ejabberd - Comments for "Ejabberd's salt (SCRAM) breaks mod_rest"

It has been fixed in ejabberd

mfoss — Mon, 27 Aug 2012 15:36:15 +0000

It has been fixed in ejabberd 2.1.x branch recently.

Missed the big ticket item

Zach Calvert — Thu, 12 Jul 2012 20:57:48 +0000

Missed the big ticket item out of ejabberd_commands.erl:

check_auth({User, Server, Password}) ->
    %% Check the account exists and password is valid
    AccountPass = ejabberd_auth:get_password_s(User, Server),
    AccountPassMD5 = get_md5(AccountPass),
    case Password of
        AccountPass -> {ok, User, Server};
        AccountPassMD5 -> {ok, User, Server};
        _ -> throw({error, invalid_account_data})
    end.
get_md5(AccountPass) ->
    lists:flatten([io_lib:format("~.16B", [X])
                   || X <- binary_to_list(crypto:md5(AccountPass))]).

This also means that if I'm able to sneak a peek at the database, I could still authenticate as admin for user credentials because it allows for plain text matching in the commands module.

Discovered that the problem

Zach Calvert — Thu, 12 Jul 2012 20:49:14 +0000

Discovered that the problem is that ejabberd authentication for command execution is different than the authentication for users. From ejabberd_commands.erl:

check_access(all, _) ->
    true;
check_access(Access, Auth) ->
    {ok, User, Server} = check_auth(Auth),
    %% Check this user has access permission
    case acl:match_rule(Server, Access, jlib:make_jid(User, Server, "")) of
        allow -> true;
        deny -> false
    end.

The fix is to fix the commands module to use the cyrsasl behavior. Has anyone done this before?

The mod rest call with an

Zach Calvert — Thu, 12 Jul 2012 20:45:54 +0000

The mod rest call with an http post fails a the following response:
Error: invalid_account_data

The only place I find that atom referenced is not in the mod_rest code, nor even in the ejabberd code, but it is present in the ejabberd comments for the /ejabberd-2.1.11/src/ejabberd_commands.erl code. It looks like the commands module is not making use of the cryptography change.

Is this a configuration element or can I enable it?

ejabberd - Comments for "Ejabberd&#039;s salt (SCRAM) breaks mod_rest"

It has been fixed in ejabberd

Missed the big ticket item

Discovered that the problem

The mod rest call with an

ejabberd - Comments for "Ejabberd's salt (SCRAM) breaks mod_rest"