TURN Server for WebRTC with REST API Authentication

Question

I am trying to configure the TURN rfc5766-turn-server server for webRTC from here . I was able to successfully transfer my video through this TURN server using the turnuserdb.conf file, where I have my username and password (my_user_name: my_password). And on the web client side, I used:

 "iceServers":{[ "url": "turn:my_user_name,@turn_server_ip", "credential":"my_password" }] 

I am trying to use the REST API function that comes with the TURN server to avoid sending the password over the network or saving it on the client side. I followed this specification and this explanation in the Rest API

However, unfortunately, I get 401 , and I can not authenticate.

Here is what I did for sure:

• I created a secret "my_secret" and I started the queue server as follows:

   turnserver -v --syslog -a -L xx.xxx.xx.xx -X yy.yyy.yyy.yy -E zz.zzz.zz.zzz --max-bps=3000000 -f -m 3 --min-port=32355 --max-port=65535 --use-auth-secret --static-auth-secret=my_secret --realm=north.gov --cert=turn_server_cert.pem --pkey=turn_server_pkey.pem --log-file=stdout -q 100 -Q 300 --cipher-list=ALL 

  (I just replaced the IP address with xx.xxx.xx.xx yy.yyy.yyy.yy zz.zzz.zz.zzz )

• Later, I generated a timestamp, which would now be + 1 hour, so I ran through nodejs:

   Date.now()+1000*60*60; // output 1433895918506. 

  I created a temporary password on this website , using my secret and getting the result 0ca57806bdc696b3129d4cad83746945b00af77b

• I have encoded the password for base64.

• Now I tried to connect to the queue server from the web client using a temporary username: 1433895918506:my_user_name and password: MGNhNTc4MDZiZGM2OTZiMzEyOWQ0Y2FkODM3NDY5NDViMDBhZjc3Yg== , now I'm using the web client

   "iceServers":"url":"turn:1433895918506: my_user_name@turn _server_ip","credential":"MGNhNTc4MDZiZGM2OTZiMzEyOWQ0Y2FkODM3NDY5NDViMDBhZjc3Yg=="}] 

But this does not work, I get:

 401 user <1433895918506:my_user_name> incoming packet message processed, error 401: Unauthorised. 

Can you help me figure out what is wrong?

Answer 1

when I created the credentials with your name and secret, I got 1Dj9XZ5fwvKS6YoQZOoORcFnXaI= not MGNhNTc4MDZiZGM2OTZiMzEyOWQ0Y2FkODM3NDY5NDViMDBhZjc3Yg== for error code, check your algorithm.

and the time is in the Unix timestamp , so in seconds, not in milliseconds, as you did (although this should not affect, but just makes your credentials never expire)

check if your system and the system running the TURN server are installed, the synchronized clock (at least not separate days) and, in general, to avoid synchronizing the synchronized clock, it is better to use ttl as 24 hours, so your timestamp :

 timestamp= parseInt(Date.now()/1000) + 24*3600 

code for generating the TURN identifier:

 var crypto = require('crypto'); function getTURNCredentials(name, secret){ var unixTimeStamp = parseInt(Date.now()/1000) + 24*3600, username = [unixTimeStamp, name].join(':'), password, hmac = crypto.createHmac('sha1', secret); hmac.setEncoding('base64'); hmac.write(username); hmac.end(); password = hmac.read(); return { username: username, password: password }; }