[Asterisk-Users] Unable to Register to Asterisk through Proxy

[Olle E Johansson]

Aaron Clauson wrote:
> Hi,
> 
> Has anybody come across a situation where they were unable to register with Asterisk through a SIP stateless proxy server?
> 
> I'm getting an error:
> 
> "403 Authentication user name does not match account name"
Doesn't the error message explain the problem, really? The account name 
in the From: header needs to match the authentication user name in the 
Authorization header in Asterisk. This is a policy established in the 
source code.

> 
> Transmitting (NAT) to yyy.yyy.yyy.yyy:5060:
> SIP/2.0 401 Unauthorized
> Via: SIP/2.0/UDP yyy.yyy.yyy.yyy:5060;branch=z9hG4bKCefqJfo5hAO/paxgvw/iR7owic4=;received=yyy.yyy.yyy.yyy
> Via: SIP/2.0/UDP 192.168.1.2:5066;received=zzz.zzz.zzz.zzz:64073;rport=64073;branch=z9hG4bK882020b45b
> From: "test" <sip:test at xxx.xxx.xxx.xxx>;tag=632743770590650000
> To: "test" <sip:test at xxx.xxx.xxx.xxx>;tag=as738d9ccd
> Call-ID: 3deb0da4bada8c3 at 192.168.1.2
> CSeq: 65 REGISTER
> User-Agent: Asterisk PBX
> Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
> Contact: <sip:test at xxx.xxx.xxx.xxx>
> WWW-Authenticate: Digest realm="asterisk", nonce="6a62f137"
> Content-Length: 0
> 
> 
> ---
> Scheduling destruction of call '3deb0da4bada8c3 at 192.168.1.2' in 15000 ms
> buffalo*CLI>
> <-- SIP read from yyy.yyy.yyy.yyy:5060:
> REGISTER sip:xxx.xxx.xxx.xxx SIP/2.0
> Via: SIP/2.0/UDP yyy.yyy.yyy.yyy:5060;branch=z9hG4bKaN3LqUmNnA6Bm9VM4+7lrnh97Bo=
> Via: SIP/2.0/UDP 192.168.1.2:5066;received=zzz.zzz.zzz.zzz:64073;rport=64073;branch=z9hG4bKe494c5046b
> From: "test" <sip:test at xxx.xxx.xxx.xxx>;tag=632743770590650000
> To: "test" <sip:test at xxx.xxx.xxx.xxx>;tag=as738d9ccd
> Contact: <sip:test at xxx.xxx.xxx.xxx>
> Call-ID: 3deb0da4bada8c3 at 192.168.1.2
> CSeq: 66 REGISTER
> Max-Forwards: 69
> Expires: 600
> Authorization: Digest realm="asterisk",nonce="6a62f137"

This Authorization header is really broken, it is just a copy of the 
challenge that Asterisk sent in the 401 Unauthorized packet above. It 
contains no username and no digest really. In this case we should 
propably have an error message saying "Your client is broken, get 
Asterisk" :-)

/Olle