client tcp-auth=file:filename=<file>

[redwil]

Short:
client ignores the file containing the password for tcp authentication

What I try to accomplish:
From the client use a script to start a xpra server bound to tcp on the remote over ssh using one time random generated password for that session. Session password stored in a file on the remote
attach to that tcp session using the password retrieved over ssh
Local intranet not overly concerned with encrypted communication after connection was established
Setup and sensitive info exchanged over ssh

Env:

• xpra 4.2.3
• opensuse leap 15.4

server command:

xpra start --pulseaudio=no --webcam=no \
    --notifications=no --exit-with-children=yes --terminate-children --sharing=no --mdns=yes --start-new-commands \
   --dbus-launch=no --start-child=xterm --bind-tcp=192.168.3.3:11001 \
    --tcp-auth=file:filename=/home/vmm/.xpra/xpst/1001/pw :1001`

client command

    xpra attach tcp://vmm@s1200:11001/1001,auth=file:filename=<abs-path-to-pw-file> \
   --pulseaudio=no --webcam=no --notifications=no --sharing=no --speaker=disabled --microphone=disabled \
   --enable-pings --debug=auth

NOTE:
I tried options --tcp-auth=file:filename=... and --auth=file:filename=...
From the log did not seem to find the file:
2023-07-18 12:25:58,855 handle(..) password_file=None

LOG:

2023-07-18 12:25:57,064 Xpra GTK3 X11 client version 4.2.3 64-bit
2023-07-18 12:25:57,101  running on Linux openSUSE 15.4 n/a
2023-07-18 12:25:57,102  window manager is 'Fluxbox'
2023-07-18 12:25:57,906 init_challenge_handlers(['all'])
2023-07-18 12:25:57,907 auth module name for 'uri': 'xpra.client.auth.uri_handler'
2023-07-18 12:25:57,908 auth module name for 'file': 'xpra.client.auth.file_handler'
2023-07-18 12:25:57,909 auth module name for 'env': 'xpra.client.auth.env_handler'
2023-07-18 12:25:57,910 auth module name for 'kerberos': 'xpra.client.auth.kerberos_handler'
2023-07-18 12:25:57,910 auth module name for 'gss': 'xpra.client.auth.gss_handler'
2023-07-18 12:25:57,911 auth module name for 'u2f': 'xpra.client.auth.u2f_handler'
2023-07-18 12:25:57,911 auth module name for 'prompt': 'xpra.client.auth.prompt_handler'
2023-07-18 12:25:57,912 auth module name for 'prompt': 'xpra.client.auth.prompt_handler'
2023-07-18 12:25:57,912 auth module name for 'prompt': 'xpra.client.auth.prompt_handler'
2023-07-18 12:25:57,912 auth module name for 'prompt': 'xpra.client.auth.prompt_handler'
2023-07-18 12:25:58,112 created unix domain socket '/run/user/1000/xpra/clients/owl-23047'
2023-07-18 12:25:58,193 OpenGL_accelerate module loaded
2023-07-18 12:25:58,199 Using accelerated ArrayDatatype
2023-07-18 12:25:58,323 Warning: cannot handle window transparency
2023-07-18 12:25:58,324  screen is not composited
2023-07-18 12:25:58,338 Warning: vendor 'Intel Open Source Technology Center' is greylisted,
2023-07-18 12:25:58,338  you may want to turn off OpenGL if you encounter bugs
2023-07-18 12:25:58,496 OpenGL enabled with Mesa DRI Intel(R) HD Graphics 530 (SKL GT2)
2023-07-18 12:25:58,700 missing some source information: cannot import name 'COMMIT'
2023-07-18 12:25:58,703  keyboard settings: rules=evdev, model=pc105, layout=us
2023-07-18 12:25:58,738  desktop size is 1920x1080 with 1 screen:
2023-07-18 12:25:58,738   :0.0 (508x285 mm - DPI: 96x96) workarea: 1920x1062
2023-07-18 12:25:58,739     AUO eDP-1 (344x193 mm - DPI: 142x142)
2023-07-18 12:25:58,853 processing challenge: [b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password']
2023-07-18 12:25:58,854 challenge handlers: [uri, file, env, kerberos, gss, u2f, prompt, prompt, prompt, prompt]
2023-07-18 12:25:58,854 calling challenge handler uri
2023-07-18 12:25:58,854 <bound method Handler.handle of uri>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,855 calling challenge handler file
2023-07-18 12:25:58,855 handle(..) password_file=None
2023-07-18 12:25:58,856 <bound method Handler.handle of file>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,856 calling challenge handler env
2023-07-18 12:25:58,856 <bound method Handler.handle of env>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,856 calling challenge handler kerberos
2023-07-18 12:25:58,856 hmac+sha512 is not a kerberos challenge
2023-07-18 12:25:58,856 <bound method Handler.handle of kerberos>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,856 calling challenge handler gss
2023-07-18 12:25:58,856 hmac+sha512 is not a gss challenge
2023-07-18 12:25:58,856 <bound method Handler.handle of gss>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,857 calling challenge handler u2f
2023-07-18 12:25:58,857 hmac+sha512 is not a u2f challenge
2023-07-18 12:25:58,857 <bound method Handler.handle of u2f>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=False
2023-07-18 12:25:58,857 calling challenge handler prompt
2023-07-18 12:25:58,857 do_process_challenge_prompt([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'], 'password') get_pinentry_command()=None
2023-07-18 12:25:58,899 <bound method Handler.handle of prompt>([b'challenge', b'\x03\x8c>\x98\xe3\x01\xc7\x1f+c\x04D\xe2\xb0y{4\x97\xa3\xde\xf9\xbco1cs\x0b\x97M\x81\xdd\xc3\xc1\x7f))A\xbe57\x8aad\xd2\x1c_\xb7\x92\xd3\x96\x88\xc4\xb6\x08v\xb1t\x87\xe0m\x10\xf8\x8a`', b'', b'hmac+sha512', b'hmac+sha512', b'password'])=True

[totaam]

xpra 4.2.3

This is not a supported version.

--mdns=yes --start-new-commands

These are already the defaults.

--pulseaudio=no

This doesn't do anything with xpra attach.

--enable-pings

This is already the default.

xpra attach tcp://vmm@s1200:11001/1001,auth=file:filename=<abs-path-to-pw-file>

The 1001 display number is likely unnecessary here since you only have a single server running on that TCP port.
Also, this syntax is not valid: client authentication handlers are configured using the challenge-handlers option.
ie:

xpra attach tcp://127.0.0.1:11001/ --challenge-handlers=file:filename=./password.txt -d auth

The documentation has been improved in de7ab1d : https://github.com/Xpra-org/xpra/blob/master/docs/Usage/Authentication.md

[redwil]

Thank you will try again with your suggestions especially the link to the doc. Unfortunately google hits on xpra doc lead to much earlier versions