Closed jonra1993 closed 11 months ago
krusadellc
commented
11 months ago Did you try sending a 4XX error response in your authentication API endpoint? We have seen some RTSP clients like VLC do not even attempt a basic auth unless an error response is sent back by the auth endpoint.
jonra1993
commented
11 months ago Hello @krusadellc I have done that it works perfectly with rtmp when I send credentials it auth when they miss I send a 4xx as I mentioned in the issue Mediamtx is not sending user and pass to auth server. For now, I am send them from query params and extract from them. But I still have user and password as empty strings. The log from by auth server I am not suing VLC
aler9
commented
11 months ago Hello, i tested again but in my case the external authentication mechanism worked without any issue. Make sure to return code 400 in case of empty credentials, otherwise the client won't send credentials. You didn't post the entire log therefore it's impossible to understand whether you're implementing the server correctly or not. Here's a sample code.
package main
import (
"encoding/json"
"fmt"
"net"
"net/http"
"context"
"github.com/gin-gonic/gin"
)
type server struct {
s *http.Server
}
func newServer() (*server, error) {
ln, err := net.Listen("tcp", ":9120")
if err != nil {
return nil, err
}
ts := &server{}
router := gin.New()
router.POST("/auth", ts.onAuth)
ts.s = &http.Server{Handler: router}
go ts.s.Serve(ln)
return ts, nil
}
func (ts *server) close() {
ts.s.Shutdown(context.Background())
}
func (ts *server) onAuth(ctx *gin.Context) {
var in struct {
IP string `json:"ip"`
User string `json:"user"`
Password string `json:"password"`
Path string `json:"path"`
Action string `json:"action"`
Query string `json:"query"`
}
err := json.NewDecoder(ctx.Request.Body).Decode(&in)
if err != nil {
ctx.AbortWithStatus(http.StatusBadRequest)
return
}
fmt.Printf("%+v\n", in)
if in.User == "" {
ctx.AbortWithStatus(http.StatusUnauthorized)
return
}
ctx.Status(http.StatusOK)
}
func main() {
_, err := newServer()
if err != nil {
panic(err)
}
select {}
}Hello @aler9 thanks I solved it it was missing the 400 error when the first request user is empty I see Mediamtx sends another request.
saket424
commented
11 months ago In releases earlier to 1.3, an error code of 401 used to work when username and password were empty. With 1.3 the error code must be 400, otherwise things don't authenticate successfully
aler9
commented
10 months ago @saket424 i just tested external authentication against v1.4.0 and it works well when the code is ether 401 or 400, there's no difference at all. Currently, the server just checks whether status code is inside range 200-299 or not:
github-actions[bot]
commented
4 months ago This issue is being locked automatically because it has been closed for more than 6 months. Please open a new issue in case you encounter a similar problem.
Which version are you using?
v1.3.0
Which operating system are you using?
Describe the issue
RTSP does not extract user and password when using an external auth server. I have set up the external server and mediamtx does not send in the payload the user and passwords. I test with rtmp and it works.
Describe how to replicate the issue
Default config file
Did you attach the server logs?
yes
Did you attach a network dump?
no