iChat Server, SRV records and Digest-MD5

Question

iChat Server, SRV records and Digest-MD5

Hi all,

So I have a server, let's say "jabber.example.com", and in my DNS I have some SRV records that map jabber.tcp, xmpp-client.tcp and xmpp-server.tcp to this server.

Now, I go to Server Admin for jabber.example.com, and in the iChat configuration, I set "example.com" as the Host Domain.

The DNS for jabber.example.com is correctly set-up, as are the SRV records. jabber.example.com is happy with its hostname too.

What I find when I do this is that I can't log-in to the iChat server with JIDs of the form "user@example.com". Nor can I log-in with JIDs like "user@jabber.example.com", but that's expected and I don't want to do that.

If I change the Host Domain to "jabber.example.com", then I can log-in using "user@jabber.example.com", but not with "user@example.com". I want the latter.

If I comment-out the digest-md5 mechanism from the SASL mechanisms in c2s.xml and set the Host Domain back to "example.com", things work how I want. I'm using SSL, so there's no particular problem using the SASL plain mechanism, though I'd rather not.

Surely this is a bug? How is one supposed to configure things so that users get JIDs like their e-mail addresses (i.e. with a domain rather than a full host name)? Surely digest-md5 should work with such a set-up?

Any insight?

Kind regards,

Alastair.

Mac OS X (10.6.2)

Posted on Feb 14, 2010 9:03 AM

Reply

Answer 1

jaydisc

Level 4

1,464 points

Feb 14, 2010 2:18 PM in response to Alastair Houghton

So I have a server, let's say "jabber.example.com", and in my DNS I have some SRV records that map jabber.tcp, xmpp-client.tcp and xmpp-server.tcp to this server.

Are the full versions of these SRV records jabber._tcp.example.com or jabber._tcp.jabber.example.com?

What client are you using?

Have you tried manually setting the server address to server.example.com while having the JID set to user@example.com? If not, the client might simply be trying to resolve example.com. Does that resolve to the same address as jabber.example.com?

Also, have you looked in sysem.log? That's where jabberd messages are logged. (you can filter by "jabberd")

Lastly, are you using SSL, non-SSL or both? As I've never gotten SRV records to work with an SSL only configuration.

Reply

Answer 2

Feb 15, 2010 6:35 AM in response to jaydisc

jaydisc wrote:

So I have a server, let's say "jabber.example.com", and in my DNS I have some SRV records that map jabber.tcp, xmpp-client.tcp and xmpp-server.tcp to this server.

Are the full versions of these SRV records jabber._tcp.example.com or jabber._tcp.jabber.example.com?

jabber.tcp.example.com

What client are you using?

iChat

Have you tried manually setting the server address to server.example.com while having the JID set to user@example.com ?

Yes

If not, the client might simply be trying to resolve example.com. Does that resolve to the same address as jabber.example.com?

No, but that's the point of having the SRV records 🙂

Also, have you looked in sysem.log? That's where jabberd messages are logged. (you can filter by "jabberd")

Yes, done that. Nothing terribly useful; just the messages you'd expect from Apple's OpenDirectory authentication code (ODKVerifyClientRequestFixed you that you can't authenticate, which happens because the digest-md5 mechanism isn't working because something is using the wrong name).

Lastly, are you using SSL, non-SSL or both? As I've never gotten SRV records to work with an SSL only configuration.

Both. As for SRV with SSL, it's probably just that something is looking for "_jabbers" or "xmpp-clients" or something similar, and expecting to use the next port number up. With it set to use both, IIRC it'll do TLS over the usual port rather than trying to connect directly with SSL to start with.

As I said in my original message, it was all set up exactly as you'd expect; the problem seems to be that the digest authentication fails because (I guess) the hostname being used is different to what it should be.

If anyone has this working with digest-md5 enabled, I'd be interested to hear about it, but honestly I doubt anyone does.

Reply

Answer 3

jaydisc

Level 4

1,464 points

Feb 17, 2010 4:05 PM in response to Alastair Houghton

OK, I've been able to recreate your problem without SRV records. Since the only purpose they serve is auto-discovery, I wouldn't worry about those for now since the problem occurs even when manually configuring iChat.

Unfortunately, I don't have a solution, but FWIW, I can replicate it. Hopefully Apple can too. I'd file a bug.

Reply

Answer 4

Tim Harris

Level 4

1,481 points

Feb 19, 2010 1:10 PM in response to Alastair Houghton

Hello there. I can understand the frustration.

The problem is not really with the iChat server it is the linkage between it and Open Directory. In simple terms, Digest-MD5 contains the domain name as used by the client and this is passed by the iChat server on to Open Directory to validate, but it fails. This is because Open Directory is only permitted to authorize access for users in is own domain (e.g. server.mydomain.com) and not mydomain.com.

As has been said, you should raise this with apple. The answer however lies in allowing OD to authenticate other domains.

Reply