[asterisk-users] Odd Issue With Polycom Phones

[Sean Brady]

On 04/21/2010 03:08 PM, Warren Selby wrote:
> On Wed, Apr 21, 2010 at 3:46 PM, Jay Vocaire <jvocaire at innproc.com 
> <mailto:jvocaire at innproc.com>> wrote:
>
>     Thanks for the tip, I did just that, and now I am more confused.
>
>     It does appear as though there is just one call ID (if my
>     assumption that the "tag=" determines the call.
>
>     The first time it sends like this:
>
> <snip>
>
>     Asterisk responds with a SIP/2.0 401 Unauthorized, the phone then
>     comes back with this:
>
> <snip>
>
>     The difference is that the CSeq is now 2 and the following line is
>     added:
>
>     Authorization: Digest username="3271", realm="asterisk",
>     nonce="393a1b1f", uri="sip:3261 at y.y.y.y;user=phone",
>     response="c8223e261c252c12172982ee661ad307", algorithm=MD5
>
>
>     So maybe I do have an issue in Asterisk, okay probably.  Any clues
>     as to how to debug?  Let me know if need to post more information.
>
>
> This is expected behavior for SIP communications.  I see this all the 
> time when an end point is registering with Asterisk.  I think in those 
> cases, however, it's a REGISTER request, not an INVITE.  How is your 
> sip.conf configured for these end points?
>
> Do you have any phones other than the ones experiencing this problem 
> that you can test with?
>

Yes this is expected behavior on a REGISTER.  I didn't think that it was 
correct on an INVITE, however on reading RFC 3261, I believe that 
Asterisk is correctly responding to the request, needing credentials 
from the UA (Polycom).


My Ekiga softphone is doing the exact same thing, however it's not 
creating the same "2 call" issue that your Polycoms are having.  The 
Ekiga call setup is not including credentials on the first INVITE, 
receives a 401 not authorized, and sends another INVITE with 
credentials, and receives a "100 TRYING" from Asterisk.

This is most likely an issue with the firmware on the Polycom.  Bottom 
line is that another UA is doing the same thing, the call is setup 
properly, and it appears to work.

I respectfully request that someone smarter than me take a look at this 
and verify my conclusions, or correct me accordingly.

Thanks.

According to RFC 3261 (note that the RFC uses the word "request" instead 
of "register" or "registration request"):

"... If a 401 (Unauthorized) or 407 (Proxy Authentication Required)
response is received, the UAC SHOULD follow the authorization
procedures of Section 22.2 and Section 22.3 to retry the request with
credentials. ..."


Read more: http://www.faqs.org/rfcs/rfc3261.html#ixzz0llyASXyI

" ...

22.2 User-to-User Authentication

    When a UAS receives a request from a UAC, the UAS MAY authenticate
    the originator before the request is processed.  If no credentials
    (in the Authorization header field) are provided in the request, the
    UAS can challenge the originator to provide credentials by rejecting
    the request with a 401 (Unauthorized) status code.

    The WWW-Authenticate response-header field MUST be included in 401
    (Unauthorized) response messages.  The field value consists of at
    least one challenge that indicates the authentication scheme(s) and
    parameters applicable to the realm.

    An example of the WWW-Authenticate header field in a 401 challenge
    is:

       WWW-Authenticate: Digest
               realm="biloxi.com",
               qop="auth,auth-int",
               nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
               opaque="5ccc069c403ebaf9f0171e9517f40e41"

    When the originating UAC receives the 401 (Unauthorized), it SHOULD,
    if it is able, re-originate the request with the proper credentials.
    The UAC may require input from the originating user before
    proceeding.  Once authentication credentials have been supplied
    (either directly by the user, or discovered in an internal keyring),
    UAs SHOULD cache the credentials for a given value of the To header
    field and "realm" and attempt to re-use these values on the next
    request for that destination.  UAs MAY cache credentials in any way
    they would like.

    If no credentials for a realm can be located, UACs MAY attempt to
    retry the request with a username of "anonymous" and no password (a
    password of "").

    Once credentials have been located, any UA that wishes to
    authenticate itself with a UAS or registrar -- usually, but not
    necessarily, after receiving a 401 (Unauthorized) response -- MAY do
    so by including an Authorization header field with the request.  The
    Authorization field value consists of credentials containing the
    authentication information of the UA for the realm of the resource
    being requested as well as parameters required in support of
    authentication and replay protection.

..."

Read more: http://www.faqs.org/rfcs/rfc3261.html#ixzz0llyY2M2W

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20100421/77cd2664/attachment-0001.htm