Can't log into office communicator after upgrade

[Ralf Hildebrandt]

After an upgrade to precise, pidging cannot login to office communicator anymore; debug yields:

(11:11:40) account: Connecting to account <email address hidden>,CHARITE\HILDEB.
(11:11:40) connection: Connecting. gc = 0x7f66be0e2010
(11:11:40) sipe: sipe_login: username '<email address hidden>,CHARITE\HILDEB'
(11:11:40) sipe: sipe_login: login 'CHARITE\HILDEB'
(11:11:40) sipe: sipe_login: auth domain 'CHARITE' user 'HILDEB'
(11:11:40) sipe: sipe_core_allocate: signin_name '<email address hidden>'
(11:11:40) sipe: sipe_core_allocate: user 'ralf.hildebrandt' domain 'charite.de'
(11:11:40) sipe: sipe_core_connect: user specified SIP server s-ocs01.charite.de:0
(11:11:40) sipe: transport_connect - hostname: s-ocs01.charite.de port: 5061
(11:11:40) sipe: using SSL
(11:11:40) dnsquery: Performing DNS lookup for s-ocs01.charite.de
(11:11:40) dns: Wait for DNS child 4344 failed: No child processes
(11:11:40) dns: Created new DNS child 5036, there are now 1 children.
(11:11:40) dns: Successfully sent DNS request to child 5036
(11:11:40) dns: Got response for 's-ocs01.charite.de'
(11:11:40) dnsquery: IP resolved for s-ocs01.charite.de
(11:11:40) proxy: Attempting connection to 10.32.32.180
(11:11:40) proxy: Connecting to s-ocs01.charite.de:5061 with no proxy
(11:11:40) proxy: Connection in progress
(11:11:40) proxy: Connecting to s-ocs01.charite.de:5061.
(11:11:40) proxy: Connected to s-ocs01.charite.de:5061.
(11:11:40) nss: subject=CN=s-ocs01.charite.de,OU=GB-IT,O=Charite´ Universitätsmedizin Berlin,L=Berlin,ST=Berlin,C=DE issuer=CN=Charite Zertifizierungsstelle,DC=charite,DC=de
(11:11:40) nss: partial certificate chain
(11:11:40) certificate/x509/tls_cached: Starting verify for s-ocs01.charite.de
(11:11:40) certificate/x509/tls_cached: Checking for cached cert...
(11:11:40) certificate/x509/tls_cached: ...Found cached cert
(11:11:40) nss/x509: Loading certificate from /home/hildeb/.purple/certificates/x509/tls_peers/s-ocs01.charite.de
(11:11:40) certificate/x509/tls_cached: Peer cert matched cached
(11:11:40) nss/x509: Exporting certificate to /home/hildeb/.purple/certificates/x509/tls_peers/s-ocs01.charite.de
(11:11:40) util: Writing file /home/hildeb/.purple/certificates/x509/tls_peers/s-ocs01.charite.de
(11:11:40) certificate: Successfully verified certificate for s-ocs01.charite.de
(11:11:40) stun: using server
(11:11:40) stun: using server
(11:11:40) stun: using server
(11:11:40) sipe: SIP transactions count:1 after addition
(11:11:40) sipe:
MESSAGE START >>>>>>>>>> SIP - 2012-03-23T10:11:40.933312Z
REGISTER sip:charite.de SIP/2.0
Via: SIP/2.0/tls 141.42.231.227:39420;branch=z9hG4bKF859B7BF112F1CF46533
From: <sip:<email address hidden>>;tag=4326261466;epid=56cde94cd68b
To: <sip:<email address hidden>>
Max-Forwards: 70
CSeq: 1 REGISTER
User-Agent: Purple/2.10.2 Sipe/1.11.2 (linux-x86_64; )
Call-ID: DB76gD477a517Ei1C11mAD82t9AA5b0018xD97Ax
Contact: <sip:141.42.231.227:39420;transport=tls;ms-opaque=d3470f2e1d>;methods="INVITE, MESSAGE, INFO, SUBSCRIBE, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY";proxy=replace;+sip.instance="<urn:uuid:cc4eb680-28c4-504c-9ff4-5a0b5e4ee393>"
Supported: gruu-10, adhoclist, msrtc-event-categories, com.microsoft.msrtc.presence
Event: registration
Allow-Events: presence
ms-keep-alive: UAC;hop-hop=yes
Content-Length: 0

