Once we have our credentials, or if we've chosen to automatically create new credentials, we are ready to connect to the server. We first need to create a variable to hold our XMPP client:
private XmppClient xmppClient = null;
We then create the client using the connection details we've procured. We also provide the default language code that we will use, as well as a reference to the assembly that represents the current application. This assembly will be used to extract some basic information about the application, such as the application name and version. This information can be requested by other participants in the network:
this.xmppClient = new XmppClient(Host, Port,
UserName, PasswordHash, PasswordHashMethod, "en",
typeof(App).GetTypeInfo().Assembly)
{
AllowCramMD5 = false,
AllowDigestMD5 = false,
AllowPlain = false,
AllowScramSHA1 = true
};
this.xmppClient.OnStateChanged += this.StateChanged;
this.xmppClient.OnConnectionError += this.ConnectionError;
this.AttachFeatures();
Log.Informational("Connecting to " + this.xmppClient.Host + ":" + this.xmppClient.Port.ToString());
this.xmppClient.Connect();
When authenticating itself with the server, the client will use one authentication mechanism from a list of mechanisms presented to it by the server. Some of these mechanisms are more secure than others. While the client will validate the server certificate and check that it corresponds to the domain name, there's still a risk of losing user credentials if somebody manages to perform a downgrade attack while presenting a valid certificate anyway — especially if valid domain names are not used. To prevent credentials from leaking, you can explicitly turn off unsecure authentication mechanisms, such as PLAIN, CRAM-MD5, and DIGEST-MD5, and only allow SCRAM-SHA-1. This requires, however, that the server you connect to supports the SCRAM-SHA-1 mechanism.