Thanks. Everything is much more clear now. I will do the reading.<div><div><br></div><div>-Bruce<br><br><div class="gmail_quote">On Wed, Nov 9, 2011 at 3:58 PM, Olle E. Johansson <span dir="ltr"><<a href="mailto:oej@edvina.net">oej@edvina.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><br>
9 nov 2011 kl. 21:05 skrev Bruce B:<br>
<div class="im"><br>
> I just did an X-Lite register to Asterisk extension and first SIP invite included extension but then Asterisk rejected and asked for authentication to which X-Lite provided password?!<br>
><br>
> So, why is there the need to invite without providing authentication in the first place? Why is there a two step to authentication? This really shows a shortcoming of SIP v2.0 RFC when it comes to this type of security implementation.<br>
<br>
</div>Bruce,<br>
I suggest you do some reading on challenge-response authentication and HTTP Digest MD5 auth.<br>
<br>
To succeed with challenge-response, you need a challenge to respond to. You get that in the first response, the 401 or 407.<br>
<font color="#888888"><br>
/O<br>
</font><div><div></div><div class="h5">--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
<br>
asterisk-dev mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-dev" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-dev</a><br>
</div></div></blockquote></div><br></div></div>