Hi Dirk,

I fooled around with the client a bit but I am not familiar enough with the crypto stuff. As Christian mentioned it might be trivial I took a stab at it.

However I am a bit stumped on the use of sha256 vs. md5, the docs [1] mentions:

{md5(md5(username:realm:password) + nonce)}

but Christian's mail mentioned salted sha256. How's one related to the other?

Second issue I have is regarding the salt. Where do I put it and do I then have to add it to all server communication or only to the authentication/getting a session?

I could take another stab but I guess I need a little bit of guidance.

Sorry if I sound like a noob on this crypto stuff ;-)

[1]: http://docs.basex.org/wiki/Server_Protocol#Authentication

On Mon, Dec 29, 2014 at 2:54 PM, Marc van Grootel marc.van.grootel@gmail.com wrote:

Hi Andreas,

Maybe that is a better way but I am using the client from within a IPython Notebook which means I can integrate a bit more closely with the notebook interface and do queries and graphing with the data using IPythons great analytics and graphing features..

I had this working with 7.9.

--Marc

On Mon, Dec 29, 2014 at 2:45 PM, Andreas Jung lists@zopyx.com wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

<offtopic>

I am working with Python and Base-X for a while but not through the standard Python bindings. Instead I am using the "pyfilesystem" module for Python for accessing Base-X content through the WebDAV port using standard file operation methods as you know it from Python.

</offtopic>

Andreas

Marc van Grootel wrote:

...

Hi,

Anyone using the python client. I used it before, I think it was with 7.9, where it was still working. But now on a recent snapshot I cannot get my example to work anymore. I will report to maintainer but I would like to know if anyone could confirm having difficulties too.

Anything changed in the protocol?

I'm running on Python 2.7.8 :: Anaconda 2.0.1 (x86_64), on Mac that is.

The error message occurs when trying to set up a session:

/Users/marcvangrootel/Dropbox/notebooks/BaseXClient.py in __init__(self, host, port, user, password, receive_bytes_encoding, send_bytes_encoding) 129 # evaluate success flag 130 if not self.server_response_success(): --> 131 raise IOError('Access Denied.') 132 133 def execute(self, com):

IOError: Access Denied.

Thanks, --Marc

---

Regards Andreas Jung andreas@andreas-jung.com about.me/andreasjung -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQGUBAEBAgAGBQJUoVsUAAoJEADcfz7u4AZjWoILwMUkypGYOB8N9NPenIXNCZaD iQLCLDpVMr7RuTTj9M8E5yfOx22fgVdU9kcfPI5s13RHlH7UVYabkIypxQXsjUmJ Shb4TPdYO44cP1fqC43vcNu9yODBCq/hnugPK4VnsN0V/UBRIA2ghEQEYWB4Gygc b5XJt7kFOgZDLLV3JYfaSv8y3SH5HsHPSYqy7thKncOhK9K7tzuDqhyPmWAXt3a+ 8emragz+PnVLrY2/mirC5sk8a0FnpW1nJ9/eqvnhqxtmBpD6IQurG3v8xXZ5YRaf BBcHaSqxspntjUSLqtXp4bdHcJT/+YNZMyD+lEetYzTuBIGnyHXpGTtD1Fkru2Bf yGj0Yp/kTng0QrFZpwU28TUboEKyy+Xkav69julzTIIKk8ocZCkQsWAlFD/QWSws WJj/+ScEDWNk5d5KugkwfFbDv8LIM78Sz2odzGAvoh7t9/66hP0kiPtuGXcLqsXY wAE7hoIAdIPut52m+0R2N2AyBgZ/9Fc= =xR76 -----END PGP SIGNATURE-----

-- --Marc

ah, of course, I can always take a look at https://github.com/BaseXdb/basex/blob/master/basex-examples/src/main/java/or...

I'll have another go at it then.

--Marc

On Mon, Dec 29, 2014 at 4:57 PM, Marc van Grootel marc.van.grootel@gmail.com wrote:

... or maybe there's some client code that is already updated, then I could take a look at that. --Marc

Hi,

Seems to work fine. At least, I didn't introduce any issues that weren't already there. I didn't find the email address of the maintainer I attach the file to this post. I have checked on recent snapshot of 8.0 and 7.9.

If you want me to submit it differently or have me create a pull request let me know.

Here's the diff

120c120 < timestamp = self.recv_c_str() ---

    response = self.recv_c_str().split(':')

124,126c124,133 < #FIXME: should we allow to customize password encoding? < hfun.update(hashlib.md5(password.encode('us-ascii')).hexdigest().encode('us-ascii')) < hfun.update(timestamp.encode('us-ascii')) ---

    if len(response) > 1:
        code = "%s:%s:%s" % (user,response[0],password)
        nonce = response[1]
    else:
        code = password
        nonce = response[0]

    hfun.update(hashlib.md5(code.encode('us-ascii')).hexdigest().encode('us-ascii'))
    hfun.update(nonce.encode('us-ascii'))

374c381 < return result \ No newline at end of file ---

    return result