Asterisk AMI PJSIP auth lists and credential evidence

Choose the auth evidence boundary before querying

PJSIPShowAuths enumerates every loaded PJSIP auth object. It is broader than PJSIPShowEndpoint, which returns detail only for auth objects associated with one requested endpoint. Neither action proves that a challenge was sent, answered or accepted.

Record the responding node, installed branch, manager identity, timestamp and intended consumer. An auth object can be shared by several endpoints or referenced by an outbound registration, so object-name similarity is not an ownership proof.

Require the completed all-auth transaction

PJSIPShowAuths raises one AuthList event for each loaded auth object and terminates with AuthListComplete. Retain the action response, a unique ActionID, every row and the terminal EventList and ListItems fields. Timeout, socket silence or an expected count is not completion.

An empty completed list means this responding instance reported no loaded auth objects in that transaction. It does not prove a FreePBX record was never saved, that another node is empty, or that no external authentication system exists.

Treat every auth row as secret-bearing output

The documented AuthList and AuthDetail schemas include fields for a plain password, password digests, OAuth client data, OAuth secret and refresh token. A field can be empty for a particular auth type, but its schema is enough to make the action highly privileged. Do not publish raw rows, paste them into tickets or store them in general telemetry.

Use a dedicated least-privilege manager identity, protected transport, restricted network access, field-level redaction and bounded retention. Redaction must occur before logs, traces, error reports or analytics can capture the message.

Map auth objects to their actual consumers

PJSIPShowEndpoint can emit EndpointDetail and associated AuthDetail rows before EndpointDetailComplete. Compare endpoint Auth and OutboundAuth references with the returned object names and preserve repeated relationships. A separate outbound-registration object can also reference outbound auth.

The endpoint auth relationship supplies the UAS side that challenges incoming requests. outbound_auth supplies the UAC side that answers remote challenges. Asterisk warns against reusing one auth section for both because an empty realm has different meaning in the two roles.

Keep realms, algorithms and stored material version-sensitive

Current Asterisk documents digest and google_oauth auth types; the older userpass and md5 values are deprecated and converted to digest. password_digest, supported_algorithms_uac and supported_algorithms_uas arrived in specific maintenance releases and depend on the linked pjproject and OpenSSL capabilities.

A pre-computed digest binds username, realm and password for one algorithm. It cannot be converted into another algorithm or used with an unknown wildcard realm. Preserve the loaded realm, UAC/UAS algorithm sets and pjproject show buildopts evidence rather than inferring capability from configuration text.

Verify authentication and service outcomes separately

For one authorized test, preserve method, direction, Call-ID, CSeq, challenge status, realm, offered algorithms, selected auth object, retried request and final response. Endpoint identification can be IP-, username- or auth_username-based; the latter cannot match until an Authentication header exists after a challenge.

A loaded auth object does not prove identification, authentication, dialplan authorization, registration, call completion or media. No PBX, module, manager account, session, auth object, password, digest, OAuth secret, endpoint, registration, SIP challenge, packet, media stream or live call was inspected or tested.

Keep registration-associated AuthDetail rows inside the protected evidence boundary

The outbound-registration evidence guide requires early redaction and preserves the registration-to-auth relationship.

Redact AuthDetail at outbound-registration collection time

The AMI list diagnostic prevents password, OAuth secret and refresh-token fields from entering shared records.