[solved] Digest authentication on MKR Wifi 1010 (ESP32)

Projects Programming
1

Hey guys,
i spend this whole day but didn't get this running. so this is my call for help :).
For my project, i have to send xml-commands to a other wifi device.
everything works fine when i send the command using curl:

curl -anyauth -d@off.xml http://admin:11115555@192.168.1.66:10001/control.cgi

in the next step, i tried to reproduce this in my sketch using httpclient:

#include <ArduinoHttpClient.h>
...
HttpClient switchConnection = HttpClient(wificonnection, switchAdress, switchPort);
Serial.print("Sending Auth...");
switchConnection.sendBasicAuth("admin", "11115555");
Serial.print("Sending ommand...");
switchConnection.post("control.cgi", "Content-type: application/x-www-form-urlencoded", command);
ResponseCode(switchConnection);

but i get a 401 Unauthorized- error, because the device requesting a "Digest" authentication.

is there a way to do this authentication with the MKR Wifi 1010?
do i need another board? because in the end, the auth is just software.

thanks in advance!

2

https://forum.arduino.cc/index.php?topic=553420.msg3791490#msg3791490

3

Thanks, i already had a look to this post, but well...not close enougth :/.

I already wrote my own implementation.

It's pretty hacky and it's made for my requirements but maybe it will help someone, someday:

#include <ArduinoHttpClient.h>
#include <MD5.h>
HttpClient client = HttpClient(wifiConnection, adress, port);
...
bool HttpSendDigest(String uri, String user, String password, String data)
{

  //Serial.println("HttpSendDigest::POST request");
  client.beginRequest();
  client.post(uri,"application/x-www-form-urlencoded",data);
  client.endRequest();


  String header ="";
  // read the status code and body of the response
  int statusCode = client.responseStatusCode();
  if (client.headerAvailable()){
    while(!client.endOfHeadersReached()){
      header = header + char(client.readHeader());
    }
  }
  String headerName = client.readHeaderName();
  String headerValue = client.readHeaderValue();
  String response = client.responseBody();
  /*
  Serial.println("HttpSendDigest::Headername: "+ headerName);
  Serial.println("HttpSendDigest::Headervalue: "+ headerValue);
  Serial.println("HttpSendDigest::header: ");
  Serial.println(header);
  Serial.print("HttpSendDigest::statuscode: ");
  Serial.println(statusCode);
  Serial.println("HttpSendDigest::response: ");
  Serial.println(response);
  */

  if (statusCode == 401 && headerName.equalsIgnoreCase("WWW-Authenticate"))
  {
      //Serial.println("HttpSendDigest::401+WWW-Authenticate detected");  
      String AuthMethod = headerValue.substring(0,headerValue.indexOf(' '));
      String realm = strGetValue(headerValue,"realm=\"","\"");
      String nonce = strGetValue(headerValue,"nonce=\"","\"");
      String qop = strGetValue(headerValue,"qop=\"","\"");
      /*
      Serial.println("HttpSendDigest::AuthMethod: "+AuthMethod);  
      Serial.println("HttpSendDigest::realm: "+realm);  
      Serial.println("HttpSendDigest::nonce: "+nonce);  
      Serial.println("HttpSendDigest::qop: "+qop);  
      */
      //Serial.print("HttpSendDigest::Calculate HA1...");  
      String HA1 = calcMD5(user+":"+realm+":"+password);
      //Serial.println(HA1);  

      //Serial.print("HttpSendDigest::Calculate HA2...");  
      String HA2 = calcMD5("POST:"+uri);
      //Serial.println(HA2);  

      String cnonce = String(random(8556822323));
      //Serial.println("HttpSendDigest::cnonce: "+cnonce);  
      //Serial.println("HttpSendDigest::Calculate authResponse...");  
      String authResponse =calcMD5(HA1+":"+nonce+":"+"00000001"+":"+cnonce+":"+qop+":"+HA2); //MD5(HA1:nonce:nonceCount:cnonce:qop:HA2)
      //Serial.println("HttpSendDigest::authResponse: "+authResponse);       

      String authHeaderString = "Authorization: Digest username=\"" + user +
                        "\",realm=\"" + realm +
                        "\",nonce=\"" + nonce +
                        "\",uri=\"" + uri +
                        "\",cnonce=\"" + cnonce +
                        "\",qop=auth, nc=00000001, response=\"" + authResponse + "\"";//\r\n";
      //Serial.println("HttpSendDigest::authHeaderString: "+authHeaderString);   
      
      //Serial.println("HttpSendDigest::---auth post---");
      client.beginRequest();
      client.post(uri);
      client.sendHeader(authHeaderString);
      client.sendHeader(HTTP_HEADER_CONTENT_TYPE, "application/x-www-form-urlencoded");
      client.sendHeader(HTTP_HEADER_CONTENT_LENGTH, data.length());
      client.beginBody();
      client.print(data);
      client.endRequest();
      
      //Serial.println("HttpSendDigest::---authresponse---");
      header ="";
      // read the status code and body of the response
      statusCode = client.responseStatusCode();
      if (client.headerAvailable()){
        while(!client.endOfHeadersReached()){
          header = header + char(client.readHeader());
        }
      }

      headerName = client.readHeaderName();
      headerValue = client.readHeaderValue();
      response = client.responseBody();
      /*
      Serial.println("HttpSendDigest::Headername: "+ headerName);
      Serial.println("HttpSendDigest::Headervalue: "+ headerValue);
      Serial.println("HttpSendDigest::header: ");
      Serial.println(header);
      Serial.print("HttpSendDigest::statuscode: ");
      Serial.println(statusCode);
      Serial.println("HttpSendDigest::response: ");
      Serial.println(response); 
      */
  }
  if (statusCode==200)
  {
    return true;  
  }
  else
  {
    return false; 
  }
  
}

you can call it like this:

HttpSendDigest("/command.cgi",user,password,dataString)