can't connect to Jabber account

[drunken monkey]

Since updating to Ubuntu Precise (before, I hand Lucid) Pidgin won't connect to my Jabber account. It gets deactivated with the message "Not authorized", no further messages. It happens regardless of whether I use my old configuration or move the whole .purple folder and set the account up afresh.
However, it works with (e.g.) Gajim, and even with Pidgin on Windows (2.10.3, the same version), so this is almost definitely a Pidgin problem.

Here is the (hopefully) relevant (and slightly censored) output of `pidgin --debug`:

(15:39:09) account: Connecting to account LOGIN@SERVER/Home.
(15:39:09) connection: Connecting. gc = 0x7ffd53fa2a10
(15:39:09) util: Writing file ~/.purple/icons/7661745cff2f4fd50e2859c6b3b3e3b844f0412c.png
(15:39:09) dnssrv: querying SRV record for SERVER: _xmpp-client._tcp.SERVER
(15:39:09) dnssrv: found 1 SRV entries
(15:39:09) dnsquery: Performing DNS lookup for HOST
(15:39:09) dns: Created new DNS child 11371, there are now 1 children.
(15:39:09) dns: Successfully sent DNS request to child 11371
(15:39:09) dns: Got response for 'HOST'
(15:39:09) dnsquery: IP resolved for HOST
(15:39:09) proxy: Attempting connection to 128.130.95.20
(15:39:09) proxy: Connecting to HOST:5222 with no proxy
(15:39:09) proxy: Connection in progress
(15:39:09) proxy: Connecting to HOST:5222.
(15:39:09) proxy: Connected to HOST:5222.
(15:39:09) jabber: Sending (LOGIN@SERVER/Home): <?xml version='1.0' ?>
(15:39:09) jabber: Sending (LOGIN@SERVER/Home): <stream:stream to='SERVER' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>
(15:39:09) jabber: Recv (173): <?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' id='1346731435' from='SERVER' version='1.0' xml:lang='en'>
(15:39:09) jabber: Recv (536): <stream:features><starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/><compression xmlns='http://jabber.org/features/compress'><method>zlib</method></compression><mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><mechanism>SCRAM-SHA-1</mechanism><mechanism>DIGEST-MD5</mechanism><mechanism>PLAIN</mechanism></mechanisms><c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='———'/><register xmlns='http://jabber.org/features/iq-register'/></stream:features>
(15:39:09) jabber: Sending (LOGIN@SERVER/Home): <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
(15:39:09) jabber: Recv (50): <proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
…
(15:39:09) certificate/x509/tls_cached: Starting verify for SERVER
(15:39:09) certificate/x509/tls_cached: Checking for cached cert...
(15:39:09) certificate/x509/tls_cached: ...Found cached cert
(15:39:09) nss/x509: Loading certificate from ~/.purple/certificates/x509/tls_peers/SERVER
(15:39:09) certificate/x509/tls_cached: Peer cert matched cached
(15:39:09) nss/x509: Exporting certificate to ~/.purple/certificates/x509/tls_peers/SERVER
(15:39:09) util: Writing file ~/.purple/certificates/x509/tls_peers/SERVER
(15:39:09) certificate: Successfully verified certificate for SERVER
(15:39:09) jabber: Sending (ssl) (LOGIN@SERVER/Home): <stream:stream to='SERVER' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>
(15:39:09) jabber: Recv (ssl)(173): <?xml version='1.0'?><stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' id='2292024795' from='SERVER' version='1.0' xml:lang='en'>
(15:39:09) jabber: Recv (ssl)(485): <stream:features><compression xmlns='http://jabber.org/features/compress'><method>zlib</method></compression><mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><mechanism>SCRAM-SHA-1</mechanism><mechanism>DIGEST-MD5</mechanism><mechanism>PLAIN</mechanism></mechanisms><c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='iuv1wp1cS6sjN8DwA1g+KZMr/14='/><register xmlns='http://jabber.org/features/iq-register'/></stream:features>
(15:39:09) sasl: Mechs found: SCRAM-SHA-1 DIGEST-MD5 PLAIN
(15:39:09) jabber: Sending (ssl) (LOGIN@SERVER/Home): <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='DIGEST-MD5' xmlns:ga='http://www.google.com/talk/protocol/auth' ga:client-uses-full-bind-result='true'/>
(15:39:09) jabber: Recv (ssl)(148): <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>———</challenge>
(15:39:09) sasl: DIGEST-MD5 client step 2
(15:39:09) sasl: DIGEST-MD5 parse_server_challenge()
(15:39:09) sasl: DIGEST-MD5 ask_user_info()
(15:39:09) sasl: DIGEST-MD5 make_client_response()
(15:39:09) jabber: Sending (ssl) (LOGIN@SERVER/Home): <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>———</response>
(15:39:09) jabber: Recv (ssl)(77): <failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><not-authorized/></failure>
(15:39:09) sasl: DIGEST-MD5 client mech dispose
(15:39:09) sasl: DIGEST-MD5 common mech dispose
(15:39:09) sasl: Mechs found: SCRAM-SHA-1 PLAIN
(15:39:09) sasl: No worthy mechs found
(15:39:09) connection: Connection error on 0x7ffd53fa2a10 (reason: 2 description: Nicht autorisiert)
(15:39:09) account: Disconnecting account LOGIN@SERVER/Home (0x7ffd53acab90)
(15:39:09) connection: Disconnecting connection 0x7ffd53fa2a10
(15:39:09) jabber: Sending (ssl) (LOGIN@SERVER/Home): </stream:stream>
(15:39:09) connection: Destroying connection 0x7ffd53fa2a10

