Confusing instructions in readme

[tmittelstaedt]

The Readme states:
Fill in the authorization username or password. This is the credential verified by the

<authorizationURL>

in the phone's configuration XML.

In checking https://usecallmanager.nz/rtp-streaming.html, https://usecallmanager.nz/cgi-execute-xml.html it states:

If an <authenticationURL> has been defined,

and in checking https://usecallmanager.nz/phone-services-xml.html it says

authenticationURL link
If defined, the phone will make requests to this URL containing the username and password that was included in the Authorization header in the request to http://x.x.x.x/CGI/Execute. The script handling the request must respond exactly with AUTHORIZED (with no newline character at end) otherwise the request will be denied. See CGI Execute for more information.

If you are using the example phone services above the URL would be http://HOST/authentication.

There is no mention of a <authorizationURL> XML directive for these phones anywhere on the usecallmanager site. Is this a typo in the readme for this project?

Furthermore if it is supposed to be <authenticationURL> then could you please include an example of this directive used in the SEPMAC file for your rtp project? I am not understanding the format for this. I found this old post:

https://www.3cx.com/community/threads/cisco-7975g-and-auth-settings.104300/

And this one:

https://damow.net/cisco-7942-hacking/

Which sort of explain what's going on but once more lack examples of what precisely goes into the SEPMAC file

This post does have an example but once more it appears to be a URL lacking credentials:

https://www.uplinx.com/phone-control/userguide/topics/troubleshooting--informacast-authentication.htm

Lastly, many instructions out there say to set the multicast address the phone listens to. Your project defines a multicast address your app sends to but how do you tell the phone to listen to that address in the SEPMAC file?

[Wriar]

Good morning, Ted (@tmittelstaedt). Yes, the authorization username and password is generally verified by the authenticationURL. The authentication URL points to a server that authenticates the CGI request via AUTHORIZED. You should be able to write a simple PHP script that does this for your own server to emulate the CM authentication server behavior.

An example from my server would be <authenticationURL>http://10.67.5.50/authorization.php</authenticationURL>.

To answer your last question, the (START) and (STOP) buttons execute two behaviors each: Sends a CGI request to the phone to begin listening on that specific multicast address, then subsequently starts streaming media to that address via bundled FFMPEG. (ADV) REQ. MS allows you to manually send the listening address without streaming anything. When a stream start command is send to the phone via CGI, the speakerphone key will be lit. When (STOP) is selected, the program terminates the multicast stream in FFMPEG and then sends another CGI request to the phone to stop listening to media on that port.

Only streaming to the multicast address using FFMPEG or another tool won't cause the phones to start playing the stream automatically, which is why a CGI request must be send to start and stop the stream (the multicast address and port is specified in the request). This is unlike a lot of other phone models, which continuously listen and detect when audio is being streamed to a certain address. So, to reiterate:

1. Software sends CGI request to each phone via IP to start listening to the multicast addr via mediaStream
2. Phones verify the command using the authentication/authorization server providing user/pass from software (they are encoded in a HTTP header, not part of the actual GET request URI you see in InformaCast).
3. If server responds AUTHORIZED to the phone, the phone enables speaker and starts listening to that port.
4. In the software, once it detects all phones have responded successfully to each mediaStream request, it uses FFMPEG to optimize and stream the file to that multicast address.
5. The phones that have been already instructed to listen to the address will play the media.
6. To terminate the stream, the software sends another mediaStream request to each phone requesting to stop listening to the multicast stream.
7. The phones go through the same verification process which upon success will stop listening to the stream and disable the speaker.

If you prefer, I can provide one-to-one support with your project and also the server files, as well as share more info about a more durable v2 provisioning server in development (I understand you have interest and would really appreciate to hear your opinion). Please e-mail me at me[@]wriar[dot]org.

[Wriar]

Sorry, GH automatically closed this.

[tmittelstaedt]

An authorization.php for just testing, of:

<?php
header("Content-type: text/plain");
header("X-Custom-Header: AUTHORIZED");
?>

produces this:

HTTP/1.1 200 OK 
Date: Sun, 21 Sep 2025 08:35:07 GMT
Server: Apache
X-Custom-Header: AUTHORIZED
Content-Length: 0
Content-Type: text/plain;charset=UTF-8

But that seems to differ from this:
https://usecallmanager.nz/phone-services-xml.html
which says:

The script handling the request must respond exactly with AUTHORIZED (with no newline character at end)

I found an example in Qt:

https://forum.qt.io/topic/42603/cisco-ip-phone-serivices-authentication-url-response

It seems to indicate the phones will ignore a lot of fluff output as long as AUTHORIZED with no newline is the last thing in the header sent to the phone

The services 2.8 file on the usecallmanager site has a python file as a CGI url containing:

#!/usr/bin/env python3
#
# Copyright (c) 2020 Gareth Palmer <gareth.palmer3@gmail.com>
# This program is free software, distributed under the terms of
# the GNU General Public License Version 2.

from flask import Blueprint, Response, request
import config


blueprint = Blueprint('authentication', __name__)


@blueprint.route('/authentication')
def cgi_authentication():
    username = request.args.get('UserID', '')
    password = request.args.get('Password', '')

    if username != config.cgi_username or password != config.cgi_password:
        return Response('UNAUTHORIZED', mimetype = 'text/plain'), 200

    return Response('AUTHORIZED', mimetype = 'text/plain'), 200

@blueprint.errorhandler(Exception)
def error_handler(error):
    return Response('ERROR', mimetype = 'text/plain'), 500

that they use but it requires flask It seems the responses are overly complicated, is there a quick hack in php that would just always return authorized as an http header without the extra cruff?

