WebRTC/ Coturn Authentication using TURN REST API flag (use-auth-secret), based upon authentication secret

2.3k views Asked by At

I was playing with this was able to get it working immediately using Node/Javascript, took a while using Golang (this is just generating the user/password to be sent to coturn.) Notice the secret should match the coturn configuration and in the API JS/Go side.

The configuration on coturn: /etc/turnserver.conf

listening-port=443
tls-listening-port=443
listening-ip=10.100.0.2
relay-ip=10.100.0.2
external-ip=123.456.78.9
min-port=10000
max-port=20000
verbose
fingerprint
lt-cred-mech
server-name=myserver
realm=myserver
cert=/etc/SSL/fullchain.pem
pkey=/etc/SSL/privkey.pem
log-file=/var/log/turnserver.log
use-auth-secret
static-auth-secret=MySecret

The following is Node/Js Implementation API (copied from elsewhere - worked):

var crypto = require('crypto');
var unixTimeStamp = parseInt(Date.now()/1000) + 24*3600,   // this credential valid for 24 hours
    TempUser = [unixTimeStamp, "SomeUser"].join(':'),
    TempPassword,
    hmac = crypto.createHmac('sha1', "MySecret");
hmac.setEncoding('base64');
hmac.write(TempUser);
hmac.end();
TempPassword = hmac.read();

The following is GOLANG Implementation API (took a while):

UserId := "SomeUser" 
// This worked, returned the exact seconds
timestamp := strconv.FormatInt(time.Now().UTC().Unix()+24*3600, 10)
// Example: The above is 1602692130
secret := "MySecret"
TempUser := timestamp + ":" + UserId  // For API Auth, coturn expects this format, the timestamp is the expiry date of the final temp user/password.

// Create a new HMAC by defining the hash type and the key (as byte array)
//h := hmac.New(sha256.New, []byte(secret))   // sha256 does not work, use sha1
h := hmac.New(sha1.New, []byte(secret))    

h.Write([]byte(TempUser))

//sha := b64.URLEncoding.EncodeToString(h.Sum(nil))  // URLEncoding did not work
TempPassword := b64.StdEncoding.EncodeToString(h.Sum(nil)) // StdEncoding worked

The JS on the Webrtc client. Notice we are using the TempUser and TempPassword here to be sent to coturn.

    ...
 const stunUrl = 'stun:mystun_server',
    turnUsername = TempUser,
    turnPassword = TempPassword,
...
        'iceServers': [
            { 'url': stunUrl },
            {
                'urls': turnUrl1,
                'username': turnUsername,
                'credential': turnPassword
            },

Now coturn will authenticate using the TempUser and TempPassword above. Hope someone will find this useful. Thanks!

0

There are 0 answers