803119 - Chat module will not authenticate to Jabber server with error message "Error: The server only supports authentication by sending the password in cleartext"

Status: RESOLVED WORKSFORME

(Thunderbird :: Instant Messaging, defect)

Description

[Keith Howard]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:16.0) Gecko/20100101 Firefox/16.0
Build ID: 20121010144125

Steps to reproduce:

Configure xmpp (jabber) account to authenticate with plain/clear text.
Specifically, in the 'Properties' dialog, under 'Connection Security' drop-down box, 'Allow sending the password unencrypted' is selected.


Actual results:

I received this error:
"Error: The server only supports authentication by sending the password in cleartext"
Please note:
This only occurred (for me) when I attempted to connect to my ejabber server using LDAP authentication backend, while other IM clients such as Exodus and Pandion connect fine.  I tried setting my passwords in LDAP to cleartext to no avail.


Expected results:

Successful logon to xmpp server.

Comment 1

[Patrick Cloke [:clokep]]

(In reply to Keith Howard from comment #0)
> "Error: The server only supports authentication by sending the password in
> cleartext"
We throw this error when attempting to send a password without an SSL connection and without explicitly allowing a password to be sent in the clear (this is bad behavior!). Can you not turn on SSL/TLS?

> I tried setting my passwords in LDAP to cleartext to
> no avail.
What does this mean?

Did you set the "Connection security" option of your XMPP account to "Allow sending the password unencrypted"?

Comment 2

[Patrick Cloke [:clokep]]

So seems like this was broken until recently and was fixed as part of bug 789745, which should be in Thunderbird 17.

If this works for you in a Thunderbird 17 beta then we can resolve this.

Comment 3

[Florian Quèze [:florian]]

For future reference, the fix is https://hg.mozilla.org/comm-central/rev/c4143a904267#l1.52

Comment 4

[Keith Howard]

(In reply to Patrick Cloke [:clokep] from comment #1)
> (In reply to Keith Howard from comment #0)
> > "Error: The server only supports authentication by sending the password in
> > cleartext"
> We throw this error when attempting to send a password without an SSL
> connection and without explicitly allowing a password to be sent in the
> clear (this is bad behavior!). Can you not turn on SSL/TLS?
> 
> > I tried setting my passwords in LDAP to cleartext to
> > no avail.
> What does this mean?
> 
> Did you set the "Connection security" option of your XMPP account to "Allow
> sending the password unencrypted"?

Patrick,

This is not YET a production effort.  

The first thing anyone should try is an UNENCRYPTED connection FIRST, and THEN after successful connection, add on extra layers such as SSL.  Why over complicate the process (of trouble-shooting or implementation) if you can not connect with the lowest common settings (clear text) first?  Furthermore, I CAN successfully connect WITHOUT SSL using eJabberd's builtin (internal) authentication.  Do you understand?

Passwords can be hashed (SHA,MD5, etc...) and stored in LDAP.  What I mean is that I removed any passwords that were hashed and recreated them as clear text as part of the trouble-shooting process.  Is that clear?

Patrick, this is not meant to be rude, however, please read my post more carefully as your answer to your last question is already answered in my original post!

Regarding your second post, I will try TB 17 and report back; Thank you kindly!
Keith

Comment 5

[Keith Howard]

(In reply to Florian Quèze [:florian] [:flo] from comment #3)
> For future reference, the fix is
> https://hg.mozilla.org/comm-central/rev/c4143a904267#l1.52

Florian,
I visited the link you provided, however, I do not understand what I am supposed to do.
Could you provide more information, please?
Thanks.
Keith

Comment 6

[Florian Quèze [:florian]]

(In reply to Keith Howard from comment #5)
> (In reply to Florian Quèze [:florian] [:flo] from comment #3)
> > For future reference, the fix is
> > https://hg.mozilla.org/comm-central/rev/c4143a904267#l1.52
> 
> Florian,
> I visited the link you provided,

I provided this link just for developpers reading this report who could be curious to know what was wrong / how we fixed the bug. There's nothing you need to do with this link.

> however, I do not understand what I am
> supposed to do.

If you want to move things forward, you can confirm that you can successfully connect when using a Thunderbird 17 beta :-).

Comment 7

[Patrick Cloke [:clokep]]

(In reply to Keith Howard from comment #4)
> This is not YET a production effort.  
That was not clear from the information provided. There's no need to lecture on the practices of getting a system up and running.

> Patrick, this is not meant to be rude, however, please read my post more
> carefully as your answer to your last question is already answered in my
> original post!
Please read over the Bugzilla etiquette guidelines. Sorry, I misread your first post.

> Regarding your second post, I will try TB 17 and report back; Thank you
> kindly!
Please reopen this if it doesn't work with Thunderbird 17.

Comment 8

[Keith Howard]

Florian,

It does indeed work in TB 17!

Thank You!

Keith