Add support for HTTP Basic authentication

[bsriramprasad]

Add support for HTTP Basic authentication over TLS-protected connections (RFC 7617)

Motivation

As ONVIF devices increasingly operate in cloud-connected and TLS-only deployments, the current specification's exclusive reliance on HTTP Digest authentication creates friction for modern integration patterns:

• Cloud and proxy architectures: Digest authentication cannot be proxied transparently. Because the response hash is bound to the request URI and to a device-issued nonce, any intermediary that rewrites paths or distributes requests across workers must terminate and re-originate authentication itself — holding password-equivalent credentials for each device and maintaining per-device auth state. Basic authentication, being stateless and path-independent, forwards unchanged, which simplifies cloud-based device access at the cost of requiring TLS
  with proper certificate validation end to end.

• Regulatory direction: Frameworks such as the EU Cyber Resilience Act and NIS2 impose secure-by-design and risk-management obligations that are pushing deployments toward encrypted-by-default transport, making TLS-everywhere an increasingly common baseline.

• Simplified authentication stack: Organizations enforcing TLS-only access can use Basic over TLS rather than maintaining Digest challenge-response infrastructure alongside TLS termination.

• Interoperability with standard HTTP clients and tooling: HTTP Basic is universally supported across HTTP client libraries, browsers, and automation tooling without custom Digest handling.

This change introduces HTTP Basic authentication as an optional, TLS-only feature with an explicit capability signal (HttpBasic).

Compatibility Analysis

Aspect	Impact
Backward compatible	A device supporting Basic shall also support digest and include a Digest challenge in every 401 response. Existing Digest-only clients see unchanged behaviour and need not be aware of Basic.
Capability signalling	HttpBasic is optional; per existing Core convention, an omitted capability indicates the device does not support it.
Profiles	No profile requirements change. HTTP digest remains mandatory wherever profile specifications require it; this PR does not amend any profile document.
Discovery	Clients negotiate via the WWW-Authenticate challenge as HTTP requires; the capability is for configuration and planning, not negotiation.
Schema	New optional HttpBasic boolean attribute in devicemgmt.wsdl (GetServiceCapabilities path).
Security Service	No changes. All edits are scoped to Core and the Device Management WSDL.

Summary of Changes

doc/Core.xml

Section	Change
Normative references	Added RFC 7617
Authentication over HTTP and HTTPS	Added HTTP Basic over TLS-protected connections as an authentication exception alongside existing exceptions (WS-UsernameToken, TLS client auth, JWT)
Authentication over HTTP and HTTPS	Added three normative requirements for devices supporting Basic: accept preemptive credentials, offer a Basic challenge only over TLS, and continue to offer Digest in every 401
Authentication over HTTP and HTTPS	Listed HTTP Basic over TLS-protected connections as an accepted authentication method for RTSP and HTTP methods
GetServiceCapabilities table	Added HttpBasic row to Security capabilities (updated morerows count)
Appendix (new)	HTTP Basic challenge-response example over a TLS-protected connection
Revision history	Added entry

wsdl/ver10/device/wsdl/devicemgmt.wsdl

Section	Change
SecurityCapabilities	Added HttpBasic boolean attribute

References

• RFC 7617 - The 'Basic' HTTP Authentication Scheme
• RFC 7616 - HTTP Digest Access Authentication (existing reference)
• RFC 2617 - HTTP Authentication: Basic and Digest Access Authentication (existing reference)

[MariaYa0091]

Is HTTP Basic authentication really to be applicable for RTSP?

[bsriramprasad]

RTSP 1.0 mandates Basic

• https://datatracker.ietf.org/doc/html/rfc2326#appendix-D.2.2

RTSP2.0 does not mention Basic

• https://datatracker.ietf.org/doc/html/rfc7826#section-19.1

[bsriramprasad]

Additional clarification on usage of basic for RTSP

[MariaYa0091]

General note:

It could a bit of backward compatibility issue for clients. They could expect no HTTP digest for HTTPS connection (as it was required before).

Also for all currently existing profiles using of HTTP digest for HTTPS to be the expected behavior. There were no exceptions before.

[bsriramprasad]

General note:

It could a bit of backward compatibility issue for clients. They could expect no HTTP digest for HTTPS connection (as it was required before).

Also for all currently existing profiles using of HTTP digest for HTTPS to be the expected behavior. There were no exceptions before.

Latest changes addresses your concern.