Skip to content

Commit 5e56335

Browse files
emrahcomemrahcom
authored
Improve the authentication pages (#574)
* fix(docs/dev-guide): format secure-domain.md * refactor(docs/dev-guide): improve the secure domain notes * fix(docs/dev-guide): fix titles of authentication pages * feat(docs/dev-guide): add the token authentication guide * fix(docs/dev-guide): format issues in token-authentication.md * fix(docs/dev-guide): update the guest domain in auth pages * fix(docs/dev-guide): format issues in secure-domain.md * docs(dev-guide): quoted string in hocon config
1 parent e102bda commit 5e56335

File tree

4 files changed

+235
-48
lines changed

4 files changed

+235
-48
lines changed

‎docs/devops-guide/ldap-authentication.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
id: ldap-authentication
3-
title: LDAP authentication
4-
sidebar_label: LDAP Authentication
3+
title: LDAP Authentication
4+
sidebar_label: Authentication (LDAP)
55
---
66

77
:::note

‎docs/devops-guide/secure-domain.md‎

Lines changed: 85 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,132 +1,171 @@
11
---
22
id: secure-domain
3-
title: Secure Domain setup
3+
title: Secure Domain Setup
44
sidebar_label: Authentication (Secure Domain)
55
---
66

7-
It is possible to allow only authenticated users to create new conference
8-
rooms. Whenever a new room is about to be created, Jitsi Meet will prompt for
9-
a user name and password. After the room is created, others will be able to join
10-
from anonymous domain. Here's what has to be configured:
7+
It is possible to allow only authenticated users to create new conference rooms.
8+
Whenever a new room is about to be created, Jitsi Meet will prompt for a user
9+
name and password. After the room is created, others will be able to join from
10+
anonymous domain. Here's what has to be configured:
1111

1212
## Prosody configuration
1313

14-
If you have installed Jitsi Meet from the Debian package, these changes should be made in `/etc/prosody/conf.avail/[your-hostname].cfg.lua`
14+
If you have installed Jitsi Meet from the Debian package, these changes should
15+
be made in `/etc/prosody/conf.avail/[your-hostname].cfg.lua`
16+
17+
In the example below, this hostname is assumed to be `jitsi.example.com`. Update
18+
this value according to your own hostname.
1519

1620
### Enable authentication
1721

18-
Inside the `VirtualHost "[your-hostname]"` block, replace anonymous authentication with hashed password authentication:
22+
Inside the `VirtualHost "[your-hostname]"` section, replace anonymous
23+
authentication with hashed password authentication:
1924

2025
```
21-
VirtualHost "jitsi-meet.example.com"
26+
VirtualHost "jitsi.example.com"
2227
authentication = "internal_hashed"
2328
```
2429

25-
Replace `jitsi-meet.example.com` with your hostname.
30+
You will see your own hostname instead of `jitsi.example.com` in your config
31+
file.
2632

2733
### Enable anonymous login for guests
2834

29-
Add this block **after the previous VirtualHost** to enable the anonymous login method for guests:
35+
Add this section **after the previous VirtualHost** to enable the anonymous
36+
login method for guests:
3037

3138
```
32-
VirtualHost "guest.jitsi-meet.example.com"
33-
authentication = "anonymous"
39+
VirtualHost "guest.jitsi.example.com"
40+
authentication = "jitsi-anonymous"
3441
c2s_require_encryption = false
3542
```
3643

37-
_Note that `guest.jitsi-meet.example.com` is internal to Jitsi, and you do not need to (and should not) create a DNS record for it, or generate an SSL/TLS certificate, or do any web server configuration. While it is internal, you should still replace `jitsi-meet.example.com` with your hostname._
44+
_Note that `guest.jitsi.example.com` is internal to Jitsi, and you do not need
45+
to (and should not) create a DNS record for it, or generate an SSL/TLS
46+
certificate, or do any web server configuration. While it is internal, you
47+
should still replace `jitsi.example.com` with your hostname._
3848

3949
## Jitsi Meet configuration
4050

4151
In config.js, the `anonymousdomain` options has to be set.
4252

43-
If you have installed jitsi-meet from the Debian package, these changes should be made in `/etc/jitsi/meet/[your-hostname]-config.js`.
53+
If you have installed jitsi-meet from the Debian package, these changes should
54+
be made in `/etc/jitsi/meet/[your-hostname]-config.js`.
4455

4556
```
4657
var config = {
4758
hosts: {
48-
domain: 'jitsi-meet.example.com',
49-
anonymousdomain: 'guest.jitsi-meet.example.com',
50-
...
51-
},
52-
...
59+
domain: 'jitsi.example.com',
60+
anonymousdomain: 'guest.jitsi.example.com',
61+
// ...
62+
},
63+
// ...
5364
}
5465
```
5566

