Problem with authentication for the outbound leg ()

Asterisk AI
1

Setup

  • Asterisk 22.9.0, chan_pjsip, TCP transport (Docker: andrius/asterisk).
  • Acting as a B2BUA between a registration trunk and a cloud SIP provider
    (ElevenLabs, LiveKit-based) whose source IP is dynamic.
  • Goal: authenticate the provider’s inbound INVITEs (their agent dialling
    out) by digest username/password, so I don’t depend on their changing IP.

Problem

With identify_by=auth_username, the INVITE is challenged, the provider retries
with credentials, and Asterisk rejects it:

res_pjsip/pjsip_distributor.c: ... - Failed to authenticate
res_pjsip/pjsip_distributor.c: ... - No matching endpoint found after 5 tries

If I instead add a type=identify block with their current source IP and use
identify_by=ip, the exact same username/password authenticates and the call
completes normally.

What I’ve already verified

I took the nonce, cnonce, uri, qop, nc and response from the
authenticated INVITE and independently recomputed the MD5 digest:


HA1 = MD5(username:realm:password)      (realm = "asterisk")
HA2 = MD5("INVITE":uri)
response = MD5(HA1:nonce:nc:cnonce:qop:HA2)


The recomputed `response` **matches exactly** what the provider sends. So the
password, realm and hash are correct — Asterisk is rejecting a cryptographically
valid response, but **only** on the `auth_username` path.

Config

[global]
type=global
endpoint_identifier_order=ip,auth_username,username

[provider-auth]
type=auth
auth_type=userpass
username=REDACTED
realm=asterisk
password=REDACTED

[provider]
type=endpoint
context=from-provider
disallow=all
allow=ulaw,alaw,g722
auth=provider-auth
identify_by=auth_username      ; fails here; works if I use ip + a type=identify match
media_encryption=sdes
media_encryption_optimistic=yes
aors=provider

Question:
Is identify_by=auth_username supposed to work for authenticating inbound
INVITEs? Since the first INVITE has no Authorization header, it can’t be
identified by auth-username until after the challenge — is there a supported way
to make digest auth work here without relying on the source IP, or is IP-based
identification the recommended approach for a dynamic-IP provider? If
auth_username should work, what am I missing?

2

You need to provide the actual SIP traffic as well as the complete configuration. Without those, we’re guessing based on your own analysis.

3

You seem to have a very strange provider. Nearly every other provider won’t identify themselves.

Are their addresses really that random, or can you get them to specify valid blocks of addresses?

As I understand it, if any endpoint uses match by username, Asterisk will challenge for authentication for all endpoints that cannot be positively identified. (Possibly all endpoints.)