First, I've forwarded this to grand stream directly but I have no idea how good their support is, I want to see if anyone can confirm my diagnostics and tell me if other grand stream phones have a different authentication flow for phonebook.xml
If grand stream does not fix their firmware fairly quickly, how hard is it to enable basic http auth and how much of a security issue is it, if using https?
example log files of the 4 tests. (I have substituted IP addresses for 1.2.3.4 and username for web_auth_user in logs as well as the MAC address for macaddress)
log1 cfg provisioning.alwaysAuthenticateBeforeChallenge off (works)
log 2 cfg provisioning.alwaysAuthenticateBeforeChallenge on (does not work)
log 3 phonebook provision test from laptop (works)
log 4 phonebook provision from phone (does not work, always authenticate option not possible to disable)
in log 2 and log 4, you'll see two 401 unauthorized for two different config filename possibilities. You'll also see the 3rd column in both is web_auth_user. This is the username set in "phonebook.download.username" My understanding is this 3rd column is the basic http auth username.
In log 1 and 3, both requests begin with 401, get resent using digest authentication and on the second line end with successful 200 status. neither line has a username in column 3. my understanding is this indicates http digest authentication.
I don't believe I'm missing any settings available to end users. I am not sure if basic http auth is possible or advised. however, I know that it's not possible to download the phonebook.xml on fusionpbx with the wp825 using http auth enabled out of the box.
If grand stream does not fix their firmware fairly quickly, how hard is it to enable basic http auth and how much of a security issue is it, if using https?
example log files of the 4 tests. (I have substituted IP addresses for 1.2.3.4 and username for web_auth_user in logs as well as the MAC address for macaddress)
log1 cfg provisioning.alwaysAuthenticateBeforeChallenge off (works)
log 2 cfg provisioning.alwaysAuthenticateBeforeChallenge on (does not work)
log 3 phonebook provision test from laptop (works)
log 4 phonebook provision from phone (does not work, always authenticate option not possible to disable)
in log 2 and log 4, you'll see two 401 unauthorized for two different config filename possibilities. You'll also see the 3rd column in both is web_auth_user. This is the username set in "phonebook.download.username" My understanding is this 3rd column is the basic http auth username.
In log 1 and 3, both requests begin with 401, get resent using digest authentication and on the second line end with successful 200 status. neither line has a username in column 3. my understanding is this indicates http digest authentication.
I don't believe I'm missing any settings available to end users. I am not sure if basic http auth is possible or advised. however, I know that it's not possible to download the phonebook.xml on fusionpbx with the wp825 using http auth enabled out of the box.