[QPIDJMS-335] SCRAM-SHA mechanism impls erroneously escape "=" and "," in the password during processing

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.26.0
• Fix Version/s: 0.27.0
• Component/s: qpid-jms-client
• Assignee: Robbie Gemmell
• Reporter: Robbie Gemmell
• Created: 06/Oct/17 16:47
• Updated: 06/Nov/17 15:49
• Resolved: 16/Oct/17 15:17

Description

Per discussion on http://mail-archives.apache.org/mod_mbox/qpid-users/201710.mbox/%3C1507290028737-0.post%40n2.nabble.com%3E the client is erroneously escaping "=" and "," during password handling, whereas the SCRAM mechanisms only require this for the username and some other cases, causing authentication to fail when they are present as the wrong value is used to compute the details sent to the server.

Issue Links

• is related to: QPID-7964 [Java Client, AMQP 0-x] SCRAM SASL implementation incorrectly encodes "=" and "," for passwords