Getting HTTP 400 Bad Request when authenticating via ONVIF

[xtrdustin]

Hello,

We are using a Java library to talk to an Axis camera via the ONVIF protocol. However, when it sends credentials to authenticate, it receives an HTTP 400 Bad Request error from the camera.

Here is the XML content of the request we're sending (captured via the packet capture feature from the camera itself):

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
               xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
               xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <soap:Header>
        <wsse:Security>
            <wsse:UsernameToken>
                <wsse:Username>onviftest</wsse:Username>
                <wsse:Password
                        Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">
                    dQx1ajCWS9gbWy328nV9R9hKkpI=
                </wsse:Password>
                <wsse:Nonce
                        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">
                    MTg5NTI2NjA5Ng==
                </wsse:Nonce>
                <wsu:Created>2022-08-12T14:41:48Z</wsu:Created>
            </wsse:UsernameToken>
        </wsse:Security>
    </soap:Header>
    <soap:Body>
        <ns2:GetCapabilities xmlns:ns2="http://www.onvif.org/ver10/device/wsdl"
                             xmlns:ns3="http://www.onvif.org/ver10/schema"
                             xmlns:ns4="http://docs.oasis-open.org/wsn/b-2"
                             xmlns:ns5="http://www.w3.org/2005/08/addressing"
                             xmlns:ns6="http://docs.oasis-open.org/wsrf/bf-2"
                             xmlns:ns7="http://docs.oasis-open.org/wsn/t-1"
                             xmlns:ns9="http://www.w3.org/2004/08/xop/include"
                             xmlns:xmime="http://www.w3.org/2005/05/xmlmime">
            <ns2:Category>All</ns2:Category>
        </ns2:GetCapabilities>
    </soap:Body>
</soap:Envelope>

Can anybody see anything wrong with how we're authenticating, or have any ideas how to get it to work?

Incidentally, if there's a well-supported Java ONVIF library (including commercially supported) that's known to Just Work[tm] with Axis cameras, I'd love to know about that as well, as I'd rather just use that instead of the open source library we're using, which looks like it's not very actively maintained.

Thanks in advance!
-Dustin

[mattias-kindborg-at-work]

Hi @xtrdustin!

I don't know of any well supported Java ONVIF library, unfortunately, but the authentication process in ONVIF is described in the ONVIF Application Programmer's Guide chapter 6.1. Please have a look and see whether you can implement the steps in Java.

BTW, make sure to create your ONVIF user in the Axis device. ONVIF users are a separate thing from ordinary device users.