Programming Jabber

Choosing the Authentication Method

Now that we know a little bit about the authentication methods, let’s jump back to the initial IQ-get query in Example 7-3:

SEND: <iq type='get'>
        <query xmlns='jabber:iq:auth'>
          <username>dj</username>
        </query>
      </iq>

RECV: <iq type='result'>
        <query xmlns='jabber:iq:auth'>
          <username>dj</username>
          <password/>
          <digest/>
          <sequence>496</sequence>
          <token>3B2DEEC0</token>
          <resource/>
        </query>
      </iq>

What we’re actually seeing here is the result of the authentication modules announcing their readiness to authenticate the user dj. The query is passed to each of the modules. mod_auth_plain announces its readiness by inserting the <password/> flag, mod_auth_digest does the same with the <digest/> flag, and mod_auth_0k inserts the <sequence/> and <token/> tags and values, which is what the client will need if it wishes to authenticate using the zero-knowledge method. The <resource/> tag, which is required in any authentication, is finally added before the result is returned.

This way, the IQ-result can convey which authentication methods are available; if the mod_auth_plain and mod_auth_digest modules were to be commented out in the module load directive list, as we saw earlier, then the IQ-result would look like this without the <password/> or <digest/> tags:

RECV: <iq type='result'>
        <query xmlns='jabber:iq:auth'>
          <username>dj</username>
          <sequence>496</sequence>
          <token>3B2DEEC0</token>
          <resource/>
        </query>
      </iq>

Note

At the beginning of this section, ...