Help me with digest authentication using java

Question

So i am trying to authenticate myself to the monero-rpc-wallet, the server requires me to use digest authentication.

If my username is: Alladin and password: open sesame

The www-authenticate header looks like this:

    WWW-Authenticate: Digest qop="auth",algorithm=MD5,realm="monero-wallet-rpc",nonce="hHQVNuEdyZszjmEPwS/jkQ==",stale=false
Digest qop="auth",algorithm=MD5-sess,realm="monero-wallet-rpc",nonce="hHQVNuEdyZszjmEPwS/jkQ==",stale=false

And my java code to implement it looks like this:

connection.addRequestProperty("Authorization", "Digest [don't know what goes here]");

The place where i put "don't know what goes here", can someone go through the steps in showing me what i need to put in there?

If i figure this out i can build a nice java library that communicates with the wallet-rpc that has authentication built it. Right now i am able to build the library without this authentication because i don't know how to do it, but would much prefer to have the added security of authentication.

Answer 1

I took a look over here: https://en.wikipedia.org/wiki/Digest_access_authentication and from how I understand it you must do the following

Get the nonce and realm from that first message:

algorithm=MD5,realm="monero-wallet-rpc",nonce="hHQVNuEdyZszjmEPwS/jkQ=="

Then use the following flow:

HA1=MD5(MD5(username:realm:password):nonce:cnonce) //cnonce is a client nonce
HA2=MD5(method:digestURI)
response=MD5(HA1:nonce:HA2)

Your response would look something like:

import java.security.*;

..

java.security.SecureRandom random = java.security.SecureRandom.getInstance("SHA1PRNG");
random.setSeed(System.currentTimeMillis()); 
byte[] nonceBytes = new byte[16]; 
random.nextBytes(nonceBytes); 

String clientNonce = new String(org.apache.commons.codec.binary.Base64.encodeBase64(nonceBytes), "UTF-8");
String serverNonce = "hHQVNuEdyZszjmEPwS/jkQ==";

String HA1String = "aladdin:monero-wallet-rpc:open sesame";
String HA2String = "GET:<your-uri>";
byte[] ha1Bytes = HA1String.getBytes("UTF-8");
byte[] ha2Bytes = HA2String.getBytes("UTF-8");

MessageDigest md = MessageDigest.getInstance("MD5");
String HA1_1 = new String(md.digest(ha1Bytes)) + ":" + serverNonce + ":" + clientNonce;
byte[] ha1_1 = HA1_1.getBytes("UTF-8");

String HA1 = new String(md.digest(ha1_1);
String HA2 = new String(md.digest(ha2Bytes));

String HA1nonceHA2 = HA1+ "hHQVNuEdyZszjmEPwS/jkQ==" + HA2;
byte[] ha1nonceha2bytes = HA1nonceHA2.getBytes("UTF-8");

String responseVal = new String(md.digest(ha1nonceha2bytes));

String response = "Digest "+
                 "username=\"aladdin\",\r\n"+
                 "realm=\"monero-wallet-rpc\",\r\n"+
                 "nonce=\"" + serverNonce + "\",\r\n"+
                 "uri=\"" + <your-uri> + "\",\r\n"+
                 "qop=auth,\r\n"+
                 "nc=00000001,\r\n"+ //Increment this each time.
                 "cnonce=\"" + clientNonce + "\",\r\n"+
                 "response=\"" + responseVal + "\""

connection.addRequestProperty("Authorization", response);

That should at least get you close. Remember null checks etc.