[Wriar]

The AUTHORIZED text is part of the response body from the server. Only credentials are part of the header, but you don't plan to use those. In PHP, it looks something like this:

<?php
header('Content-Type: text/plain; charset=utf-8'); //line may be optional
echo "AUTHORIZED";
?>

[tmittelstaedt]

This works perfectly with a Cisco model CP-7841 running Enterprise firmware version sip78xx.12-8-1-0101-482.
It fails with the error "Unauthorized, please check the login credentials" on a Cisco model CP-9971 running firmware sip9971.9-4-2SR2-2 (same error message on that phone if authenticationURL left blank) and it also fails on a Cisco model CP-6921 running firmware version SIP 9.4.1.3.SR3 with the error message "Index was outside the bounds of the array"

Config for 9971 is a copy of the one here with changes to allow registration on my PBX:

https://community.freepbx.org/t/cisco-9971-phone-configuration-working-example-with-setup-tips/13481/8

In checking the webserver log, the following load line was logged from the CP-6921:

phony.pdnit.com:80 192.168.1.159 - - [22/Sep/2025:20:16:58 -0700] "GET /cisco/authorized.php?UserID=&Password=&devicename=SEP5CA48A992049 HTTP/1.1" 200 162 "-" "Pegatron-Unihan-Software"

There was no load line logged for the CP-9971

Loadline from the 7841 is:

phony.pdnit.com:80 192.168.1.166 - - [22/Sep/2025:20:16:57 -0700] "GET /cisco/authorized.php?UserID=&Password=&devicename=SEPBC671C31FF58 HTTP/1.1" 200 162 "-" "libcurl-agent/7.26.0"

[tmittelstaedt]

I have some more information to add on this.

I tested with a Cisco CP-8941 and it responds identically to a CP-6971 "index was outside the bounds of the array"

I then attempted to use a userID and password in the program with the CP-9971 and now I am getting a login line in the Apache log that is:

phony.pdnit.com:80 192.168.1.164 - - [26/Sep/2025:00:17:01 -0700] "GET /cisco/authorized.php?UserID=%24%3F%5D%48%71%3C%65%2C%68%42%35%3D%38%28%31%55%56%28%3E%2F&Password=28%24%6D%65%21%5B%7C%62%78%52%2E%7E%44%56%41%61%7E%69%75&devicename=SEP08CC68E91B71 HTTP/1.1" 200 142 "-" "Allegro-Software-WebClient/4.34"

and I get the error message from the software "The character set provided in Content Type is invalid Cannot read content as string using an invalid character set"

I also replaced the DNS name in the URL for the CP-9971 with the IP address of the webserver but I don't know if that made any difference.

I also tested with several other different g711 files from different conversion programs and got the same errors on the phones, all of those files worked with the CP-7841

I also changed the authorized.php file from the simple echo output to the actual authentication PHP file from
https://github.com/slazar/cisco-authenticate/blob/master/README.md
and used his suggestion of creating hashes for the userID and password. This also works fine with the CP-7841 but I still get the Index was outside of bounds error message even using this authentication php

I noted that the authenticate php from slazar is 13 years old, dating from 2012. The CP78xx series first release date is a year later so the only Cisco phones that slazar would have had available were the x9xx series such as the 6921, 8941, 9971 and clearly he got it working then.

So I have to conclude the issue is the phone is erroring from the http call being sent from the program to the phone, rather than any other issue. Something is being parsed differently by the Allegro Software WebClient and the Pegatron Unihan software used in these phones vs the libcurl agent used in the 78xx phone.

I did find a clue in this URL:

https://www.uplinx.com/phone-control/userguide/topics/fix-phone-authentication-69xx-phones.htm

It says "The Apache web server that returns the additional X- options in HTTP header(in red in below Authentication answer from CUCM) seem to break the parsing of the CUCM standard authentication replies on 69xx phones."

Incidentally there is also yet another authentication script there - for use with IIS server it is a Windows aspx script.

[tmittelstaedt]

After much experimentation it has become obvious that the Cisco phones code paths in their firmware end up triggering error messages that authentication failed, no matter what configuration issues or other issues might be present. The internal parsers in the phone models firmware are picky and inconsistent. Depending on what model may be in use, commands sent to one phone that work, can fail with a different model, and in most of the failure cases the errors returned from the phone indicate an authentication failure request, even though the authentication succeeded and something else in the phone failed.

This issue and it's followups contain enough information about implementing authentication properly with these phones that the issue can probably be closed unless you want to keep it open as additional documentation.