MESSAGE END >>>>>>>>>> SIP - 2012-03-23T10:11:40.933312Z
(11:11:41) sipe: transport_input_common: new buffer length 4096
(11:11:41) sipe:
MESSAGE START <<<<<<<<<< SIP - 2012-03-23T10:11:41.091638Z
SIP/2.0 401 Unauthorized
Date: Fri, 23 Mar 2012 10:11:41 GMT
WWW-Authenticate: NTLM realm="SIP Communications Service", targetname="s-ocs01.charite.de", version=4
WWW-Authenticate: Kerberos realm="SIP Communications Service", targetname="sip/s-ocs01.charite.de", version=4
From: <sip:<email address hidden>>;tag=4326261466;epid=56cde94cd68b
To: <sip:<email address hidden>>;tag=332BBE16C64694D2786630C76E4C25E8
Call-ID: DB76gD477a517Ei1C11mAD82t9AA5b0018xD97Ax
CSeq: 1 REGISTER
Via: SIP/2.0/tls 141.42.231.227:39420;branch=z9hG4bKF859B7BF112F1CF46533;ms-received-port=39420;ms-received-cid=26100
Content-Length: 0

MESSAGE END <<<<<<<<<< SIP - 2012-03-23T10:11:41.091638Z
(11:11:41) sipe: process_input_message: msg->response(401),msg->method(REGISTER)
(11:11:41) sipe: process_input_message: RE-REGISTER CSeq: 1
(11:11:41) sipe: process_input_message: we have a transaction callback
(11:11:41) sipe: process_register_response: got response to REGISTER; expires = 0
(11:11:41) sipe: process_register_response: REGISTER retries 1
(11:11:41) sipe: process_register_response: Auth header: Kerberos realm="SIP Communications Service", targetname="sip/s-ocs01.charite.de", version=4
(11:11:41) sipe: fill_auth: type Kerberos
(11:11:41) stun: using server
(11:11:41) stun: using server
GSS-API error in gss_init_sec_context (GSS): Unspecified GSS failure. Minor code may provide more information
GSS-API error in gss_init_sec_context (Mech): Configuration file does not specify default realm
ERROR: sip_sec_init_sec_context__krb5: failed to initialize context. ret=851968
(11:11:41) connection: Connection error on 0x7f66be0e2010 (reason: 2 description: Failed to authenticate to server)
(11:11:41) sipe: SIP transactions count:2 after addition
(11:11:41) sipe:
MESSAGE START >>>>>>>>>> SIP - 2012-03-23T10:11:41.117138Z
REGISTER sip:charite.de SIP/2.0
Via: SIP/2.0/tls 141.42.231.227:39420;branch=z9hG4bK5CF1AC42F9926439EC54
From: <sip:<email address hidden>>;tag=5925636926;epid=56cde94cd68b
To: <sip:<email address hidden>>
Max-Forwards: 70
CSeq: 2 REGISTER
User-Agent: Purple/2.10.2 Sipe/1.11.2 (linux-x86_64; )
Call-ID: DB76gD477a517Ei1C11mAD82t9AA5b0018xD97Ax
Contact: <sip:141.42.231.227:39420;transport=tls;ms-opaque=d3470f2e1d>;methods="INVITE, MESSAGE, INFO, SUBSCRIBE, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY";proxy=replace;+sip.instance="<urn:uuid:cc4eb680-28c4-504c-9ff4-5a0b5e4ee393>"
Supported: gruu-10, adhoclist, msrtc-event-categories, com.microsoft.msrtc.presence
Event: registration
Allow-Events: presence
ms-keep-alive: UAC;hop-hop=yes
Content-Length: 0

MESSAGE END >>>>>>>>>> SIP - 2012-03-23T10:11:41.117138Z
(11:11:41) sipe: process_input_message: removing CSeq 2
(11:11:41) sipe: SIP transactions count:1 after removal
(11:11:41) account: Disconnecting account <email address hidden>,CHARITE\HILDEB (0x7f66bd1a95c0)
(11:11:41) connection: Disconnecting connection 0x7f66be0e2010
(11:11:41) sipe: SIP transactions count:0 after removal
(11:11:41) GLib: g_hash_table_destroy: assertion `hash_table != NULL' failed
(11:11:41) connection: Destroying connection 0x7f66be0e2010
(11:11:45) util: Writing file accounts.xml to directory /home/hildeb/.purple
(11:11:45) util: Writing file /home/hildeb/.purple/accounts.xml

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: pidgin-sipe 1.11.2-1ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-19.30-generic 3.2.11
Uname: Linux 3.2.0-19-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 1.95-0ubuntu1
Architecture: amd64
Date: Fri Mar 23 11:11:12 2012
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
ProcEnviron:
 TERM=xterm
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: pidgin-sipe
UpgradeStatus: Upgraded to precise on 2012-03-19 (3 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Andrew Bayliss (abayliss)]

Seems to be related to an NSS security fix, which the Pidgin devs are aware of, see their FAQ regarding NSS 3.13.1 (http://sourceforge.net/apps/mediawiki/sipe/index.php?title=FAQ). Starting Pidgin with NSS_SSL_CBC_RANDOM_IV=0 works around the problem for me.

[Ralf Hildebrandt (ralf-hildebrandt)]

Yep. Works for me. I owe you a beer (in Berlin, should you come here)