a red-herring since the module is neither a client nor a provider of such a service. There is no obligation to implement such a service as documented - since in any event auth_ephemeral neither implements nor consumes this web service.

All auth_ephemeral does it to authenticate clients using a secret (password) that is encrypted using a shared key. auth_ephemeral I guess decrypts the secret which is structured so that auth_ephemeral can tell that it is legit and unexpired.

Do I have this right?

Gotta say that the docs really don't make this clear.

Thanks, Steve

On 17/01/2017 14:58, Carsten Bock wrote:

Hi,

I don't know, who's responsible for approving bigger messages - if present, please approve my message for completeness of this thread... :-)

Done!

Cheers, Daniel

You are right - except that it doesn't really decrypt the secret, it only creates a hash identical to the one create by the Webservice and compares the hash.

Thanks, Carsten

2017-01-17 14:38 GMT+01:00 Steve Davies steve-lists-srusers@connection-telecom.com:

...

Hi Daniel,

On 17 January 2017 at 14:15, Daniel-Constantin Mierla miconda@gmail.com wrote:

...

I guess you can use other modules such as http_client to interact with the web service. The jansson module can be used to parse the result.

Also, it should be possible to do it without interacting with the web service, because you can compute the password using the shared secret key. So, in this case, Kamailio doesn't need to interact with the web service.

Thanks for that, and to Carsten who also sent explanation.

It seems like all that documentation about the web service is indeed a red-herring since the module is neither a client nor a provider of such a service. There is no obligation to implement such a service as documented - since in any event auth_ephemeral neither implements nor consumes this web service.

All auth_ephemeral does it to authenticate clients using a secret (password) that is encrypted using a shared key. auth_ephemeral I guess decrypts the secret which is structured so that auth_ephemeral can tell that it is legit and unexpired.

Do I have this right?

Gotta say that the docs really don't make this clear.

Thanks, Steve

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Hi,

the idea between ephemeral passwords is, that any webservice can create username/passwords without explicitly provisioning them on the other servers. The auth_ephemeral module does not provide the webserver, but only the compability to authenticate based on a shared secret.

You may e.g. use the following PHP function to create a username, which is valid for the next 3 hours (3*3600):

function getEphemeralUsername($username) { $timeout = time () + (3 * 3600); return $timeout . ':' . $username; }

With this "temporary username" and the shared secret, you can now create a temporary password:

function getEphemeralPassword($temporary_user, $shared_secret) { return base64_encode ( hash_hmac ( 'sha1', $temporary_user, $shared_secret, true ) ); }

$secret = "imsrulez"; $username = getEphemeralUsername('steve'); // Creates: '<-unix-timestamp:valid until->:steve' $password = getEphemeralPassword($username, $secet);

The documation refers to any website, which could provide the username/password (e.g. even a homepage without any API interaction).

On Kamailio, you can now verify the username/password, if you configure the same "shared password":

modparam("auth_ephemeral", "secret", "imsrulez")

Thanks, Carsten

2017-01-17 12:53 GMT+01:00 Steve Davies steve-lists-srusers@connection-telecom.com:

Hi Peter Dunkley or anyone else who can throw me some clue,

I'm interested in using the auth_ephemeral module to authenticate registrations with the help of an external web service.

But I'm reading and reading the documentation and I'm clearly missing something.

The document starts by describing how "the web service" should work. I understand fully that I must implement this web service.

But nowhere in the documentation with auth_ephemeral do you tell the module the URL where the service is found.

Whilst the Makefile includes libcurl when static linking is used, there are no calls to the curl library in the auth_ephemeral module, or to socket() or connect().

So I don't see that this module can act as a client to the documented web service?

What am I failing to understand?

Thanks, Steve

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users