AES-CBC authentication and password validation
Now Bob receives the cipher and would like to authenticate it, so he can tell for sure, that the message really came from Alice (or anyone else who knows the passphrase). 


Bob should be using an AEAD mode of AES, full-stop. GCM is the go-to candidate for this, rolling your own CBC+HMAC mode is also possible, but should be used as a last resort and only if you emphatically know what you're doing.


  Another problem I'm struggling with is, how will Bob get the IV and the salt which were randomly generated at encryption time?


IVs and salts are not secret. Send them with the ciphertext.

Besides your direct question, it looks like you're trying to wire together your own transport encryption protocol. I strongly recommend you just use TLS instead. Barring that, I'd recommend using libsodium's out-of-the-box AEAD modes instead of rolling your own.