Outbound authentication errors using pjsip

Asterisk Asterisk SIP
21

OK so now who is calling whom? What’s the local endpoint and the remote endpoint?
If 192.168.1.31 is involved, you can…

CLI> pjsip set logger host 192.168.1.31

to get a SIP trace of an attempt.

22

[Jan 29 21:50:39] WARNING[27892]: res_pjsip_outbound_authenticator_digest.c:178 digest_create_request_with_auth: Host: ‘192.168.1.31:5060’: Unable to create request with auth. No auth credentials for realm(s) ‘KFONE2’ in challenge.
[Jan 29 21:50:39] <— Transmitting SIP response (565 bytes) to UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] SIP/2.0 401 Unauthorized
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport=5060;received=192.168.1.31;branch=z9hG4bKPj9f29635e-8509-4674-9e33-b32a20835b87
[Jan 29 21:50:39] Call-ID: 6f9d8fdb-1b15-4bdf-b494-04ba489f998b
[Jan 29 21:50:39] From: sip:Brigitte@192.168.1.31;tag=a41d1ef8-72e4-4dc3-8809-5db672fc983a
[Jan 29 21:50:39] To: sip:1003@192.168.1.31;tag=z9hG4bKPj9f29635e-8509-4674-9e33-b32a20835b87
[Jan 29 21:50:39] CSeq: 12762 NOTIFY
[Jan 29 21:50:39] WWW-Authenticate: Digest realm=“KFONE2”,nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”,opaque=“6b8b850d6b008cbc”,algorithm=md5,qop=“auth”
[Jan 29 21:50:39] Server: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Content-Length: 0
[Jan 29 21:50:39]
[Jan 29 21:50:39]
[Jan 29 21:50:39] <— Received SIP response (565 bytes) from UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] SIP/2.0 401 Unauthorized
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport=5060;received=192.168.1.31;branch=z9hG4bKPj9f29635e-8509-4674-9e33-b32a20835b87
[Jan 29 21:50:39] Call-ID: 6f9d8fdb-1b15-4bdf-b494-04ba489f998b
[Jan 29 21:50:39] From: sip:Brigitte@192.168.1.31;tag=a41d1ef8-72e4-4dc3-8809-5db672fc983a
[Jan 29 21:50:39] To: sip:1003@192.168.1.31;tag=z9hG4bKPj9f29635e-8509-4674-9e33-b32a20835b87
[Jan 29 21:50:39] CSeq: 12762 NOTIFY
[Jan 29 21:50:39] WWW-Authenticate: Digest realm=“KFONE2”,nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”,opaque=“6b8b850d6b008cbc”,algorithm=md5,qop=“auth”
[Jan 29 21:50:39] Server: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Content-Length: 0
[Jan 29 21:50:39]
[Jan 29 21:50:39]
[Jan 29 21:50:39] WARNING[27892]: res_pjsip_outbound_authenticator_digest.c:178 digest_create_request_with_auth: Host: ‘192.168.1.31:5060’: Unable to create request with auth. No auth credentials for realm(s) ‘KFONE2’ in challenge.
[Jan 29 21:50:39] <— Transmitting SIP request (938 bytes) to UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] NOTIFY sip:1001@192.168.1.31:5060 SIP/2.0
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport;branch=z9hG4bKPj73007eb4-1f07-4822-bd06-c68e99a2b219
[Jan 29 21:50:39] From: sip:1001@192.168.1.31;tag=441da8e8-b4b5-4256-8207-126ebce1e6c2
[Jan 29 21:50:39] To: sip:1001@192.168.1.31
[Jan 29 21:50:39] Contact: sip:1001@192.168.1.31:5060
[Jan 29 21:50:39] Call-ID: c9afce89-ebf2-4087-9a3b-177008455c4b
[Jan 29 21:50:39] CSeq: 33625 NOTIFY
[Jan 29 21:50:39] Subscription-State: terminated
[Jan 29 21:50:39] Event: message-summary
[Jan 29 21:50:39] Allow-Events: presence, dialog, message-summary, refer
[Jan 29 21:50:39] Max-Forwards: 70
[Jan 29 21:50:39] User-Agent: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Authorization: Digest username=“PeteKirkham”, realm=“KFONE2”, nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”, uri=“sip:1001@192.168.1.31:5060”, response=“7843d034b25cc1c47303ebe76869e83c”, algorithm=md5, cnonce=“f57c2f56-e476-40e4-a33e-da206be1d875”, opaque=“79ef6e4f63c976fe”, qop=auth, nc=00000001
