Fix Mumble auth lookup for ATAK Vx plugin usernames#338
Open
Reijnn wants to merge 1 commit into
Open
Conversation
The ATAK Vx plugin sends the Mumble username as "callsign---uid", but MumbleAuthenticator looked up the full string, which never matches an OTS account. Strip the UID suffix before the lookup so authentication succeeds when the OTS username matches the ATAK callsign.
Contributor
Author
|
I like the promised changes, happy to test if you want. |
Contributor
TX-RX
added a commit
to TX-RX/OpenTAKServer
that referenced
this pull request
Jul 17, 2026
- resolve_identity: extract presented-name normalization into a pure _candidate_callsigns() helper (behavior-preserving) and add a .strip() on the ---<uid> suffix split, so a callsign portion carrying a stray leading/trailing space (e.g. "ANVIL ---<uid>") still matches TRIM()'d EUD rows. Mirrors upstream brian7704#338 while keeping our broader lookup chain (underscore->space, cert-CN fallback). - tests/test_mumble_authenticator.py: cover _candidate_callsigns, mumble_identity, and resolve_identity's lookup chain. Uses pytest.importorskip("Ice") since the module loads Murmur's Ice slice at import time. This is the only intentional divergence from the deployed authenticator (otherwise byte-identical); it is additive and behavior-preserving apart from the stray-space hardening. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TDzrz7kU1P2yNcPqv9oBUS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
callsign---uid(e.g.ANVIL---47c4c853-4e52-4b97-9a0b-08a0f961b0fa).MumbleAuthenticator.authenticate()looked up that full string in the OTS user database, which never matches an account (registered under just the callsign, e.g.ANVIL). Every Vx connection was rejected by Mumble with "Wrong certificate or password for existing user".---uidsuffix before thefind_userlookup, so authentication succeeds when the OTS username matches the ATAK callsign.Tested against OTS 1.7.12, ATAK 5.6.0.12, and the Vx plugin.
Test plan
tests/test_mumble_authenticator.pycovering thecallsign---uidand plain-username cases (guarded withpytest.importorskip("Ice")since Ice is a platform-specific dependency)