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: pidgin 1:2.10.3-0ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-24.37-generic 3.2.14
Uname: Linux 3.2.0-24-generic x86_64
NonfreeKernelModules: fglrx
ApportVersion: 2.0.1-0ubuntu7
Architecture: amd64
Date: Thu May 3 15:33:14 2012
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
ProcEnviron:
 TERM=xterm
 PATH=(custom, user)
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
SourcePackage: pidgin
UpgradeStatus: No upgrade log present (probably fresh install)

[Net4home-King (kevin-hedquist)]

I too have this issue with the Jabber/XMPP protocol using the xfce4 gdm, but on my laptop I'm able to run the unity gdm and it works fine. Both machines are running Ubuntu 12.04 LTS x86_64 with the latest kernel.

[Mati (mati-fsinf)]

I run jabber.at and jabber.fsinf.at and frequently get users with that problem. I can myself confirm the problem. The weird thing is that it does work on jabber.at and *not* on jabber.fsinf.at, despite them having almost identical configuration - one key difference: jabber.fsinf.at has account creation disabled. I don't know if that could be the problem.

In any case, a pidgin 2.10.2 from fedora works fine, as does a Gajim account.

Package maintainers: Please don't hesitate to contact (<email address hidden>) me, I am happy to help debug the problem.

greetings, Mati

[WSC (ohir)]

I can confirm this bug. On my side (precise 12.04 32bit) it affects both google and jabber xmpp.

(17:21:05) dnsquery: IP resolved for jabber.org
(17:21:05) proxy: Attempting connection to 208.68.163.220
(17:21:05) proxy: Connecting to jabber.org:5222 with no proxy
(17:21:05) proxy: Connection in progress
(17:21:06) proxy: Connecting to jabber.org:5222.
(17:21:06) proxy: Connected to jabber.org:5222.
...
[Opening chat window to other jabber.org user]
...
(17:23:46) GLib-GObject: value "-1216691852" of type `gint' is invalid
or out of range for property `weight' of type `gint'
(17:23:46) GLib-GObject: value "-1216691852" of type `gint' is invalid
or out of range for property `weight' of type `gint'
(17:23:46) gtkconv: setting active conversation on toolbar 0xba135c78
(17:23:46) gtkconv: setting active conversation on toolbar 0xba135c78
(17:23:46) prefs: /pidgin/conversations/toolbar/wide changed, scheduling save.
(17:23:46) gtkconv: setting active conversation on toolbar 0xba135c78
(17:23:46) prefs: /pidgin/conversations/im/x changed, scheduling save.
[...]
[Type message]
(17:23:54) conversation: typed...
--- Same GLib error as above

================================================
ohir

[alien8 (fb-alien8)]

I assume that bug is the same as described here: https://support.process-one.net/browse/EJAB-1529

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Adrien Cunin (adri2000)]

The bug mentioned by alien8 is bug #1048634.

[Benedikt Gollatz (benedikt)]

I started experiencing this bug after upgrading my Jabber server (running ejabberd) to Debian wheezy. Someone created an associated bug report which can be found at <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654853>.

I also started to experience this bug on a different machine (previously not experiencing it there, even after the server upgrade) after upgrading it to Fedora 19. The Fedora people have fixed this bug (bug report at <https://bugzilla.redhat.com/show_bug.cgi?id=979052>) by explicitly adding a dependency on the cyrus-sasl-scram library (see <http://pkgs.fedoraproject.org/cgit/pidgin.git/commit/?id=a3d3522983ef0633e960dcaefa1973c8667eb2ea>). I can confirm that this fix works for me: the pidgin SASL module will prefer SCRAM-SHA1 over DIGEST-MD5 and pidgin authenticates successfully.

While this probably doesn't address the underlying bug (possibly in ejabberd) maybe Ubuntu can also ship the appropriate libraries for SCRAM-SHA1 support in SASL and fix user experience in this way.

[drunken monkey (remus)]

Ah, thanks a lot for posting this!

However, I couldn't apply this workaround successfully on Ubuntu: I had libsasl2-2 already installed, and adding libgsasl7, too, also made no difference. Or would I need to re-install pidgin for this to take effect?
Have you succeeded in applying this fix in Ubuntu? If so, how?

Thanks again for sharing this! In any case, I hope it brings some developer on the right track.

[Benedikt Gollatz (benedikt)]

Sorry for answering late, apparently I'm not getting e-mail on launchpad tickets by default.

I resolved the issue for myself by changing the configuration of my ejabberd as explained in http://git.deb.at/w/pkg/ejabberd.git/commit/1c56fb6d96725a465e7ddb401db7551a8ea64769 -- unfortunately this was missing in the documentation at the time of the upgrade.

You'll have to ask your server operator to do this for you.