- self["username"] = response["username"]
-
- -- check for nonce, ...
- if not response["nonce"] then
- return "failure", "malformed-request"
- else
- -- check if it's the right nonce
- if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end
- end
-
- if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end
- if not response["qop"] then response["qop"] = "auth" end
-
- if response["realm"] == nil then response["realm"] = "" end
-
- if response["charset"] == nil then
- response["username"] = latin1toutf8(response["username"])
- response["realm"] = latin1toutf8(response["realm"])
- elseif response["charset"] ~= "utf-8" then
- return "failure", "incorrect-encoding", "The client's response uses "..response["charset"].." for encoding with isn't supported by sasl.lua. Supported encodings are latin or utf-8."
- end
-
- local domain = ""
- local protocol = ""
- if response["digest-uri"] then
- protocol, domain = response["digest-uri"]:match("(%w+)/(.*)$")
- if protocol == nil or domain == nil then return "failure", "malformed-request" end
- else
- return "failure", "malformed-request", "Missing entry for digest-uri in SASL message."
- end
-
- --TODO maybe realm support
- self.username = response["username"]
- local password_encoding, Y = self.password_handler(response["username"], response["realm"], "DIGEST-MD5")
- if Y == nil then return "failure", "not-authorized"
- elseif Y == false then return "failure", "account-disabled" end
-
- local A1 = Y..":"..response["nonce"]..":"..response["cnonce"]--:authzid
- local A2 = "AUTHENTICATE:"..protocol.."/"..idna_ascii(domain)
-
- local HA1 = md5(A1, true)
- local HA2 = md5(A2, true)
-
- local KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
- local response_value = md5(KD, true)
-
- if response_value == response["response"] then
- -- calculate rspauth
- A2 = ":"..protocol.."/"..idna_ascii(domain)
-
- HA1 = md5(A1, true)
- HA2 = md5(A2, true)
-
- KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
- local rspauth = md5(KD, true)
- self.authenticated = true
- return "challenge", serialize({rspauth = rspauth})
- else
- return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated."
- end
- elseif self.step == 3 then
- if self.authenticated ~= nil then return "success"
- else return "failure", "malformed-request" end