crossbario / autobahn-java

WebSocket & WAMP in Java for Android and Java 8
https://crossbar.io/autobahn
MIT License
1.52k stars 427 forks source link

WAMPCRA Salting #512

Closed om26er closed 3 years ago

om26er commented 3 years ago

Fixes https://github.com/crossbario/autobahn-java/issues/511

jesccos06 commented 3 years ago

I need this functionality, so as soon as I saw this branch I downloaded and built it to test with it. However the Server i am trying to connect to is saying that the Authentication is Invalid. Can you please provide some test so I can see how to run this?

om26er commented 3 years ago

Finally, found a fix https://github.com/crossbario/autobahn-java/pull/512/commits/b5064bbc8436e34e9073e3a4203912722d510970

om26er commented 3 years ago

@jesccos06, could you try this branch with the server you were previously trying to connect and let me know if it fixes the issue for you.

I used the following crossbar config

{
    "$schema": "https://raw.githubusercontent.com/crossbario/crossbar/master/crossbar.json",
    "version": 2,
    "controller": {
    },
    "workers": [
        {
            "type": "router",
            "realms": [
                {
                    "name": "realm1",
                    "roles": [
                        {
                            "name": "anonymous",
                            "permissions": [
                                {
                                    "uri": "",
                                    "match": "prefix",
                                    "allow": {
                                        "call": true,
                                        "register": true,
                                        "publish": true,
                                        "subscribe": true
                                    },
                                    "disclose": {
                                        "caller": false,
                                        "publisher": false
                                    },
                                    "cache": true
                                }
                            ]
                        }
                    ]
                }
            ],
            "transports": [
                {
                    "type": "web",
                    "endpoint": {
                        "type": "tcp",
                        "port": 8080,
                        "backlog": 1024
                    },
                    "paths": {
                        "ws": {
                            "type": "websocket",
                            "serializers": [
                                "cbor", "msgpack", "json"
                            ],
                             "auth": {
                                "wampcra": {
                                   "type": "static",
                                   "users": {
                                      "peter": {
                                         "secret": "Eu7CQLfR+/Ffb+275A4s9/6H/RGKYxM4s6IMrsNKzC8=",
                                         "role": "anonymous",
                                         "salt": "salt123",
                                         "iterations": 1000,
                                         "keylen": 32
                                      }
                                   }
                                }
                             }
                        }
                    }
                }
            ]
        }
    ]
}

And in Android just did to test that I was successfully able to join. As you can see the password is secret123

AuthenticationExampleClient.exampleCRA("ws://10.0.2.2:8080/ws", "realm1", "peter", "secret123").whenComplete((exitInfo, throwable) -> {
});
jesccos06 commented 3 years ago

@om26er I was able to connect to the server with the latest code! Everything seems good now. Thanks a lot! When do you think a new release with these fixes will be available?

oberstet commented 3 years ago

When do you think a new release with these fixes will be available?

yes, it will be in the net release sometime in the coming months