Merge pull request #3113 from dwd/sasl-2-clean

OF-2535: Add support for XEP-0388: Extensible SASL Profile (SASL2)

Author: akrherz

.github/actions/conversationstest-action/action.yml

@@ -32,7 +32,7 @@ runs:
         sudo udevadm trigger --name-match=kvm
 
     - name: Cache Conversations APK
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: conversations.apk
         key: conversations-apk-4217303 # Update this number at the same time as the version in run-tests.sh

.github/workflows/continuous-integration-workflow.yml

@@ -344,9 +344,9 @@ jobs:
           - name: demoboot
             maestro-tags: demoboot
             config-file: '' # Use default demoboot config
-          #- name: sasl2
-          #  maestro-tags: sasl2
-          #  config-file: build/ci/conversations/configs/sasl2.xml
+          - name: sasl2
+            maestro-tags: sasl2
+            config-file: build/ci/conversations/configs/sasl2.xml
 
     steps:
       - name: Checkout local actions and test flows # Do this _before_ untarring the distribution, as the checkout will empty the directory prior to the checkout!
@@ -371,12 +371,19 @@ jobs:
         with:
           logLevel: debug
       - name: Run Conversations tests (${{ matrix.name }})
+        id: runConversationsTests
         uses: ./.github/actions/conversationstest-action
         with:
           includeTags: ${{ matrix.maestro-tags }}
       - name: Stop CI server
         if: ${{ always() && steps.startCIServer.conclusion == 'success' }}
         uses: ./.github/actions/stopserver-action
+      - name: Upload Openfire logs on test failure
+        if: ${{ failure() && steps.runConversationsTests.conclusion == 'failure' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: Conversations Test (${{ matrix.name }}) Openfire logs
+          path: distribution/target/distribution-base/logs/openfire.log
 
 
   should-do-database-tests:

build/ci/conversations/configs/sasl2.xml

@@ -75,8 +75,10 @@
           </user3>
       </users>
   </autosetup>
-  <properties>
-    <!-- TODO: Add SASL2-enabling system properties here. -->
-    <!-- These are likely defined in the SASL2 plugin or as xmpp.auth.* core properties. -->
-  </properties>
+  <!-- Enable SASL2 (xmpp.auth.sasl2). TLS is required too, but is satisfied by the CI server's self-signed certificate. -->
+  <xmpp>
+    <auth>
+      <sasl2>true</sasl2>
+    </auth>
+  </xmpp>
 </jive>

build/ci/conversations/flows/sasl2.yaml

@@ -47,7 +47,20 @@ onFlowStart:
       - assertVisible: "Let app always run in background?"
       - tapOn: "Allow"
 
+# Using SASL2
 - runScript: 
     file: scripts/checkForLogs.js
     env:
         PATTERN: .*SASL 2.0 authorization identifier was jane@example.org
+
+# Using Channel Binding
+- runScript:
+      file: scripts/checkForLogs.js
+      env:
+          PATTERN: 'jane@example\.org.*Authenticating with SASL_2\/[A-Z0-9-]+-PLUS'
+
+# Authentication successful
+- runScript:
+      file: scripts/checkForLogs.js
+      env:
+          PATTERN: 'jane@example\.org.*logged in \(using SASL_2\)'

documentation/openfire.doap

@@ -417,6 +417,11 @@
                 <xmpp:version>1.0.0</xmpp:version>
             </xmpp:SupportedXep>
         </implements>
+        <implements>
+            <xmpp:SupportedXep>
+                <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0388.html"/>
+            </xmpp:SupportedXep>
+        </implements>
         <implements>
             <xmpp:SupportedXep>
                 <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0410.html"/>

documentation/protocol-support.html

@@ -397,6 +397,7 @@ <h2>List of other XEPs Supported</h2>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0289.html">XEP-0289</a>: Federated MUC for Constrained Environments</td></tr>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0321.html">XEP-0321</a>: Remote Roster Management [<a href="#fn15">15</a>]</td></tr>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0359.html">XEP-0359</a>: Unique and Stable Stanza IDs</td></tr>
+            <tr><td><a href="https://www.xmpp.org/extensions/xep-0388.html">XEP-0388</a>: XEP-0388: Extensible SASL Profile (SASL2)</td></tr>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0398.html">XEP-0398</a>: User Avatar to vCard-Based Avatars Conversion</td></tr>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0433.html">XEP-0433</a>: Extended Channel Search</td></tr>
             <tr><td><a href="https://www.xmpp.org/extensions/xep-0440.html">XEP-0440</a>: SASL Channel-Binding Type Capability</td></tr>

i18n/src/main/resources/openfire_i18n.properties

@@ -1315,6 +1315,8 @@ system_property.xmpp.auth.anonymous=Set to true to allow anonymous login, otherw
 system_property.xmpp.auth.external.client.skip-cert-revalidation=Set to true to avoid validation of the client-provided PKIX certificate (for mutual authentication) other than the validation that happens when the TLS session is established.
 system_property.xmpp.auth.external.server.require-authzid=Require the peer to provide an authorization identity through SASL (typically in the Initial Response) when authenticating an inbound S2S connection that uses the EXTERNAL SASL mechanism. This is not required by the XMPP protocol specification, but it was required by Openfire versions prior to release 4.8.0. This configuration option is added to allow for backwards compatibility.
 system_property.xmpp.auth.external.server.skip-sending-authzid=Send an authorization identity in the Initial Response when attempting to authenticate using the SASL EXTERNAL mechanism with a remote XMPP domain. Sending the authzid in this manner is not required by the XMPP protocol specification, but is recommended in XEP-0178 for compatibility with older server implementations.
+system_property.xmpp.auth.sasl2=Enables support for SASL2 authentication (XEP-0388)
+system_property.xmpp.auth.sasl2.require-tls=Require TLS in order to authenticate with SASL2
 system_property.xmpp.auth.ssl.default-trustmanager-impl=The class to use as the default TLS TrustManager (which checks certificates from peers).
 system_property.xmpp.client.csi.enabled=Controls if Client State Indication (XEP-0352) functionality is supported by Openfire.
 system_property.xmpp.client.csi.delay.enabled=Determines if 'unimportant' stanzas are delayed for a client that is inactive.

xmppserver/src/main/java/org/jivesoftware/openfire/SessionPacketRouter.java

@@ -59,7 +59,7 @@ public void route(Element wrappedElement)
             throws UnknownStanzaException {
         String tag = wrappedElement.getName();
         if ("auth".equals(tag) || "response".equals(tag)) {
-            SASLAuthentication.handle(session, wrappedElement);
+            SASLAuthentication.handle(session, wrappedElement, false);
         }
         else if ("iq".equals(tag)) {
             route(getIQ(wrappedElement));

xmppserver/src/main/java/org/jivesoftware/openfire/http/HttpSession.java

@@ -227,9 +227,9 @@ public List<Element> getAvailableStreamFeatures() {
 
         // If authentication has not happened yet, include available authentication mechanisms.
         if (getAuthToken() == null) {
-            final Element sasl = SASLAuthentication.getSASLMechanismsElement(this);
-            if (sasl != null) {
-                elements.add(sasl);
+            final List<Element> mechanisms = SASLAuthentication.getSASLMechanisms(this);
+            for (Element mechanism : mechanisms) {
+                elements.add(mechanism);
             }
         }