jQuery up to version 1.3 worked fine with your script, but version 1.4+ returned an error after the json challenges are received.

It seems from version 1.4 onwards they changed the .ajax request to return an error if the returned data wasn’t “proper” json.

v1.4+ doesn’t like the returned strings to be wrapped with apostrophes. I changed the index.php file to return the challenges wrapped in quotes and it works fine now.

Cheers from South Africa!

Stephan

thanks for your thoughts and this script. It’s worth to have a deeper look inside.

One improvement I have found by now: you can check if the password is equal to the username on the server-side too.

For this you could insert the following lines of code into ChapAuthenticationImpl.php below the block for checking if the pwd is empty (line 205):
// Check if the plaintext password is the same as the username.
else if ($this->passwordPlainTextTransform($username, $challenge1) == $password)
{
throw new ChapAuthenticationException('Password cannot be equal to the username');
}