IdHTTPServer and digest authentication
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
mrdebug · 2024-03-06 17:22

Hi, I need to implement server side the digest authentication. Can
someone post an example on how to implement the component
IdHTTPServer, server side? Many thanks

----------------------------------------------------------------------
Remy Lebeau · 2024-03-09 21:01

At this time, TIdHTTPServer does not natively implement any
authentications other than BASIC.  If you want to use a different
authentication, you have to implement it yourself, by parsing the
client's authentication data in the OnParseAuthentication event, and
validating the client's authentication data and populating
TIdResponseInfo with any necessary server authentication data in the
OnCommand... events.

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i procedure
TMyForm.IdHTTPServerParseAuthentication(AContext: TIdContext;  const
AAuthType, AAuthData: String; var VUsername, VPassword: String;  var
VHandled: Boolean);begin  if TextIsSame(AAuthType, 'Digest') then 
begin    // parse AAuthData, populate VUsername and VPassword as
needed...    VHandled := True;  end;end; procedure
TMyForm.IdHTTPServerCommandGet(AContext: TIdContext;    ARequestInfo:
TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);begin  ...  if
ARequestInfo.AuthExists then  begin    // use ARequestInfo.AuthType,
ARequestInfo.AuthUsername,    // and ARequestInfo.AuthPassword as
needed...  end;  if Digest Authentication is needed then  begin   
AResponseInfo.ResponseNo := 401;   
AResponseInfo.WWWAuthenticate.Add('Digest ...');    // or:    //
AResponseInfo.CustomHeaders.Values['WWW-Authenticate'] := 'Digest
...';    Exit;  end;  ...end;

----------------------------------------------------------------------
mrdebug · 2024-03-10 07:57

Many thanks for your reply.
Now the client sends this header to server:

Authorization: Digest username="Admin", realm="", nonce="",
algorithm="MD5", uri="/Path",
response="dc9857e3e15a18babf11b71edbd68359"

I think I have to built a text with user id, password and a digest
text in order to obtain the same md5 algorithm.
How can I build it? Or how can I validate this header?

----------------------------------------------------------------------
Remy Lebeau · 2024-03-11 22:46

Quote from: mrdebug on March 10, 2024, 08:57:29 amNow the client sends
this header to server:

Authorization: Digest username="Admin", realm="", nonce="",
algorithm="MD5", uri="/Path",
response="dc9857e3e15a18babf11b71edbd68359"

All that data is available in the AAuthData parameter of the
OnParseAuthentication event.

Quote from: mrdebug on March 10, 2024, 08:57:29 amI think I have to
built a text with user id, password and a digest text in order to
obtain the same md5 algorithm.
How can I build it? Or how can I validate this header?

You have to parse and validate it yourself, following the rules of RFC
7616.  Indy does not provide a server-side framework for parsing
authentication (only client-side - see the TIdDigestAuthentication
class used by the TIdHTTP client).