Browse Source

FIX: add flag to control whether to check room claim in JWT validation

jibri queue component stop checking room validation in token
Jibri queue component debug output when bad token is found
master
Aaron van Meerten 4 years ago
parent
commit
d05fa32413

+ 11
- 7
resources/prosody-plugins/mod_jibri_queue_component.lua View File

62
 local ASAPAcceptedAudiences
62
 local ASAPAcceptedAudiences
63
     = module:get_option_array('asap_accepted_audiences',{'*'});
63
     = module:get_option_array('asap_accepted_audiences',{'*'});
64
 
64
 
65
-    module:log("info", "ASAP Accepted Audiences %s", ASAPAcceptedAudiences);
66
-    token_util:set_asap_accepted_audiences(ASAPAcceptedAudiences);
65
+module:log("info", "ASAP Accepted Audiences %s", ASAPAcceptedAudiences);
66
+token_util:set_asap_accepted_audiences(ASAPAcceptedAudiences);
67
+
68
+-- do not require room to be set on tokens for jibri queue
69
+token_util:set_asap_require_room_claim(false);
67
 
70
 
68
 local ASAPTTL
71
 local ASAPTTL
69
     = module:get_option_number("asap_ttl", 3600);
72
     = module:get_option_number("asap_ttl", 3600);
410
     local verified, reason, message = token_util:process_and_verify_token(session);
413
     local verified, reason, message = token_util:process_and_verify_token(session);
411
     if not verified then
414
     if not verified then
412
         log("warn", "not a valid token %s: %s", tostring(reason), tostring(message));
415
         log("warn", "not a valid token %s: %s", tostring(reason), tostring(message));
416
+        log("debug", "invalid token %s", token);
413
         return false;
417
         return false;
414
     end
418
     end
415
 
419
 
416
-    if not token_util:verify_room(session, room_jid) then
417
-        log("warn", "Token %s not allowed to access: %s",
418
-            tostring(token), tostring(room_jid));
419
-        return false;
420
-    end
420
+    -- if not token_util:verify_room(session, room_jid) then
421
+    --     log("warn", "Token %s not allowed to access: %s",
422
+    --         tostring(token), tostring(room_jid));
423
+    --     return false;
424
+    -- end
421
 
425
 
422
     return true;
426
     return true;
423
 end
427
 end

+ 11
- 3
resources/prosody-plugins/token/util.lib.lua View File

92
     --array of accepted audiences: by default only includes our appId
92
     --array of accepted audiences: by default only includes our appId
93
     self.acceptedAudiences = module:get_option_array('asap_accepted_audiences',{'*'})
93
     self.acceptedAudiences = module:get_option_array('asap_accepted_audiences',{'*'})
94
 
94
 
95
+    self.requireRoomClaim = module:get_option_boolean('asap_require_room_claim', true);
96
+
95
     if self.asapKeyServer and not have_async then
97
     if self.asapKeyServer and not have_async then
96
         module:log("error", "requires a version of Prosody with util.async");
98
         module:log("error", "requires a version of Prosody with util.async");
97
         return nil;
99
         return nil;
112
     self.acceptedAudiences = acceptedAudiences;
114
     self.acceptedAudiences = acceptedAudiences;
113
 end
115
 end
114
 
116
 
117
+function Util:set_asap_require_room_claim(checkRoom)
118
+    self.requireRoomClaim = checkRoom;
119
+end
120
+
115
 --- Returns the public key by keyID
121
 --- Returns the public key by keyID
116
 -- @param keyId the key ID to request
122
 -- @param keyId the key ID to request
117
 -- @return the public key (the content of requested resource) or nil
123
 -- @return the public key (the content of requested resource) or nil
222
         return nil, issCheckErr;
228
         return nil, issCheckErr;
223
     end
229
     end
224
 
230
 
225
-    local roomClaim = claims["room"];
226
-    if roomClaim == nil then
227
-        return nil, "'room' claim is missing";
231
+    if self.requireRoomClaim then
232
+        local roomClaim = claims["room"];
233
+        if roomClaim == nil then
234
+            return nil, "'room' claim is missing";
235
+        end
228
     end
236
     end
229
 
237
 
230
     local audClaim = claims["aud"];
238
     local audClaim = claims["aud"];

Loading…
Cancel
Save