Jitsi Meet Authentication with Single Sign-On an Active Directory

TobiKa · February 6, 2023, 2:16pm

Hello,

We have been using Jitsi Meet for 2 years now. It is installed on a virtual machine running Ubuntu.

The server is currently configured with an LDAP query.
When a user opens a room, the dialog for entering the login data appears. It is then checked via LDAP in the Active Directory whether the user is authorized to open a room. A room that is already open can also be accessed by other people without an LDAP query.

Since entering the username and password is very time-consuming, I would like to switch to Single Sign-On. The user logged on to Windows should be automatically logged on to Jitsi as a moderator. It should still be possible for other people to join without SSO. Unfortunately I couldn’t find anything here in the forum.

Is there already a documented guide for this? Has this already been done before?

Best regards

Tobias

Freddie · February 6, 2023, 3:01pm

Welcome to the forum.

JWT Tokens should work for you.

github.com

jitsi/lib-jitsi-meet/blob/master/doc/tokens.md

# JSON Web Token (JWT) authentication Prosody plugin

This plugin implements a **Prosody authentication provider** that verifies a client connection based on a JWT
described in [RFC7519]. It allows use of an external form of authentication with _lib-jitsi-meet_.
Once your user authenticates you need to generate the JWT as described in the RFC and pass it to your client app.
Once it connects with a valid token, it is considered authenticated by the jitsi-meet system.

During configuration, you can choose between two JWT validation methods:

* Shared Secret Validation or
* Public Key Validation 

In both cases you will need to provide the _application ID_ that identifies the client.

For the **Shared Secret Validation** an _application secret_ is shared by both the server (Prosody) and the JWT
generation. Take a look at an example structure in [Example Structure > Shared Secret Validation](#shared-secret-validation).
Like described in the RFC, the _shared secret_ is used to compute a HMAC hash value which allows authentication of the 
generated token. There are many existing libraries which can be used to implement token generation. More info can be 
found here: [http://jwt.io/#libraries-io]

This file has been truncated. show original