[Jan 29 21:50:39] Content-Type: application/simple-message-summary
[Jan 29 21:50:39] Content-Length: 49
[Jan 29 21:50:39]
[Jan 29 21:50:39] Messages-Waiting: yes
[Jan 29 21:50:39] Voice-Message: 6/0 (0/0)
[Jan 29 21:50:39]
[Jan 29 21:50:39] <— Received SIP request (938 bytes) from UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] NOTIFY sip:1001@192.168.1.31:5060 SIP/2.0
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport;branch=z9hG4bKPj73007eb4-1f07-4822-bd06-c68e99a2b219
[Jan 29 21:50:39] From: sip:1001@192.168.1.31;tag=441da8e8-b4b5-4256-8207-126ebce1e6c2
[Jan 29 21:50:39] To: sip:1001@192.168.1.31
[Jan 29 21:50:39] Contact: sip:1001@192.168.1.31:5060
[Jan 29 21:50:39] Call-ID: c9afce89-ebf2-4087-9a3b-177008455c4b
[Jan 29 21:50:39] CSeq: 33625 NOTIFY
[Jan 29 21:50:39] Subscription-State: terminated
[Jan 29 21:50:39] Event: message-summary
[Jan 29 21:50:39] Allow-Events: presence, dialog, message-summary, refer
[Jan 29 21:50:39] Max-Forwards: 70
[Jan 29 21:50:39] User-Agent: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Authorization: Digest username=“PeteKirkham”, realm=“KFONE2”, nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”, uri=“sip:1001@192.168.1.31:5060”, response=“7843d034b25cc1c47303ebe76869e83c”, algorithm=md5, cnonce=“f57c2f56-e476-40e4-a33e-da206be1d875”, opaque=“79ef6e4f63c976fe”, qop=auth, nc=00000001
[Jan 29 21:50:39] Content-Type: application/simple-message-summary
[Jan 29 21:50:39] Content-Length: 49
[Jan 29 21:50:39]
[Jan 29 21:50:39] Messages-Waiting: yes
[Jan 29 21:50:39] Voice-Message: 6/0 (0/0)
[Jan 29 21:50:39]
[Jan 29 21:50:39] <— Transmitting SIP response (568 bytes) to UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] SIP/2.0 401 Unauthorized
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport=5060;received=192.168.1.31;branch=z9hG4bKPjf521ae1d-4264-42d1-8edb-b3733c51ccad
[Jan 29 21:50:39] Call-ID: 85111ca7-afbc-4eee-9538-dd2a34fe0ce6
[Jan 29 21:50:39] From: sip:PeteKirkham@192.168.1.31;tag=09f78bfe-d42a-4a7f-82f1-1b1535eb3ba9
[Jan 29 21:50:39] To: sip:1001@192.168.1.31;tag=z9hG4bKPjf521ae1d-4264-42d1-8edb-b3733c51ccad
[Jan 29 21:50:39] CSeq: 19859 NOTIFY
[Jan 29 21:50:39] WWW-Authenticate: Digest realm=“KFONE2”,nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”,opaque=“5593cc877f2ef3bf”,algorithm=md5,qop=“auth”
[Jan 29 21:50:39] Server: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Content-Length: 0
[Jan 29 21:50:39]
[Jan 29 21:50:39]
[Jan 29 21:50:39] <— Received SIP response (568 bytes) from UDP:192.168.1.31:5060 —>
[Jan 29 21:50:39] SIP/2.0 401 Unauthorized
[Jan 29 21:50:39] Via: SIP/2.0/UDP 192.168.1.31:5060;rport=5060;received=192.168.1.31;branch=z9hG4bKPjf521ae1d-4264-42d1-8edb-b3733c51ccad
[Jan 29 21:50:39] Call-ID: 85111ca7-afbc-4eee-9538-dd2a34fe0ce6
[Jan 29 21:50:39] From: sip:PeteKirkham@192.168.1.31;tag=09f78bfe-d42a-4a7f-82f1-1b1535eb3ba9
[Jan 29 21:50:39] To: sip:1001@192.168.1.31;tag=z9hG4bKPjf521ae1d-4264-42d1-8edb-b3733c51ccad
[Jan 29 21:50:39] CSeq: 19859 NOTIFY
[Jan 29 21:50:39] WWW-Authenticate: Digest realm=“KFONE2”,nonce=“1548795039/a8e630cf79dc3f40f69e6c05c0677bd8”,opaque=“5593cc877f2ef3bf”,algorithm=md5,qop=“auth”
[Jan 29 21:50:39] Server: Asterisk PBX 16.1.1
[Jan 29 21:50:39] Content-Length: 0
[Jan 29 21:50:39]
[Jan 29 21:50:39]
[Jan 29 21:50:39] WARNING[27892]: res_pjsip_outbound_authenticator_digest.c:178 digest_create_request_with_auth: Host: ‘192.168.1.31:5060’: Unable to create request with auth. No auth credentials for realm(s) ‘KFONE2’ in challenge.

