java - Digest authentication in Android using HttpURLConnection -

as question allready says, trying digest authentication in android.
until have used defaulthttpclient , it's authentication method (using usernamepasswordcredentials , on), deprecated since android 5 , removed in android 6.
switch defaulthttpclient httpurlconnection.
trying achieve digest authentication, should work pretty simple explained here:

authenticator.setdefault(new authenticator() {     protected passwordauthentication getpasswordauthentication() {         return new passwordauthentication(username, password);     } }); 

but getpasswordauthentication gets never called reason.
during search problem found different posts, saying digest authentication not supported httpurlconnection in android, posts 2010-2012, not sure if still true. using httpurlconnection digest authentication in our desktop java application, work.

i found posts, talking okhttp. okhttp seems used android under hood (to more specific httpurlconnectionimpl). httpurlconnectionimpl bit strange, not shown in eclipse type hierarchy , not able debug it. should com.squareup.okhttp.internal.huc.httpurlconnectionimpl, while in android com.android.okhttp.internal.http.httpurlconnectionimpl.

so not able digest authentication httpurlconnection in android.
can tell me how without external libraries?

edit:
server asks digest authentication:

www-authenticate: digest realm="realm name",domain="/domain",nonce="nonce",algorithm=md5,qop="auth" 

so basic-authentication shouldn' work, server asking digest.

the answer is, httpurlconnection not support digest.

you therefore have implement rfc2617 yourself.

you can use following code baseline implementation: http digest auth android.

the steps involve (see rfc2617 reference):

• if 401 response, iterate on www-authenticate headers , parse them:
  • check if algorithm md5 or undefined, (optionally select auth qop option), otherwise ignore challenge , go next header.
  • get credentials using authenticator.requestpasswordauthentication.
  • calculate h(a1) using username, realm , password.
  • store canonical root url, realm, ha1, username, nonce (+ optionally algorithm, opaque , client selected qop option if present).
  • retry request.
• on each request, iterate on realms have session information stored canonical root url:
  • calculate h(a2) using request method , path.
  • calculate h(a3) using ha1, nonce (+ optionally nc, cnonce, qop) , ha2.
  • build , add authorization header httpurlconnection.
• implement sort of session pruning.

by using authenticator, can make sure, httpurlconnection supports digest natively, code not being used anymore (because wont receive 401 in first place).

this quick summary on how implement it, idea.

if want go further implement sha256 well: rfc7616