Dynamic ticket authenticator: unauthorized user causes crossbario error

[BramVader]

I made an IWampRpcOperation for the authenticator according to the example. My Invoke-method looks like:

public IWampCancellableInvocation Invoke<TMessage>(IWampRawRpcOperationRouterCallback caller, IWampFormatter<TMessage> formatter, InvocationDetails details, TMessage[] arguments, IDictionary<string, TMessage> argumentsKeywords)
{
    if (arguments.Length >= 3)
    {
        string realm = formatter.Deserialize<string>(arguments[0]);
        string username = formatter.Deserialize<string>(arguments[1]);
        JObject jObject = formatter.Deserialize<JObject>(arguments[2]);
        long session = jObject["session"].Value<long>();
        string ticket = jObject["ticket"].Value<string>();

        if (username == "joe" && ticket == "secret!!!")
        {
            caller.Result(null, new YieldOptions(), new[] { (JToken)"anonymous" });
        }
        else
        {
            // Causes crossbario error:
            throw new WampException(WampErrors.NotAuthorized);

            // Causes crossbario error as well:
            Dictionary<string, object> dummyDetails = new Dictionary<string, object>();
            caller.Error(WampObjectFormatter.Value, dummyDetails, "wamp.error.not_authorized", new object[] { "Unauthorized" });
        }
    }
    else
    {
        Dictionary<string, object> dummyDetails = new Dictionary<string, object>();
        caller.Error(WampObjectFormatter.Value, dummyDetails, "wamp.error.runtime_error", new object[] { "Expected parameters" });
    }
    return null;
}

This causes the following error in the crossbario router:

2018-03-29T22:57:25+0000 [Router         15] Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/autobahn/wamp/websocket.py", line 88, in onMessage
    for msg in self._serializer.unserialize(payload, isBinary):
  File "/usr/local/lib/python3.6/site-packages/autobahn/wamp/serializer.py", line 128, in unserialize
    raise ProtocolError("invalid WAMP message type {0}".format(message_type))
autobahn.wamp.exception.ProtocolError: invalid WAMP message type -404

2018-03-29T22:57:25+0000 [Router         15] Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/autobahn/wamp/websocket.py", line 88, in onMessage
    for msg in self._serializer.unserialize(payload, isBinary):
  File "/usr/local/lib/python3.6/site-packages/autobahn/wamp/serializer.py", line 128, in unserialize
    raise ProtocolError("invalid WAMP message type {0}".format(message_type))
autobahn.wamp.exception.ProtocolError: invalid WAMP message type -404

This messageType -404 refers to the enum-value WampMessageType.Unknown, because WampMethodInfo.cs is about a Dispose-method instead of the expected IWampError<TMessage>.Error-method which has an [WampHandler(WampMessageType.v2Error)]-attribute.

Is this a bug, or am I doing something wrong here?

[darkl]

I think it's a mixture of a bug and you doing something wrong. Just to make sure I understand what's going on - are you trying to register a custom dynamic authenticator to crossbar.io?

Elad

[BramVader]

Hi Elad,
That's correct. I made 2 ordinary clients (a caller and a callee) that run on the default transport on port 8080 that require dynamic ticket authentication and an authenticator client running on a seperate transport on port 8081 that require static ticket authentication (how could an authenticator otherwise authenticate itself?!).
Both clients use an authenticator class like (simplified code):

public class WampClientTicketAuthenticator : IWampClientAuthenticator
{
    private const string ticketAuthType = "ticket";
    private readonly string username;
    private readonly string ticket;

    public WampClientTicketAuthenticator(string username, string ticket)
    {
        this.username = username;
        this.ticket = ticket;
    }

    public AuthenticationResponse Authenticate(string authmethod, ChallengeDetails extra) => new AuthenticationResponse { Signature = ticket };

    public string[] AuthenticationMethods => new string[] { ticketAuthType };

    public string AuthenticationId => username;
}

IWampClientAuthenticator authenticatorCallee = new WampClientTicketAuthenticator("joe", "secret!!!");
channelCallee = new DefaultWampChannelFactory().CreateJsonChannel(router, "realm1", authenticatorCallee);

When both clients can be authenticated, everything works fine.
By know I suspect that these -404's are not caused by the authenticator but by the clients as a response to an ABORT sent from the WAMP-router (because I see two messages in the crossbario log). According to the RFC no response should be expected after an ABORT.

[darkl]

Thanks for the clarification. I think I know how to fix this, the fix is rather simple (In the WampServerProxyBuilder class one needs to use the WampInterceptorSelector).
May I ask you for a complete example (including a crossbar.config)? I mean two Program.cs (one for the authenticator and one for the client) that do this? You can upload this to GitHub Gist.

Thanks
Elad

[BramVader]

Hi Elad,
Here is my gist, including the config.json of the crossbar.io router.
Thanks,
Bram

[darkl]

Thanks for your example, I think I fixed the issue. Will release a new version to NuGet in the next few days (build server is doing trouble). Elad

…

On Fri, Mar 30, 2018, 18:33 BramVader ***@***.***> wrote: Closed #244 <#244>. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#244 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABEv9lG1bIpmQK3XtyjOWNbE2tCEMxWKks5tjqaggaJpZM4TBHRZ> .

[BramVader]

Hi Elad,
Thanks for your quick response. I'll await the new version.
Cheers,
Bram

[darkl]

Version 18.3.2 released.