RTSP digest authentication not working for ONVIF metadata streaming

[xtrdustin]

I'm trying to connect our new RTSP client code to get a metadata feed but having some problems with authentication.

When I send a SETUP request, I initially get a 401 Unauthorized response, as expected, and so I resend the request with added Authorzation header, with a digest computed from the realm and nonce values provided by the server. However. I always still get a 401 Unauthorized response.

Can you confirm that this is the correct algorithm to use to compute the "response" field of the RTSP digest?

HA1 = MD5(username:realm:password)
HA2 = MD5(method:digestURI)
response = MD5(HA1:nonce:HA2)

Or is there anything else you think I might be doing wrong?

Thanks in advance!

---

Here's an example session:

Request:

SETUP rtsp://<server ip>/onvif-media/media.amp?profile=metadata&sessiontimeout=60&streamtype=unicast RTSP/1.0
CSeq: 0
Transport: RTP/AVP/TCP;unicast;interleaved=0

Response:

RTSP/1.0 401 Unauthorized
CSeq: 0
WWW-Authenticate: Digest realm="AXIS_WS_B8A44F212011", nonce="0005491fY94310767b8eef1e39aca6c2524b0a62300fac0", stale=FALSE
Server: GStreamer RTSP server
Date: Tue, 25 Oct 2022 13:40:15 GMT

Resending Request:

SETUP rtsp://<server ip>/onvif-media/media.amp?profile=metadata&sessiontimeout=60&streamtype=unicast RTSP/1.0
Authorization: Digest username="onviftest2", realm="AXIS_WS_B8A44F212011", nonce="0005491fY94310767b8eef1e39aca6c2524b0a62300fac0", uri="rtsp://<server ip>/onvif-media/media.amp?profile=metadata&sessiontimeout=60&streamtype=unicast", response="<response computed from above algorithm>"
CSeq: 1
Transport: RTP/AVP/TCP;unicast;interleaved=0

Second Response:

RTSP/1.0 401 Unauthorized
CSeq: 1
WWW-Authenticate: Digest realm="AXIS_WS_B8A44F212011", nonce="0005491fY115668f35fb9a2b316b8c554c90b38aed8aa40", stale=FALSE
Server: GStreamer RTSP server
Date: Tue, 25 Oct 2022 13:40:16 GMT

[xtrdustin]

I opened a helpdesk ticket (Case 02024790) for this. I guess it's an "ADP Partner program" ticket, but I can't tell. I do want to go through the proper channels, but we also have to lend the camera to another team at some point in the next couple days, so I'm hoping I can at least start getting a metadata feed by then, and capture some data from it, so that I can work on consuming the data.

[haichaoji123]

have you enabled the ONVIF of the camera? defautly, onvif is disabled and you need 1. create an onvif user 2. in settings-system- plain config - webservice- UsernameToken, uncheck the "Enable replay attack protection" and save.

[xtrdustin]

Hi @haichaoji123,

Yes, we've been using ONVIF, and we did initially have some trouble with SOAP authentication due to replay attack protection. This was a problem with the RTSP part of the ONVIF metadata streaming though.

However, we did figure it out. There was a bug in my code that was omitting 0's from hex strings. So something like 00 would be emitted as just 0. So when I built the digest values, this was making the digest incorrect. After fixing that, it seems to be working now. Definitely streaming something, so hopefully it's streaming what I need (once I parse it).

[xtrdustin]

Copying from other thread so I can mark it as the answer: "There was a bug in my code that was omitting 0's from hex strings. So something like 00 would be emitted as just 0. So when I built the digest values, this was making the digest incorrect. After fixing that, it seems to be working now. Definitely streaming something, so hopefully it's streaming what I need (once I parse it)."