[Pidgin] #17070: Implementation of WEBEX-TOKEN SASL support

[Pidgin]

#17070: Implementation of WEBEX-TOKEN SASL support
--------------------+-------------------------------
 Reporter:  kainz   |      Owner:
     Type:  patch   |     Status:  new
Milestone:          |  Component:  libpurple
  Version:  2.11.0  |   Keywords:  webex jabber sasl
--------------------+-------------------------------
 Resolves defect #16965

 This patch provides a basic implementation of WEBEX-TOKEN SASL auth
 support. This is required if you with to authenticate to a Cisco WebEx
 Jabber system that is using Federated SSO.

 This works by installing a WEBEX-TOKEN mechanism handler with priority one
 higher than cyrus-sasl so that it has a chance to authenticate before
 cyrus takes over the whole SASL workflow. (otherwise, auth-cyrus.c stops
 the workflow with a SASL_FAIL because it ends up trying PLAIN first.)

 To use after building: from a Cisco Jabber install, look for a
 SSOAuthInfoStore.xml file.  This should contain a URL on
 loginp.webexconnect.com (or the like) specifying a SSO login url. Once you
 go to this with a browser and complete whatever authentication workflow is
 needed (I've tested with federated auth to an AD domain, so kerberos), you
 will get an XML stanza back called FederatedSSO.

 In that returned stanza, you will need to copy the <jabbertoken> element,
 and use that as your password. <screenname> should match your user and
 domain elements in your account configuration.  Finally, you will want to
 use the server in the <xmppjabbercluster> element as your target server to
 connect to.  I do not recommend using the supplied BOSH uri at this time,
 as I haven't gotten that to work.  Using regular SSL on 5222 works for me.

 Once you have all this, you should be able to login, add buddies, and
 chat.  I doubt any video/audio/screenshare functions will work, but I
 haven't had an opportunity to test that.  Last but not least, after the
 <timetolive> (in seconds) expires, you will need to repeat the above
 workflow to get a new password.

 Future work could be taken to automate all of the above, of course, but I
 wanted to get eyes on this proof-of-concept.

--
Ticket URL: <https://developer.pidgin.im/ticket/17070>
Pidgin <https://pidgin.im>
Pidgin