#87 Support multiple HTTP cookies

[Brian]

My company is moving our IM service to Skye for Business with Office365, and we use OKTA for SAML authentication. With this setup, the SIPE plugin doesn't connect because of what appears to be multiple cookies being returned from the authentication request.

(18:55:21) sipe: sipe_schedule_remove: action name=<+http-timeout>
(18:55:21) sipe: sipe_schedule_allocate timeouts count 1 after addition
(18:55:21) sipe: scheduling action <+http-timeout> timeout 60 seconds
(18:55:21) sipe: transport_input_common: new buffer length 4096
(18:55:21) sipe: sipe_http_transport_input: body too short (0 < 6438, strlen 423) - ignoring message
(18:55:21) sipe: transport_input_common: new buffer length 8192
(18:55:21) sipe: 
MESSAGE START <<<<<<<<<< HTTP - 2015-11-16T23:55:21.692020Z
HTTP/1.1 200 OK
Date: Mon, 16 Nov 2015 23:55:21 GMT
Server: nginx
Content-Type: application/soap+xml;charset=utf-8
Content-Length: 6438
X-Rate-Limit-Limit: 5000
X-Rate-Limit-Remaining: 4989
X-Rate-Limit-Reset: 1447718125
P3P: CP="HONK"
Strict-Transport-Security: max-age=315360000
Set-Cookie: sid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID=AD3D223EAD864867737A37676B64EA1C; Path=/

<?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"><s:Header><wsa:Action xmlns:wsa="http://www.w3.org/2005/08/addressing">http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue</wsa:Action><wsa:RelatesTo xmlns:wsa="http://www.w3.org/2005/08/addressing" RelationshipType="http://www.w3.org/2005/08/addressing/reply">..............................................</wsse:SecurityTokenReference></wst:RequestedUnattachedReference></wst:RequestSecurityTokenResponse></s:Body></s:Envelope>
MESSAGE END <<<<<<<<<< HTTP - 2015-11-16T23:55:21.692020Z

The authentication succeeds, but the plugin only sees the first cookie returned, where the session ID is really in the second cookie.

(18:55:21) sipe: sipe_http_request_response_callback: cookie: sid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
(18:55:21) sipe: sipe_svc_https_response: code 200
(18:55:21) GLib: g_strchug: assertion `string != NULL' failed
(18:55:21) GLib: g_strchomp: assertion `string != NULL' failed
(18:55:21) connection: Connection error on 0x295e580 (reason: 2 description: Web ticket request to https://webpooldm21a06.infra.lync.com:443/CertProv/CertProvisioningService.svc failed)

After trolling through the plug-in source code, I figured out that I could get it to instead use the second cookie by modifying the sipe-http-request.c file and changing line 414 to use sipmsg_find_header_instance instead of sipmsg_find_header.

        ((hdr = sipmsg_find_header_instance(msg, "Set-Cookie",1)) != NULL)) {

Making this one change entirely fixes my issue. For my particular circumstance, I only care about the second cookie, so I feel I can get away with hard-coding it like that. However, I wanted to report this, so that you will consider incorporating some logic in the plugin to handle cases where multiple cookies are returned.

[Stefan Becker]

Ticket moved from /p/sipe/bugs/297/

Can't be converted:

• _milestone: 1.20.x

[Stefan Becker]

Please add the complete --debug log. At least as complete as to show the whole authentication handshake.

[Brian]

Complete log is attached

[Stefan Becker]

Turned out that I could test multiple HTTP cookies support with my own Office365 test account.

Implemented by git commit 2061886. I would appreciate feedback if this fixes the authentication issue for you.