@mhoogenbosch
Well, using IsSpy I was able to capture a working Onvif call for the Ranger 2C, so no need to use cloud / app / secret and other things…
It is just an HTTP POST XML Soap Call to port 80 : URI = “/onvif/ptz_service”
The full Post in pretty format is :
POST /onvif/ptz_service HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8; action="http://www.onvif.org/ver20/ptz/wsdl/ContinuousMove"
Host: 192.168.0.108
Content-Length: 1513
Accept-Encoding: gzip, deflate
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<Security xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="0">
<UsernameToken>
<Username>admin</Username>
<Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">[Your password in Digest format]=</Password>
<Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">[Your password in Basic format (base 64 of user:password)]</Nonce>
<Created xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2022-12-28T13:00:46.317Z</Created>
</UsernameToken>
</Security>
<a:Action s:mustUnderstand="1">http://www.onvif.org/ver20/ptz/wsdl/ContinuousMove</a:Action>
<a:MessageID>urn:uuid:112224f3-eeca-4958-aa3d-43c46e6fb57e</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">http://192.168.0.108/onvif/ptz_service</a:To>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<ContinuousMove xmlns="http://www.onvif.org/ver20/ptz/wsdl">
<ProfileToken>Profile001</ProfileToken>
<Velocity>
<PanTilt xmlns="http://www.onvif.org/ver10/schema" x="-1" y="0" space="http://www.onvif.org/ver10/tptz/PanTiltSpaces/VelocityGenericSpace"/>
</Velocity>
<Timeout>PT1S</Timeout>
</ContinuousMove>
</s:Body>
</s:Envelope>
I tryed with Telnet on port 80 and it works very well, just open command line :
telnet 192.168.0.108 80
Than copy:paste the entire text above, you should received HTTP 200 OK and camera should move according to your x & y value (note It seems you can only use X OR Y not both one should be set to zero in my case.
Obviously you must :
Set your camera IP
Set your Digest & Basic password value
Set either X +/-1 or Y=+/-1
Set the real content-length
of the payload in the header (just use VSCode and select the payload text without header it will give you the size to set for the header (on the the bottom bar)
Note: use CRLF for line ending
I managed to remove some useless datas, the minimal requirement seems to be :
POST /onvif/ptz_service HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8; action="http://www.onvif.org/ver20/ptz/wsdl/ContinuousMove"
Host: 192.168.0.108
Content-Length: 1348
Accept-Encoding: gzip, deflate
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<Security xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="0">
<UsernameToken>
<Username>admin</Username>
<Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">[Your password in Digest format]</Password>
<Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">[Your password in Basic format (base 64 of user:password)]</Nonce>
<Created xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2022-12-28T13:00:46.317Z</Created>
</UsernameToken>
</Security>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<ContinuousMove xmlns="http://www.onvif.org/ver20/ptz/wsdl">
<ProfileToken>Profile001</ProfileToken>
<Velocity>
<PanTilt xmlns="http://www.onvif.org/ver10/schema" x="0" y="+1" space="http://www.onvif.org/ver10/tptz/PanTiltSpaces/VelocityGenericSpace"/>
</Velocity>
<Timeout>PT1S</Timeout>
</ContinuousMove>
</s:Body>
</s:Envelope>
I guess using CURL it should not be too hard to create a service using this template.
EDIT: Oups, I forgot th packet to make the camera stop moving :
POST /onvif/ptz_service HTTP/1.1
Content-Type: application/soap+xml; charset=utf-8; action="http://www.onvif.org/ver20/ptz/wsdl/Stop"
Host: 192.168.0.108
Content-Length: 1339
Accept-Encoding: gzip, deflate
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<Security xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="0">
<UsernameToken>
<Username>admin</Username>
<Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">[Your password in Digest format]</Password>
<Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">[Your password in Basic format (base 64 of user:password)]</Nonce>
<Created xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2000-01-01T01:01:12.791Z</Created>
</UsernameToken>
</Security>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<Stop xmlns="http://www.onvif.org/ver20/ptz/wsdl">
<ProfileToken>Profile001</ProfileToken>
<PanTilt>true</PanTilt>
<Zoom>true</Zoom>
</Stop>
</s:Body>
</s:Envelope>
EDIT/ERRATUM:
I say something wrong… sorry,
You have to choose a random string
Nonce must be the Base64 encodeded random string
Digest password must be : Base64(sha1(randomNumber+created+password));
Exemple:
If you choose random : “AAA”
Your password is : “MyPassword”
Create date is : “2000-01-01T01:01:12.791Z”
Nonce must be set with Base64(“AAA”);
PasswordDigest must be set with Base64(sha1(“AAA2000-01-01T01:01:12.791ZMyPassword”))
I tried plain text password and the Ranger2C does not handle this case, it must be a digest password as explained above. But once it done PTZ works very well and did not require anything from outside the LAN.