Hi,
we are trying to set up a configuration with jitsi-meet and JWT authentication on a Debian 10 machine. We installed jitsi-meet by following the self hosting guide and it’s working without problems, but we enabled the JWT token following the JWT Authentication guide we got the following error on the browser dev console
JWT error: token required
this is coming presumably from the following request which contains a token under the correct query parameter
In the prosody.log file we can see the following error is triggered in token/util.lib.lua Error verifying token err:not-allowed, reason:token required
We were using prosody 0.11.2 with the trunk patched to version 1nightly1377-1~buster, we also tried upgrading to version 0.11.9 with no results.
We also debugged the mod_auth_token.lua adding some logs and we noticed that in the function init_session(event) is never called when someone tries to join a room by using the token, we are thinking that, for some reason, the hook on bosh-session is never really called.
We went through the configuration steps several times to make sure that we did everything correctly and it appears so. our host configuration is the the following:
VirtualHost "jitsi.mydomain"
-- enabled = false -- Remove this line to enable this host
authentication = "token";
-- Properties below are modified by jitsi-meet-tokens package config
-- and authentication above is switched to "token"
app_id="my_app_id";
app_secret="my_secret";
allow_empty_token = false;
-- Assign this host a certificate for TLS, otherwise it would use the one
-- set in the global section (if any).
-- Note that old-style SSL on port 5223 only supports one certificate, and will always
-- use the global one.
ssl = {
key = "/etc/prosody/certs/jitsi.mydomain.key";
certificate = "/etc/prosody/certs/jitsi.mydomain.crt";
}
av_moderation_component = "avmoderation.jitsi.mydomain"
speakerstats_component = "speakerstats.jitsi.mydomain"
conference_duration_component = "conferenceduration.jitsi.mydomain"
-- we need bosh
modules_enabled = {
"bosh";
"pubsub";
"ping"; -- Enable mod_ping
"speakerstats";
"external_services";
"conference_duration";
"muc_lobby_rooms";
"av_moderation";
"presence_identity";
}
c2s_require_encryption = false
lobby_muc = "lobby.jitsi.mydomain"
main_muc = "conference.jitsi.mydomain"
-- muc_lobby_whitelist = { "recorder.jitsi.mydomain" } -- Here we can whitelist jibri to enter lobby enabled rooms
If you look carefully that is the http-bind call from the dev tools’ network of the browsers, not the url used to start the conference. The url was correctly formatted with the jwt parameter:
The application (the standard jitsi-meet web application) then does the magic and transforms the jwt parameter in the “token” paramater when the http-bind call is made
I tried with jitok with only the secret and aud fields, instead of jwt.io. I got the same error and a parsing error on top of that, in the console log:
The process worked out of the box by installing the newer version of prosody (v. 0.11.9) on a clean system.
When we followed the guide installing the last version of prosody-trunk (patching prosody with the newer 1nightly1377-1~buster) it did not work.
We digged into the jitsi-meet-tokens pacakge and we found this snippet
So apparently if you have prosody-trunk not installed but only unpacke you will not have the global hooks and the token authentication it will not work.
I think the installer should be modified to take into account prosody-trunk’s version and make the substitution only if the trunk is unpacked and no prosody 11 is installed (or if the trunk is unpacked and installed). What do you think?
We followed what was written in the tutorial, what was a bit confusing for us is that it’s not clear that with the newer versions of prosody we should not have installed the trunk. From the phrasing it looks like patching the trunk is a needed step:
apt-get install jitsi-meet-tokens
Proceed to “Patching Prosody” section to finish configuration.
Perhaps it’s worth deleting this line (highlighted) so someone installing for the first time is not confused searching for a “Patching Prosody” section.
