[Spce-user] "authentication failed, stale nonce"

[John Murray]

Thanks Andrew,

I'm trying to use SPCE as an SBC and now have the polycom registering with
the SPCE but I want it to also want it to register with my main proxy.

I have completed peer_auth_user, peer_auth_pass and the ip address of my
main proxy in peer_auth_realm. Does this need to match something in Peerings
and if so which field.

I currently get:

INFO: <script>: IP authorization not provisioned, allow registration -
M=REGISTER R=sip:skyracktelecom.com:5060

So the handset gets locally registered but not passed on to the main proxy.

Regards

John

-----Original Message-----
From: Andrew Pogrebennyk [mailto:apogrebennyk at sipwise.com] 
Sent: 24 May 2012 10:28
To: John Murray
Cc: spce-user at lists.sipwise.com
Subject: Re: [Spce-user] "authentication failed, stale nonce"

John,
this message does not necessarily mean "stale nonce", it could mean a wrong
username/password as well in this kamailio version.
There is a php script you can use to verify digest-authentication:
http://code.google.com/p/variman/source/browse/website/trunk/docroot/support
/digest.php

But it seems that Polycom is using wrong username: SkyrackTelecom instead of
01133204503. This won't work definitely. I don't have much experience with
Polycom to advice you a specific setting however..

On 05/23/2012 10:13 PM, John Murray wrote:
> Hello,
> 
>  
> 
> I am trying to register a polycom handset onto SPCE but am getting 
> 'stale nonce':
> 
>  
> 
> May 23 20:41:12 switch /usr/sbin/kamailio[17680]: INFO: <script>: WWW 
> authentication failed, invalid user - M=REGISTER 
> R=sip:skyracktelecom.com:5060;transport=tcp
> F=sip:01133204503 at skyracktelecom.com
> T=sip:01133204503 at skyracktelecom.com IP=x.x.x.x:42700 (127.0.0.1:5060)
> ID=a51913f1-d366a618-ec1dd8ab at 192.168.42.175
> 
> May 23 20:41:12 switch /usr/sbin/kamailio[17683]: INFO: <script>: WWW 
> authentication failed, stale nonce - M=REGISTER 
> R=sip:skyracktelecom.com:5060;transport=tcp
> F=sip:01133204503 at skyracktelecom.com
> T=sip:01133204503 at skyracktelecom.com IP=x.x.x.x:42700 (127.0.0.1:5060)
> ID=a51913f1-d366a618-ec1dd8ab at 192.168.42.175
> <mailto:ID=a51913f1-d366a618-ec1dd8ab at 192.168.42.175>
> 
>  
> 
> The UA replies to the 401:
> 
>  
> 
> WWW-Authenticate: Digest realm="skyracktelecom.com", 
> nonce="T707wU+9OpVsvS95lGr/Vwcdfyxzc7Zz".
> 
>  
> 
> With:
> 
>  
> 
> Authorization: Digest username="SkyrackTelecom", 
> realm="skyracktelecom.com", nonce="T707wU+9OpVsvS95lGr/Vwcdfyxzc7Zz",
> uri="sip:skyracktelecom.com:5060;transport=tcp",
> response="1d5477c0c2a7d2d49bef3cd9eee65e12", algorithm=MD5.
> 
>  
> 
> I don't see anywhere against the subscriber config to add the 'username'
> information that the UA is putting into the Digest response. Does this 
> matter?
> 
>  
> 
> Best regards
> 
>  
> 
> John
>