23

You appear to be sending a SIP NOTIFY with voicemail information to… yourself…

Is 192.168.1.31 the IP address of Asterisk? If so is there a reason you set a contact with that information?

24

Hi. As you’ve probably realised, this is a test system which has evolved from the earliest versions of Asterisk. It contains lots of features and I try to keep it up to date at least with the LTS versions if not better.

Yes the address indicated is the address of the Asterisk server and of ejabberd too. I’m using two X-lite softphones on 192.168.1.16 and 192.168.1.13. I may well have called myself but that’s just one way of testing like sending yourself a mail to test your mail client.

This still doesn’t answer the question about what is provoking these error messages about the default realm KFONE2 which I have configured knowingly since it’s a bit more obvious than the “asterisk” which would be used if I didn’t configure anything at all.

Does the auth table have to have values which are related to realms as opposed to the realm entry for the endpoint auths which you suggested I should set to an empty string as opposed to NULL. I have also tried localhost and 192.168.1.31 for them.

Best regards, Pete

25

It’s really hard to follow what’s going on from the scenario in the packet trace. Can you provide one that’s not a “call yourself” scenario? It’s ok if the same asterisk is calling itself but if you can do it with 2 different endpoints, that’d help.

The last configuration of the PeteKirkham auth I see has the realm empty. Did you try setting that to KFONE2?

What I’d try…
In [global] remove the default_realm.
Set up an end point for the outbound call with an outbound_auth that does NOT have realm set.
Set up another endpoint for the inbound call with an auth that DOES have realm set.

Make and capture 1 call.

Get that working first then lets go from there.

1 Like
26

I have found the origin of the problem, it’s the contact field in the AOR which I have now set to NULL and there are no more error messages.
I can’t say that the documentation in the wiki here: [https://wiki.asterisk.org/wiki/display/AST/PJSIP+Configuration+Sections+and+Relationships](http://The page in the wiki) explained things enough but that can be said about a lot of the documentation.
So things are back on track.
Thanks for your help.

27

Isn’t that what Josh pointed out at Outbound authentication errors using pjsip - #23 by jcolp ?

28

No John it isn’t what Joshua pointed out. He was referring to the realm field not the contact one.
Anyway that problem’s solved onto the next one!
Regards

29

Hello, I am with the same issue:

res_pjsip_outbound_authenticator_digest.c:178 digest_create_request_with_auth_from_old: Host: 'xx.166.xx.15:5060': Unable to create request with auth. No auth credentials for realm(s) 'handphone' in challenge.

Tried to set contact to null and didn’t work. Realm is null.

Can anyone help?

30

I have resolved the same type of warning by setting the realm in ps_auths to * when using realtime asterisk.