JWT Token installation

subodhs · October 30, 2020, 5:55pm

Hi @emrah

We are having Jitsi Meet server on Ubuntu 20.04. We are also having Jibri Server on Ubuntu 18.04.

We would like to configure JWT token on our Jitsi Server. Do you have steps to install JWT Token?

Please help.

Regards,
Subodh

damencho · October 30, 2020, 6:06pm

github.com

jitsi/lib-jitsi-meet/blob/master/doc/tokens.md

JWT token authentication Prosody plugin
==================

This plugin implements Prosody authentication provider that verifies client connection based on JWT token described in [RFC7519].
It allows to use any external form of authentication with lib-jitsi-meet. Once your user authenticates you need to
generate the JWT token as described in the RFC and pass it to your client app. Once it connects with valid token is considered authenticated by jitsi-meet system.

During configuration you will need to provide the *application ID* that identifies the client and a *secret* shared by both server and JWT token generator. Like described in the RFC, secret is used to compute HMAC hash value which allows to authenticate generated token. There are many existing libraries which can be used to implement token generator. More info can be found here: [http://jwt.io/#libraries-io]

JWT token authentication currently works only with BOSH connections.

[RFC7519]: https://tools.ietf.org/html/rfc7519
[http://jwt.io/#libraries-io]: http://jwt.io/#libraries-io

### Token structure

The following JWT claims are used in authentication token:
- 'iss' specifies *application ID* which identifies the client app connecting to the server. It should be negotiated with the service provider before generating the token.
- 'room' contains the name of the room for which the token has been allocated. This is *NOT* full MUC room address. Example assuming that we have full MUC 'conference1@muc.server.net' then 'conference1' should be used here.  Alternately, a '*' may be provided, allowing access to all rooms within the domain.
- 'exp' token expiration timestamp as defined in the RFC

This file has been truncated. show original

subodhs · October 30, 2020, 6:21pm

Do you have document with simple steps installation of JWT Server.

emrah · October 30, 2020, 6:46pm

The installation steps for Ubuntu 20.04

Ubuntu is not the distro I use. I tested the steps only once

codertryer · November 2, 2020, 8:21pm

@damencho Hello, I am trying to use jwt tokens for Docker. In the Docker manual, it only talks about changing the env variables like enabling auht, setting auth type to jwt, etc. I only did these because it does not talk about plugins. But it does not work. Can you help?

tholmgren · November 4, 2020, 3:52pm

I just set this up on Ubuntu 20.04. It’s a little tricky because one of the files is missing but I found a good post that resolved the issue.

For Ubuntu 18.04, skip Part A with the missing file, then just follow the instructions in Part B.

Part A for Ubuntu 20: Start with the following steps list below
(Source: https://doganbros.com/index.php/jitsi/jitsi-installation-with-jwt-support-on-ubuntu-20-04-lts/):

Since Ubuntu 20.04 TLS Focal Fossa is a fairly new distribution libssl1.0-dev does not exist in its Debian repository. You’ll need to install libssl1.0-dev package for 18.04 TLS Bionic Beaver.

Edit Debian (Ubuntu) package repository resources;

sudo nano /etc/apt/sources.list

Add the following line for global Debian repo;

deb http://security.ubuntu.com/ubuntu bionic-security main

Execute;

sudo apt update && apt-cache policy libssl1.0-dev

Part 2: Follow these directions for Ubuntu 18.04 (and 20.04 if you follow the 3 steps listed above):

If you are looking for a moderator after, try this: