Asterisk 13.1.0/PJSIP Outbound Calling Using SIP Trunk: Unable To Create Request With Auth.No Auth Credentials For Any Realms In Challenge.

Home » Asterisk Users » Asterisk 13.1.0/PJSIP Outbound Calling Using SIP Trunk: Unable To Create Request With Auth.No Auth Credentials For Any Realms In Challenge.
Asterisk Users 10 Comments

I have setup my Asterisk 13.1.0 server with PJSIP on AWS/EC2. My basic configuration works, and I am connected to a SIP trunk using SIP.US, and have set up my inbound calling which works correctly (when I call my PBX
DID, the call does come into my PBX network).

The issue is that I am not able to make outbound calls, because the call fails with the error:

res_pjsip_outbound_authenticator_digest.c:125
digest_create_request_with_auth: Unable to create request with auth.No auth credentials for any realms in challenge.

CLI> pjsip show endpoint sonnyGW1

…
========================================================================================
Endpoint: sonnyGW1 Not in use 0
of inf
OutAuth: sonnyGW1_auth/sonny
Aor: sonnyGW1 0
Contact: sonnyGW1/sip:65.254.44.194:5060 Unknown
nan
Transport: transport-udp udp 0 0 0.0.0.0:5060
Identify: sonnyGW1/sonnyGW1
Match: 65.254.44.194/32

My pjsip.conf is as below

[sonnyGW1]
type=registration transport=transport-udp outbound_auth=sonnyGW1_auth server_uri=sip:gw1.sip.us client_uri=sip:sonny@gw1.sip.us contact_user=sonny retry_interval`
forbidden_retry_interval`0
expiration600

[sonnyGW1_auth]
type=auth auth_type=userpass password=somepassword username=sonny realm=gw1.sip.us

[sonnyGW1]
type=aor contact=sip:65.254.44.194:5060

[sonnyGW1]
type=endpoint transport=transport-udp context=gateway1
allow=!all,ulaw outbound_auth=sonnyGW1_auth aors=sonnyGW1

[sonnyGW1]
type=identify endpoint=sonnyGW1
matche.254.44.194

My extensions.conf stub for the appropriate section looks like this (from https://wiki.asterisk.org/wiki/display/AST/Dialing+PJSIP+Channels) :

exten => _9XXXX.,1,Log(NOTICE, Dialing out from ${CALLERID(all)} to
${EXTEN:1} through gateway1)
exten => _9XXXX.,n,Dial(PJSIP/${EXTEN:1}@sonnyGW1)
; Have also tried
; exten => _9XXXX.,n,Dial(PJSIP/sip:${EXTEN:1}@65.254.44.194:5060)
exten => _9XXXX.,n,Playtones(congestion)
exten => _9XXXX.,n,Hangup()

I do know that this code is being executed as I see the log in the first line above.

Have I correctly set up authentication for outbound calling?

Any help appreciated. Thanks!

10 thoughts on - Asterisk 13.1.0/PJSIP Outbound Calling Using SIP Trunk: Unable To Create Request With Auth.No Auth Credentials For Any Realms In Challenge.

  • You probably need to remove the ‘realm’ line so that it will match any realm in the challenge.

  • That was the issue, thanks. I now am able to get the caller ringing on an outbound call, but an external phone number (E164) I am dialing does not ring.

    On Sun, Mar 15, 2015 at 12:19 PM, George Joseph

  • Any error messages? If you set ‘core set verbose 3’ and try it, does the Dial get executed?

  • Yes, I think the dial does get executed (sonny calling outbound
    202-555-1212):

    core set verbose 3
    Console verbose was OFF and is now 3.
    — Executing [912025551212@from-internal:1] Log(“PJSIP/sonny-00000031”,
    “NOTICE, Dialing out from “” to 12025551212 through fromgw”) in new stack
    [Mar 15 19:27:06] NOTICE[16648][C-00000022]: Ext. 912025551212:1 @
    from-internal: Dialing out from “”     to 12025551212 through fromgw
    — Executing [912025551212@from-internal:2]
    Dial(“PJSIP/sonny-00000031”, “PJSIP/12025551212@sonnyGW1”) in new stack
    — Called PJSIP/12025551212@sonnyGW1

    the number 202-555-1212 does not ring.

    at hangup on caller (sonny):

    == Spawn extension (from-internal, 912025551212, 2) exited non-zero on
    ‘PJSIP/sonny-00000031’

  • You’re probably going to have to turn on debug for the pjsip endpoint with
    ‘pjsip set logger host ‘ and look at the actual outbound INVITE and any response.

  • I am out now, and can happily send details in a couple of hours. However, I
    can give you a summary of what happens. The PBX sends an invite and I
    immediately start ringing at the caller (100 trying) and the I get a 407
    proxy auth required to which the server responds but clearly the sip gateway is not happy with this.

    Thank you for responding!

  • George,

    I have the detailed log below. (Resending after trimming the email to 40KB.)

    The sequence below just repeats ad-nauseam. Is this a SIP trunk issue?

    Thanks!

    ——————-

  • I don’t see anything obvious. The registration works though, right?
    You might want to compare the register auth exchange to the invite auth exchange and see if anything differs.

  • Hi George,

    Well, as it turns out the removal of “realm” in sonnyGW1_auth above does not remove the issue. I still see the issue. I did not see the issue earlier likely due to the CLI logging command mixup which I have now solved using a wireshark trace (CLI was just too verbose). I see the 407
    authentication required still, and the following pattern just repeats at the Asterisk server (which is connected to the SIP trunk at 65.254.44.194)
    because the SIP trunk needs it to complete the outbound call, but the Asterisk server doesn’t ever send it even after the 407 from the SIP trunk:

    Wireshark trace of failed outbound call:

    217274 5915.986472000 sonnysMachine 65.254.44.194 SIP/SDP
    1227 Request: INVITE sip:16175551212@65.254.44.194:5060 |
    217280 5916.059148000 65.254.44.194 sonnysMachine SIP
    385 Status: 100 Trying |
    217282 5916.059909000 65.254.44.194 sonnysMachine SIP
    582 Status: 407 Proxy Authentication Required |
    217285 5916.060227000 sonnysMachine 65.254.44.194 SIP
    425 Request: ACK sip:16175551212@65.254.44.194:5060 |
    …
    (repeats ad infinitum)

    When I look at the challenge in 407 Proxy Authentication Required from the server, I see that the realm is 65.254.44.194 (gw1.sip.us), but the appropriate Authorization (sent in the trunk registration, for example) is never sent back from the Asterisk server. Here’s what the SIP trunk actually says (407 Auth required message; the nonce was changed by me):

    Wireshark detail of 407 Proxy Authentication Required packet from SIP trunk:

    Proxy-Authenticate: Digest realm=”65.254.44.194″, nonce=”BLUBBERbbb/e495019b-83b4-491c-8f33-3e238a3c6af2″, qop=”auth”
    Authentication Scheme: Digest
    Realm: “65.254.44.194”
    Nonce Value: “BLUBBERbbb/e495019b-83b4-491c-8f33-3e238a3c6af2”
    QOP: “auth”

    And here’s how the SIP trunk registration works (correctly); note the bigger REGISTER message in the 3rd line pertaining to the registration at
    65.254.44.194, it pertains to the additional 274 bytes of authentication information:

    Wireshark detail of successful SIP trunk registration:

    12634 230.390420000 sonnysMachine 65.254.44.194 SIP
    543 Request: REGISTER sip:gw1.sip.us (fetch bindings) |
    12635 230.461572000 65.254.44.194 sonnysMachine SIP
    560 Status: 401 Unauthorized (0 bindings) |
    12637 230.462041000 sonnysMachine 65.254.44.194 SIP
    815 Request: REGISTER sip:gw1.sip.us (fetch bindings) |
    12639 230.535100000 65.254.44.194 sonnysMachine SIP
    486 Status: 200 OK (0 bindings) |

    Any help is deeply appreciated.

    Has anyone successfully done SIP trunk registration with PJSIP in Asterisk
    13.1.0?