Difference between revisions of "Services:XMPP:SASL downgrade"

From Kosmos Wiki
Jump to navigation Jump to search
(Add a page about the SASL downgrade)
 
Line 1: Line 1:
−
We are in the process of switching over the [[Services:Accounts|accounts to use LDAP]]. This page was created in order to document a warning that will occur on some clients after we enable LDAP authentication. The LDAP implementation in ejabberd doesn't support SASL authentication.
+
We are in the process of switching over the [[Services:Accounts|accounts to use LDAP]]. However, the The LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.
 +
 +
== Conversations for Android ==
 +
 
 +
In [https://conversations.im/ Conversations], go to the account settings (the form with user address and password). After failing to connect, the 'Save' button will turn into an 'Accept' button<ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 Issue: No (obvious?) way to accept SASL downgrade]</ref>.
  
−
The implication is that '''the user does not send a salted & hashed password''' to ejabberd, so the ejabberd process has access to a user's password and sends it over to the LDAP server to authenticate. This is considered <code>PLAIN</code> auth, even when both the XMPP c2s connection and the LDAP connect using TLS.
+
== References ==
−
 
−
Some clients will display a warning because they detect that the auth used to be done with SASL, but not any longer. The most common one is [https://conversations.im/ Conversations, the Android client].
 
−
 
−
== How to accept the warning in Conversations ==
 
  
−
In Conversations you can accept the warning by pressing "Accept" in the account details, that appears where the "Save" button is normally. <ref>[https://github.com/siacs/Conversations/issues/2498#issuecomment-556071993 No (obvious?) way to accept SASL downgrade]</ref>
+
<references />

Revision as of 14:38, 17 February 2020

We are in the process of switching over the accounts to use LDAP. However, the The LDAP implementation in ejabberd doesn't support SASL authentication, which we were using before. This means that some clients will refuse to connect to the server after the switch, and display a warning about it.

Conversations for Android

In Conversations, go to the account settings (the form with user address and password). After failing to connect, the 'Save' button will turn into an 'Accept' button[1].

References

  1. ↑ Issue: No (obvious?) way to accept SASL downgrade
Retrieved from "https://wiki.kosmos.org/index.php?title=Services:XMPP:SASL_downgrade&oldid=668"