403 recieved on registration.

ser11 · Post by **ser11** » Tue Jan 24, 2012 3:30 am

1. Brekeke Product Name and version: 2.4.8.6

2. Java version:

3. OS type and the version: Win 2000/XP

4. UA (phone), gateway or other hardware/software involved:

5. Select your network pattern from http://www.brekeke-sip.com/bbs/network/ ... terns.html :

6. Your problem:

Sending first Registartion message with authontication header.
The header contains User name,realm and URI.
The same realm is configured at the BSS as well.

When Register message is sent to the BSS, it recives 403 Forbidden instead of 401.

Please advise

Thx

james · Post by **james** » Tue Jan 24, 2012 10:36 am

403 will happen if a realm or/and username are not correct.

Ae you sure you set correct realm and username in Proxy-Authorization or Authorization header?

Also.. if auth's username and From's user-part are not same, 403 will happen.

ser11 · Post by **ser11** » Mon Jan 30, 2012 12:35 am

As described in my first port - ecverything is configured OK.
The only twist we have here is that my client send authorization jeader on the first register message (the unchallenged message). From some reason the Brekeke sends 403 immediatelly, although exopected to send 401.

taitan · Post by **taitan** » Mon Jan 30, 2012 10:05 am

What kind of SIP client products are you using?
I know some client products are not RFC compliant.

Also have you created a user in the [User Authentication] page?

Jackpot · Post by **Jackpot** » Tue Jan 31, 2012 4:37 am

We are having a similar problem.

We have configured the server to have a realm value manually set in the user authentication and/or the domain.

We also turned off auth-From and To in both user authentication and domain.

When this is the case we get a 403 response.

The value of realm set in the fields above is the same as that as in the authorization header realm field of the initial register.

What is causing the 403 response?

sample of initial register below:

Session Initiation Protocol
Request-Line: REGISTER sip:CPname.com:5060 SIP/2.0
Message Header
From: <sip:+441234567890@CPname.com;user=phone>;tag=99daa8-a5cdb2a-13c4-50029-2c-2cdb9c84-2c
To: <sip:+441234567890@CPname.com;user=phone>
Call-ID: 9cc608-a5cdb2a-13c4-50029-2c-6da28c86-2c
CSeq: 1 REGISTER
Via: SIP/2.0/UDP 10.92.219.42:5060;rport;branch=z9hG4bK-2c-adc1-362d1b86
Max-Forwards: 70
Supported: replaces,100rel,timer,path
User-Agent:
Expires: 3600
Contact: <sip:+441234567890@10.92.219.42:5060;transport=UDP>
Authorization: Digest username="+441234567890@CPname.com",realm="CPname.com",nonce="",uri="sip:CPname.com",response=""
Content-Length: 0

taitan · Post by **taitan** » Tue Jan 31, 2012 10:47 am

What kind of SIP client are you using?

If you use another SIP client such as X-Lite, do you have the same problem?

hope · Post by **hope** » Tue Jan 31, 2012 11:00 am

Authorization: Digest username="+441234567890@CPname.com",realm="CPname.com",nonce="",uri="sip:CPname.com",response=""

is the authentication user name "+441234567890@CPname.com" set at Brekeke? or it is +441234567890

Jackpot · Post by **Jackpot** » Wed Feb 01, 2012 4:27 am

Hope,

Thanks for your response. We have tried both variables in the user authentication field and get 403 in both cases

davi · Post by **davi** » Wed Feb 01, 2012 11:22 am

Why your "User-Agent" header is blank?

Jackpot · Post by **Jackpot** » Thu Feb 02, 2012 2:52 am

Dave,

I deleted the header value from the example

davi · Post by **davi** » Thu Feb 02, 2012 10:36 am

Why your SIP UA sends REGISTER with Authorization header before the server returns 401?

Do you get the same problem if you use another SIP UA?

Jackpot · Post by **Jackpot** » Thu Feb 02, 2012 12:11 pm

Davi,

According to 3GPP 24.229 Clause 5.1.1.2.1 the inital Register must contain an authorization header. This is how a UA specifies that does not want to register with a proxy

davi · Post by **davi** » Thu Feb 02, 2012 1:17 pm

Ask Brekeke's team. they may support 3GPP 24.229.

james · Post by **james** » Thu Feb 02, 2012 2:12 pm

Try the DialPlan rule like a below.

----------------------
[Matching Patterns]
$request = ^REGISTER
Authorization = nonce=""

[Deploy Patterns]
Authorization =
$action = register
----------------------

Jackpot · Post by **Jackpot** » Fri Feb 03, 2012 2:43 am

James.

Thanks Will do. However, I fail to see why this would prevent the Server from sending a 401 when we spcifiy the realm on the server.

james · Post by **james** » Fri Feb 03, 2012 10:18 am

the reason of 403 in your case is empty "nonce" value.

Jackpot · Post by **Jackpot** » Fri Feb 03, 2012 1:39 pm

James,

Are you certain? Do you work for Brekeke? Is this what the Server is looking for because if it is it does not comply with 3GPP 24.229.

According to 3GPP the nonce must be empty when sent in the initial REGISTER.

5.1.1.2.3 Initial registration using SIP digest without TLS

On sending a REGISTER request, as defined in subclause 5.1.1.2.1, the UE shall additionally populate the header fields
as follows:

a) an Authorization header field as defined in RFC 2617 [21], with:
- the "username" header field parameter, set to the value of the private user identity;

- the "realm" header field parameter, set to the domain name of the home network;
- the "uri" header field directive, set to the SIP URI of the domain name of the home network;
- the "nonce" header field parameter, set to an empty value; and
- the "response" header field parameter, set to an empty value;

b) the hostport parameter in the Contact header field with the port value of an unprotected port where the UE
expects to receive subsequent requests; and

c) the sent-by field in the Via header field with the port value of an unprotected port where the UE expects to
receive responses to the request.

james · Post by **james** » Mon Feb 06, 2012 10:56 am

Im a Brekeke user.

Have you tried the DialPlan rule I suggested?

Jackpot · Post by **Jackpot** » Tue Feb 07, 2012 2:53 am

James,

Yes we diid and as I suspected there was no change.

james · Post by **james** » Tue Feb 07, 2012 3:01 pm

I got 401 if I use the DialPlan even if a REGISTER have an empty nonce.

Jackpot · Post by **Jackpot** » Wed Feb 08, 2012 2:31 am

James, Thanks for your help. I have had email confirmation from the Brekeke Development team that they are non-compliant to 3GPP 24.229.

james · Post by **james** » Wed Feb 08, 2012 11:12 am

using a plugin, the server can handle any SIP packets.

james · Post by **james** » Wed Feb 08, 2012 1:35 pm

Jack, what's your purpose?

Do you just want to get 401 ?
How about the following dialplan rule?
----------------------
[Matching Patterns]
$request = ^REGISTER

[Deploy Patterns]
Authorization =
$action = register
----------------------