Is the long-term authentication mechanism * mandatory * for WebRTC to work with TURN servers?

Question

I intend to launch my own TURN service for the WebRTC application using coturn - https://code.google.com/p/coturn/ . The guide talks about authentication and credentials:

... -a, --lt-cred-mech Use long-term credentials mechanism (this one you need for WebRTC usage). This option can be used with either flat file user database or PostgreSQL DB or MySQL DB or MongoDB or Redis for user keys storage. ... 

This sample client code also assumes that TURN requires credentials:

 // use google ice servers var iceServers = [ { url: 'stun:stun.l.google.com:19302' } // { url: 'turn:192.158.29.39:3478?transport=udp', // credential: 'JZEOEt2V3Qb0y27GRntt2u2PAYA=', // username: '28224511:1379330808' // }, // { url: 'turn:192.158.29.39:3478?transport=tcp', // credential: 'JZEOEt2V3Qb0y27GRntt2u2PAYA=', // username: '28224511:1379330808' // } ]; 

• Are they always required? (Coturn can be started without any auth mechanism, but it is not clear on the web page whether for WebRTC to work).
• If required, can I just create one set of credentials and use it for all clients? (The client code example is obviously intended for demonstration purposes only, but it seems you can hard code the credentials into the client code. If this is not possible / recommended, then what is the recommended way to pass the credentials to the client code?)

Answer 1

After testing, it seems that credential transfer is required for client code to work (otherwise, you will receive an error message in the console).

Leaving the "no-auth" parameter enabled in Coturn (or leaving comments of both lt-cred-mech and st-cred-mech), but still sending credentials in the JS application also does not work, as TURN messages somehow signed using password credentials. Perhaps Coturn does not expect clients to send authentication data if it works in non-authorization mode, so it does not know how to interpret the messages.

Decision

Including lt-cred-mech and hard-coded username and password in the Coturn and JS configuration file for the application seems to work. The static user entries are commented out in the Coturn configuration file - use the plain password format, not the key format.

Coturn config (this is the whole configuration file I worked with):

 fingerprint lt-cred-mech #single static user details for long-term authentication: user=username1:password1 #your domain here: realm=mydomain.com 

List of ICE servers from the JS web application:

 var iceServers = [ { url: 'turn:123.234.123.23:3478', //your TURN server address here credential: 'password1', //actual hardcoded value username: 'username1' //actual hardcoded value } ]; 

Obviously, this does not provide any real protection for the TURN server, since the credentials are visible to anyone (so everyone can use the processor bandwidth and time, using this as a relay).

In short:

• yes, long-term authentication is required to use TURN WebRTC.
• yes, it seems that you can just hardcode one set of credentials for everyone to use - coturn didn’t worry that two clients receive distributions simultaneously with the same credentials.
• One possible security solution with minimal problems would be the TURN REST API , which supports Coturn.