IdHTTPServer and digest authentication

[mrdebug]

Hi, I need to implement server side the digest authentication. Can someone post an example on how to implement the component IdHTTPServer, server side? Many thanks

[Remy Lebeau]

At this time, TIdHTTPServer does not natively implement any authentications other than BASIC.  If you want to use a different authentication, you have to implement it yourself, by parsing the client's authentication data in the OnParseAuthentication event, and validating the client's authentication data and populating TIdResponseInfo with any necessary server authentication data in the OnCommand... events.

Code: Pascal  [Select][+][-]

1. procedure TMyForm.IdHTTPServerParseAuthentication(AContext: TIdContext;
2.   const AAuthType, AAuthData: String; var VUsername, VPassword: String;
3.   var VHandled: Boolean);
4. begin
5.   if TextIsSame(AAuthType, 'Digest') then
6.   begin
7.     // parse AAuthData, populate VUsername and VPassword as needed...
8.     VHandled := True;
9.   end;
10. end;
11.  
12. procedure TMyForm.IdHTTPServerCommandGet(AContext: TIdContext;
13.     ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);
14. begin
15.   ...
16.   if ARequestInfo.AuthExists then
17.   begin
18.     // use ARequestInfo.AuthType, ARequestInfo.AuthUsername,
19.     // and ARequestInfo.AuthPassword as needed...
20.   end;
21.   if Digest Authentication is needed then
22.   begin
23.     AResponseInfo.ResponseNo := 401;
24.     AResponseInfo.WWWAuthenticate.Add('Digest ...');
25.     // or:
26.     // AResponseInfo.CustomHeaders.Values['WWW-Authenticate'] := 'Digest ...';
27.     Exit;
28.   end;
29.   ...
30. end;

[mrdebug]

Many thanks for your reply.
Now the client sends this header to server:

Authorization: Digest username="Admin", realm="", nonce="", algorithm="MD5", uri="/Path", response="dc9857e3e15a18babf11b71edbd68359"

I think I have to built a text with user id, password and a digest text in order to obtain the same md5 algorithm.
How can I build it? Or how can I validate this header?

[Remy Lebeau]

Now the client sends this header to server:

Authorization: Digest username="Admin", realm="", nonce="", algorithm="MD5", uri="/Path", response="dc9857e3e15a18babf11b71edbd68359"

All that data is available in the AAuthData parameter of the OnParseAuthentication event.

I think I have to built a text with user id, password and a digest text in order to obtain the same md5 algorithm.
How can I build it? Or how can I validate this header?

You have to parse and validate it yourself, following the rules of RFC 7616.  Indy does not provide a server-side framework for parsing authentication (only client-side - see the TIdDigestAuthentication class used by the TIdHTTP client).