# Frequently Asked Questions

How does ENS-based authentication work?

The module uses cryptographic signatures to verify ENS domain ownership. Clients sign a message containing a UUID and timestamp with their private key, then the module recovers the signer's address and verifies it matches the current owner of the specified ENS domain.

What networks are supported?

Primary Network: Polygon mainnet (default configuration)

Other Supported Networks: Ethereum mainnet, Ethereum Sepolia testnet, or any EVM-compatible network with ENS contracts deployed.

Configuration: Set the appropriate RPC URL and contract addresses for your target network in the module parameters.

What are the X-Data and X-Sign headers?

X-Data: Contains authentication data in format "UUID:TIMESTAMP" where UUID is a unique identifier and TIMESTAMP is Unix timestamp when the signature was created.

X-Sign: Contains the Ethereum ECDSA signature of the X-Data value, signed with the private key corresponding to the ENS domain owner's address.

Example: X-Data: "550e8400-e29b-41d4-a716-446655440000:1640995200", X-Sign: "0x1b2c3d4e5f6789abcdef..."

How does the module handle wrapped ENS domains?

The module automatically detects wrapped ENS domains by first querying the ENS Registry. If the owner is the Name Wrapper contract address, it then queries the Name Wrapper contract to find the actual NFT owner. This ensures compatibility with both traditional and wrapped ENS domains.

What happens if the blockchain network is unavailable?

Authentication will fail if the RPC endpoint is unreachable or returns errors. For production deployments, use reliable RPC providers and consider implementing fallback authentication mechanisms. The module logs detailed error information when debug mode is enabled.

Do SIP clients need special modifications?

Yes, clients need to be modified to generate the required X-Data and X-Sign headers. Clients must implement Ethereum message signing functionality and include the cryptographic signature in SIP requests. Standard SIP digest authentication is not used.

How do I troubleshoot authentication failures?

1. Enable debug mode: modparam("auth_arnacon", "debug_mode", 1)

2. Check Kamailio logs for detailed error information

3. Verify ENS domain ownership on blockchain explorer

4. Test RPC endpoint connectivity and response times

5. Verify contract addresses are correct for your network

6. Check signature format and timestamp validity

What are the signature timeout considerations?

The signature timeout prevents replay attacks by rejecting signatures older than the configured timeout (default 30 seconds). Consider network latency and client clock synchronization when setting this value. Shorter timeouts provide better security but may cause issues with slow networks or unsynchronized clocks.

Is this suitable for production use?

Yes, but consider these factors: blockchain network reliability (use enterprise RPC providers), latency (blockchain calls add 100-500ms), client implementation complexity (requires cryptographic capabilities), and monitoring (implement comprehensive health checks).

Security Considerations: Ensure clients securely manage private keys, use HTTPS for all RPC endpoints, implement proper timestamp validation, and consider backup authentication for critical services.

What are the performance implications?

Each authentication requires 1-2 blockchain RPC calls (ENS Registry + potentially Name Wrapper), adding 100-500ms latency compared to database authentication. The module performs cryptographic operations locally (signature verification) which adds minimal overhead. Use connection pooling and reliable RPC providers to minimize network impact.

Can I use free RPC providers?

Free providers work for development and testing but have rate limits and no SLA guarantees. For production, use paid providers (Infura, Alchemy, QuickNode) for better reliability, higher rate limits, and support. Polygon mainnet has several reliable free options for low-volume production use.

Recommended Providers:

Polygon Mainnet: https://polygon-rpc.com (free), https://rpc.ankr.com/polygon (free)

Ethereum Mainnet: https://mainnet.infura.io/v3/YOUR_KEY (paid), https://eth.drpc.org (free tier)