Services:XMPP:SASL downgrade - Revision history

Raucao at 14:26, 20 February 2020

2020-02-20T14:26:17Z

Greg: Add caption

2020-02-20T13:27:15Z

Add caption

Greg: Add a screenshot of Conversations to accept the SASL downgrade

2020-02-20T13:25:53Z

Add a screenshot of Conversations to accept the SASL downgrade

Greg: Add link to the XMPP page

2020-02-20T11:35:51Z

Add link to the XMPP page

Greg at 16:35, 17 February 2020

2020-02-17T16:35:21Z

Raucao at 14:38, 17 February 2020

2020-02-17T14:38:10Z

Greg: Add a page about the SASL downgrade

2020-02-17T13:31:25Z

Add a page about the SASL downgrade

New page

We are in the process of switching over the [[Services:Accounts|accounts to use LDAP]]. This page was created in order to document a warning that will occur on some clients after we enable LDAP authentication. The LDAP implementation in ejabberd doesn't support SASL authentication.

The implication is that '''the user does not send a salted & hashed password''' to ejabberd, so the ejabberd process has access to a user's password and sends it over to the LDAP server to authenticate. This is considered <code>PLAIN</code> auth, even when both the XMPP c2s connection and the LDAP connect using TLS.

Some clients will display a warning because they detect that the auth used to be done with SASL, but not any longer. The most common one is [https://conversations.im/ Conversations, the Android client].

== How to accept the warning in Conversations ==

In Conversations you can accept the warning by pressing "Accept" in the account details, that appears where the "Save" button is normally. <ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 No (obvious?) way to accept SASL downgrade]</ref>

@@ Line 4: / Line 4: @@
 == Conversations for Android ==
 In [https://conversations.im/ Conversations], go to the account settings (the form with user address and password). After failing to connect, the 'Save' button will turn into an 'Accept' button<ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 Issue: No (obvious?) way to accept SASL downgrade]</ref>.
 == References ==
 <references />

@@ Line 5: / Line 5: @@
 == Conversations for Android ==
-[[File:SASL downgrade.jpg|thumb]]
+[[File:SASL downgrade.jpg|thumb|Press accept]]
 In [https://conversations.im/ Conversations], go to the account settings (the form with user address and password). After failing to connect, the 'Save' button will turn into an 'Accept' button<ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 Issue: No (obvious?) way to accept SASL downgrade]</ref>.

@@ Line 4: / Line 4: @@
 == Conversations for Android ==
 In [https://conversations.im/ Conversations], go to the account settings (the form with user address and password). After failing to connect, the 'Save' button will turn into an 'Accept' button<ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 Issue: No (obvious?) way to accept SASL downgrade]</ref>.
 == References ==
 <references />

← Older revision		Revision as of 11:35, 20 February 2020
Line 1:		Line 1:
		+	[[Services:XMPP\|See Services:XMPP for information about the kosmos.org XMPP server]]
		+
	We are in the process of switching over the [[Services:Accounts\|accounts to use LDAP]]. However, the LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.		We are in the process of switching over the [[Services:Accounts\|accounts to use LDAP]]. However, the LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.

← Older revision		Revision as of 16:35, 17 February 2020
Line 1:		Line 1:
−	We are in the process of switching over the [[Services:Accounts\|accounts to use LDAP]]. However, the ~~The~~ LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.	+	We are in the process of switching over the [[Services:Accounts\|accounts to use LDAP]]. However, the LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.

	== Conversations for Android ==		== Conversations for Android ==

@@ Line 1: / Line 1: @@
-We are in the process of switching over the [[Services:Accounts|accounts to use LDAP]]. This page was created in order to document a warning that will occur on some clients after we enable LDAP authentication. The LDAP implementation in ejabberd doesn't support SASL authentication.
+We are in the process of switching over the [[Services:Accounts|accounts to use LDAP]]. However, the The LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.
-The implication is that '''the user does not send a salted & hashed password''' to ejabberd, so the ejabberd process has access to a user's password and sends it over to the LDAP server to authenticate. This is considered <code>PLAIN</code> auth, even when both the XMPP c2s connection and the LDAP connect using TLS.
+== References ==
-In Conversations you can accept the warning by pressing "Accept" in the account details, that appears where the "Save" button is normally. <ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 No (obvious?) way to accept SASL downgrade]</ref>
+<references />