Digest proxy with required authentication does not work with proxystrategy with MQTT client

[Amaracs]

Hi,

I am trying to create an MQTT connection to a proxy server using the ProxyStrategy with configured Digest proxy with client authentication, but I always get the following error: AWS_ERROR_HTTP_PROXY_CONNECT_FAILED. For my first try I tried to use the code from the sample from here.

Aws::Crt::Http::HttpProxyStrategyBasicAuthConfig basicAuthConfig;
basicAuthConfig.ConnectionType = Aws::Crt::Http::AwsHttpProxyConnectionType::Tunneling;
basicAuthConfig.Username = proxyUserName.c_str();
basicAuthConfig.Password = proxyPassword.c_str();
proxyOptions.ProxyStrategy =
                Aws::Crt::Http::HttpProxyStrategy::CreateBasicHttpProxyStrategy(basicAuthConfig, Aws::Crt::g_allocator);
proxyOptions.AuthType = Aws::Crt::Http::AwsHttpProxyAuthenticationType::Basic;

Because as opposed to HttpProxyStrategyAdaptiveConfig it has username and password members, so it can be set. On the other hand I tried to use the HttpProxyStrategyAdaptiveConfig too, but I do not know how to set the proxy username and password and unfortunately I did not find anything useful to figure it out. I have the same issue with NTLM proxy too where authentication is necessary, but I do not have any idea how can I pass them. I welcome any hint or help here, thanks in advance.

[KaibaLopez]

Hi @Amaracs ,
Did you mean to open this issue on the iot-devices-cpp repository? I can transfer it for you if that's the case. If not, and you are trying something different from the sample you provided, then I'll need a way to reproduce, some simple standalone sample that I can run and get the error.

[Amaracs]

Hi @KaibaLopez,

Yes, thank you, maybe they could help me, because their sample is more than enough the reproduce the issue with a configured digest proxy.

[Amaracs]

I am still puzzled by this issue because I do not see any example, or even a test file which is calling the CreateAdaptiveHttpProxyStrategy function. Can I get a confirmation that these proxy types are even supported?

• Basic Auth
• Digest Auth
• Forward
• NOIP
• NTLM/Negotiate (Kerberos)
• Socks
• SSL Inspection Proxy
• WPAD

Thanks in advance.

[bretambrose]

The v2 SDK supports http proxies either with no auth or basic auth. Kerberos/NTLM support is possible, but we do not have examples or non-mocked integration tests for it.

[Amaracs]

Is there any hint or some documentation about how should I override these lambdas in the HttpProxyStrategy.h, because I have an NTLM/Kerberos auth proxy set up, but I do not know how should I pass the username and password for the authentication to these functions.

            struct AWS_CRT_CPP_API HttpProxyStrategyAdaptiveConfig
            {
                HttpProxyStrategyAdaptiveConfig() : KerberosGetToken(), NtlmGetCredential(), NtlmGetToken() {}

                KerberosGetTokenFunction KerberosGetToken;

                KerberosGetTokenFunction NtlmGetCredential;

                NtlmGetTokenFunction NtlmGetToken;
            };

Thank you for your time and your help in advance.

[Amaracs]

I tried to set the proxystrategy's basicauthpassword and basicauthusername, but I get errorCode: 3

This is what I tried:

   Http::HttpClientConnectionProxyOptions proxyStrategy;
      Http::HttpProxyStrategyAdaptiveConfig adaptiveConfig;
      adaptiveConfig.KerberosGetToken = [](String& tmp) {
          return true;
      };
      adaptiveConfig.NtlmGetCredential = [](String& tmp) {
          return true;
      };
      adaptiveConfig.NtlmGetToken = [](const String& tmp, String& tmp1) {
          return true;
      };
      
      proxyStrategy.HostName =_proxyAuthenticator->hostName();
      proxyStrategy.Port = _proxyAuthenticator->port();

      proxyStrategy.ProxyStrategy = Http::HttpProxyStrategy::CreateAdaptiveHttpProxyStrategy(adaptiveConfig);
      proxyStrategy.BasicAuthPassword = "testpw";
      proxyStrategy.BasicAuthUsername = "test";

      configBuilder.WithHttpProxyOptions(proxyStrategy);

Thanks again.

[bretambrose]

If you want to use basic auth, just use HttpProxyStrategy::CreateBasicHttpProxyStrategy()

[Amaracs]

Yes thank you, the basic auth proxy is working fine, but I am trying to find out the limitations of the proxy support with other auth proxies.

[jmklix]

As @bretambrose said we only support http proxies either with no auth or basic auth. You can look here for more documentation about proxies with AWS IoT. If you would like support for a specific proxy please create a feature request.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.