strcpy not acting as expected.

You can skip the malloc() calls if you declare your strings as arrays not pointers:

char aOneString[sizeof(username) + sizeof(realm) + sizeof(password) + 3];
char aTwoString[sizeof(method) + sizeof(uri) + 2];

You can also simplify the concatenation code (whether is saves memory I don't know):

  strcpy(aOneString, username);
  strcat(aOneString, ":");  
  strcat(aOneString, realm);  
  strcat(aOneString, ":");  
  strcat(aOneString, password);

would become:

  sprintf(aOneString, "%s:%s:%s",username,realm,password); //where the %s is replaced by the corresponding string