67+
You will see your own hostname instead of `jitsi.example.com` in your config
68+
file. You should add only the `anonymousdomain` line. Be carefull of commas.
69+
5670
## Jicofo configuration
5771

5872
When running Jicofo, specify your main domain in an additional configuration
5973
property. Jicofo will accept conference allocation requests only from the
60-
authenticated domain. This should go as a new 'authentication' section in `/etc/jitsi/jicofo/jicofo.conf`:
74+
authenticated domain. This should go as a new `authentication` section in
75+
`/etc/jitsi/jicofo/jicofo.conf`:
6176

6277
```
6378
jicofo {
6479
authentication: {
6580
enabled: true
6681
type: XMPP
67-
login-url: jitsi-meet.example.com
68-
}
69-
...
82+
login-url: "jitsi.example.com"
83+
}
84+
}
7085
```
7186

72-
When using token based authentication, the type must use `JWT` as the scheme instead:
87+
Replace `jitsi.example.com` with your own hostname. Don't create a new `jicofo`
88+
section. Create the `authentication` section inside the existing `jicofo`
89+
section.
90+
91+
## Restart the services
92+
93+
Restart prosody, jicofo and jitsi-videobridge2 as `root`.
7394

7495
```
75-
jicofo {
76-
authentication: {
77-
enabled: true
78-
type: JWT
79-
login-url: jitsi-meet.example.com
80-
}
81-
...
96+
systemctl restart prosody
97+
systemctl restart jicofo
98+
systemctl restart jitsi-videobridge2
8299
```
83100

84-
## Create users in Prosody (internal auth)
101+
## Create users in Prosody
85102

86103
Finally, run `prosodyctl` to create a user in Prosody:
87104

88105
```
89-
sudo prosodyctl register <username> jitsi-meet.example.com <password>
106+
sudo prosodyctl register <username> <your-hostname> <password>
90107
```
91-
and then restart prosody, jicofo and jitsi-videobridge2
108+
109+
For example:
110+
92111
```
93-
systemctl restart prosody
94-
systemctl restart jicofo
95-
systemctl restart jitsi-videobridge2
112+
sudo prosodyctl register myname jitsi.example.com mypassword123
96113
```
97114

98115
:::note
99-
Docker users may require an alternate config path. Users of the official [`jitsi/prosody`](https://github.com/jitsi/docker-jitsi-meet) image should invoke `prosodyctl` as follows.
116+
Docker users may require an alternate config path. Users of the official
117+
[`jitsi/prosody`](https://github.com/jitsi/docker-jitsi-meet) image should
118+
invoke `prosodyctl` as follows.
100119

101120
```
102121
prosodyctl --config /config/prosody.cfg.lua register <username> meet.jitsi <password>
103122
```
104123

105-
Full documentation for `prosodyctl` can be found on [the official site](https://prosody.im/doc/prosodyctl).
124+
Full documentation for `prosodyctl` can be found on
125+
[the official site](https://prosody.im/doc/prosodyctl).
106126
:::
107127

128+
## Remove users from Prosody
129+
130+
To remove an existing user:
131+
132+
```
133+
sudo prosodyctl unregister <username> <your-hostname>
134+
```
135+
136+
For example:
137+
138+
```
139+
sudo prosodyctl unregister myname jitsi.example.com
140+
```
141+
108142
## Optional: Jigasi configuration
109143

110144
### Enable Authentication
111145

112-
If you are using Jigasi, set it to authenticate by editing the following lines in `/etc/jitsi/jigasi/sip-communicator.properties`:
146+
If you are using Jigasi, set it to authenticate by editing the following lines
147+
in `/etc/jitsi/jigasi/sip-communicator.properties`:
113148

114-
````
149+
```
115150
org.jitsi.jigasi.xmpp.acc.USER_ID=SOME_USER@SOME_DOMAIN
116151
org.jitsi.jigasi.xmpp.acc.PASS=SOME_PASS
117152
org.jitsi.jigasi.xmpp.acc.ANONYMOUS_AUTH=false
118-
````
153+
```
119154

120155
Note that the password is the actual plaintext password, not a base64 encoding.
121156

122157
### Debugging
123158

124-
If you experience problems with a certificate chain, you may need to uncomment the following line, also in `sip-communicator.properties`:
159+
If you experience problems with a certificate chain, you may need to uncomment
160+
the following line, also in `sip-communicator.properties`:
125161

126-
````
162+
```
127163
net.java.sip.communicator.service.gui.ALWAYS_TRUST_MODE_ENABLED=true
128-
````
164+
```
129165

130166
:::note
131-
This should only be used for testing/debugging purposes, or in controlled environments. If you confirm that this is the problem, you should then solve it in another way (e.g. get a signed certificate for Prosody, or add the particular certificate to Jigasi’s trust store).
167+
This should only be used for testing/debugging purposes, or in
168+
controlled environments. If you confirm that this is the problem, you should
169+
then solve it in another way (e.g. get a signed certificate for Prosody, or add
170+
the particular certificate to Jigasi’s trust store).
132171
:::

