SCRAM authentication is one of the new features in version 4.5. Check this blog entry for an introduction on SCRAM in Couchbase.

In this article we will cover how to monitor SCRAM handshake from Java.

First, you do not have to do anything special from your Java code to use SCRAM. SCRAM is enabled by default, and will be used if your Java SDK version is 2.2.5 or higher and your Couchbase Server version is 4.5 or higher.

SCRAM will be used when you open a bucket with a password.

To monitor the SCRAM authentication from your Java code, simply set your debug level to FINEST:

Now, at some point in your code you access the bucket:

You can see the now the authentication conversation:

We show here only the steps where server inform about supported authentication method and client choose the strongest. In this handshake server supports:

  • SCRAM-SHA512
  • SCRAM-SHA256
  • SCRAM-SHA1
  • CRAM-MD5 PLAIN

And the client chooses the strongest: SCRAM-SHA512

The same code running against Couchbase 4.1 produces this output:

Here you can see how CRAM-MD5 is selected.

You can also monitor the authentication by sniffing the network traffic. One great tool for this task is wireshark. You can grab traffic and then filter by protocol “Couchbase”:

ws_scram

To finish, you have probably noticed how easy is to monitor the authentication handshake, this is why we recommend to use TLS in your client-server authentication.

In this way, a man-in-the middle attack is avoided by the fact that SCRAM uses mutual authentication and server must respond to a challenge to proof he knows the “secret” based on the client hashed password.

Happy authentication!

Posted by The Couchbase Team

Leave a reply