<div dir="auto">Hi Liviu,<div dir="auto">Ah, thanks, perfect, that totally makes sense, I will do it as you suggest!!! Pity I didn't figure that out myself :(</div><div dir="auto"><br></div><div dir="auto">Best regards,</div><div dir="auto">Yury.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 10 Apr 2023, 22:21 Liviu Chircu, <<a href="mailto:liviu@opensips.org">liviu@opensips.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div>On 10.04.2023 14:07, Yury Kirsanov
wrote:<br>
</div>
<blockquote type="cite">I'm
actually NOT using any type of DB, hence the problem, how do I
specify multiple hashes with $var(password) for different auth
types, as per the documentation?</blockquote>
<p><font face="monospace">I think there is a bit of confusion on the
"timings" when the multi-algorithm "xxx_challenge()" function is
used vs. the single-algorithm reply verification for the client
step. As such:</font></p>
<p><font face="monospace">* during the challenge step, you simply
invoke xxx_challenge(MD5, SHA256), to advertise multiple
challenge headers to the client<br>
* during the verification step, you are supposed to read the <b>$auth.alg</b>,
thus "learning" what the auth algorithm the client selected (<b>modern</b><b></b>
phone vs. <b>classic</b> phone, i.e. SHA256 or MD5), then<br>
populate <b>$var(password)</b><b> </b>with the
corresponding hash selected from your cache or database<br>
</font></p>
<p><font face="monospace">Hope this helps,<br>
</font></p>
<pre cols="72">--
Liviu Chircu
<a href="http://www.twitter.com/liviuchircu" target="_blank" rel="noreferrer">www.twitter.com/liviuchircu</a> | <a href="http://www.opensips-solutions.com" target="_blank" rel="noreferrer">www.opensips-solutions.com</a>
OpenSIPS Summit 2023 Houston, May 23-26 | <a href="http://www.opensips.org/events" target="_blank" rel="noreferrer">www.opensips.org/events</a></pre>
</div>
</blockquote></div>