‎docs/devops-guide/token-authentication.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
---
2+
id: token-authentication
3+
title: Token Authentication
4+
sidebar_label: Authentication (Token)
5+
---
6+
7+
It is possible to allow only users with a valid token to create new conference
8+
rooms. After the room is created, others will be able to join from anonymous
9+
domain. Here's what has to be configured:
10+
11+
## Token package
12+
13+
Install `jitsi-meet-tokens` packages.
14+
15+
```
16+
apt-get install jitsi-meet-tokens
17+
```
18+
19+
Set `Application ID` and `Application Secret` when asked. This command will add
20+
`app_id` and `app_secret` into the Prosody config and set `authentication`.
21+
22+
## Prosody configuration
23+
24+
If you have installed Jitsi Meet from the Debian package, the changes should be
25+
made in `/etc/prosody/conf.avail/[your-hostname].cfg.lua`
26+
27+
In the example below, this hostname is assumed to be `jitsi.example.com`.
28+
29+
After installing the package you will see the following lines in your Prosody
30+
config:
31+
32+
```
33+
VirtualHost "jitsi.example.com"
34+
authentication = "token"
35+
app_id="myappid"
36+
app_secret="myappsecret"
37+
---
38+
---
39+
40+
Component "conference.jitsi.example.com" "muc"
41+
---
42+
---
43+
modules_enabled = {
44+
---
45+
---
46+
"token_verification";
47+
---
48+
---
49+
}
50+
```
51+
52+
### allow_empty_token
53+
54+
Add `allow_empty_token` into `VirtualHost`:
55+
56+
```
57+
VirtualHost "jitsi.example.com"
58+
authentication = "token"
59+
app_id="myappid"
60+
app_secret="myappsecret"
61+
allow_empty_token = true
62+
```
63+
64+
### persistent_lobby
65+
66+
Add `persistent_lobby` as module into `VirtualHost`:
67+
68+
```
69+
VirtualHost "jitsi.example.com"
70+
---
71+
---
72+
modules_enabled = {
73+
---
74+
---
75+
"muc_lobby_rooms";
76+
"persistent_lobby";
77+
```
78+
79+
### muc_wait_for_host
80+
81+
Add `muc_wait_for_host` as module into `Component`:
82+
83+
```
84+
Component "conference.jitsi.example.com" "muc"
85+
---
86+
---
87+
modules_enabled = {
88+
---
89+
"token_verification";
90+
"muc_wait_for_host";
91+
}
92+
```
93+
94+
### Enable anonymous login for guests
95+
96+
Add this section **after the previous VirtualHost** to enable the anonymous
97+
login method for guests:
98+
99+
```
100+
VirtualHost "guest.jitsi.example.com"
101+
authentication = "jitsi-anonymous"
102+
c2s_require_encryption = false
103+
```
104+
105+
_Note that `guest.jitsi.example.com` is internal to Jitsi, and you do not need
106+
to (and should not) create a DNS record for it, or generate an SSL/TLS
107+
certificate, or do any web server configuration. While it is internal, you
108+
should still replace `jitsi.example.com` with your hostname._
109+
110+
## Jitsi Meet configuration
111+
112+
In config.js, the `anonymousdomain` options has to be set.
113+
114+
If you have installed jitsi-meet from the Debian package, these changes should
115+
be made in `/etc/jitsi/meet/[your-hostname]-config.js`.
116+
117+
```
118+
var config = {
119+
hosts: {
120+
domain: 'jitsi.example.com',
121+
anonymousdomain: 'guest.jitsi.example.com',
122+
// ...
123+
},
124+
// ...
125+
}
126+
```
127+
128+
You will see your own hostname instead of `jitsi.example.com` in your config
129+
file. You should add only the `anonymousdomain` line. Be carefull of commas.
130+
131+
## Jicofo configuration
132+
133+
No need to update anything in Jicofo config. Some out-dated documents recommend
134+
to enable the authentication in `jicofo.conf`. Don't do that. The authentication
135+
must be disabled in `jicofo.conf` when the `token` authentication is active.
136+
137+
Simply keep `jicofo.conf` as it is without changing anything.
138+
139+
## Restart the services
140+
141+
Restart prosody, jicofo and jitsi-videobridge2 as `root`.
142+
143+
```
144+
systemctl restart prosody
145+
systemctl restart jicofo
146+
systemctl restart jitsi-videobridge2
147+
```

‎sidebars.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ module.exports = {
152152
},
153153
items: [
154154
"devops-guide/secure-domain",
155+
"devops-guide/token-authentication",
155156
"devops-guide/ldap-authentication",
156157
"devops-guide/devops-guide-scalable",
157158
"devops-guide/reservation",

0 commit comments

Comments
 (0)