I have ejabberd set up using external_auth to authenticate against the user database of my web application. What I would like is to be able to create a MUC (chat room) for site moderators, and automatically add those users to the chat, to the exclusion of all other users.
Eventually I would also like to be able to map my site's groups functionality to MUC's in ejabberd also.
The external authentication API for ejabberd doesn't seem to provide for fine-grained access control, basically only allowing you to query whether a user is registered and whether a username / password combination successfully authenticates a user.
The only reference I've seen to acl's for MUC's is here:
http://www.ejabberd.im/aclpopulate
But that seems to require setting privileges through the webadmin interface.
Is there no way to do this automatically from external auth?
To answer my own question, it doesn't seem possible to do what I need by using external auth.
I ended up integrating ejabberd commands into the user / group lifecycle of my web app, which was quicker than I had anticipated, and has the added bonus of being a zillion times faster than using external auth (I use ejabberd's internal user database, using ejabberdctl to create users, update passwords, add and remove from shared rosters and create muc's).
To help with that process I created a PHP wrapper for ejabberdctl which is freely available on github:
https://github.com/tomlancaster/Ejabberd-Wrapper-PHP
Please feel free to use and abuse it as you wish.
If you have your own authentication module, in that case you can redirect the authentication process of ejabberd. In ejabberd_auth.erl file redirect authentication by modifying check_password_with_authmodule/3 and check_password_with_authmodule/5 two function. From your authentication module return back the term as these two functions return.
If you authentication module is in deferent machine, make a socket connection to communicate with your authentication module and get the result and give the result back to check_password_with_authmodul function.
After this changes rebuild ejabberd and start.
Related
I recently switched to a new company where my manager wants me to develop entirely new cloud based project in MVC. I have never worked on a project from the start and I think this is a good opportunity for me to lead.
However, I think the requirements of the clients are bit confusing.
Here is what he wants:
Client should be able to access the cloud hosted application from his network with single sign on. He wants to use his active directory for that.
There are different users in active directory, they will have different roles (I think we can handle this on database side. Create different roles and assign roles to users).
Client has to add vendor info in the application. But for this, system should send an email to vendor with the url of the cloud application. He wants user to login to the application using 2 Factor Authentication. So, send dummy password with url, and send OTP to his mobile number. Just like registering to any system.
Now my questions are:
Is it possible to have 2 different types of login mechanisms in the same application? SSO for client and 2FA for outside vendors?
If yes, could you please guide me in the right direction?
what things I need? Which framework, design pattern should I prefer?
How do I proceed ?
I'm in the process of trying to set up a server for a personal project. I'm using ServiceStack.Core with a Neo4j graph database as my persistence layer.
I would like to set up user authentication using my graph database as the user auth repository. There is no existing implementation of IUserAuthRepository for Neo4j as far as I can tell, meaning that I will have to create my own. Unfortunately, I have found very little documentation on this interface and how to correctly implement it.
So, I have a few questions:
Does there exist any kind of tutorial or other documentation on how to correctly implement my own IUserAuthRepository?
The CreateUserAuth method is supposed to take a password. What if a user logged in using Facebook or some other service and does not have a password?
Would it make more sense to just use Redis for authentication (with RedisAuthRepository), using the userAuthId to look up users in my graph db? Are there any major pitfalls to doing something like this? If I do go this route, how do I hook into the registration process to ensure that I create a user in the graph DB whenever a new user is registered?
There aren't any docs on implementing IUserAuthRepository, it's an interface with a lot of reference implementations. Easiest way would be to follow the implementation that works similar to neo4j.
The IUserAuthRepository stores 2 tables, UserAuth master table and UserAuthDetails child table which is where all OAuth providers like Facebook maintain info received when authenticating with them. The password field is used for CredentialsAuthProvider.
You can handle different events during registration and authentication with the Session and Auth Events.
I am using F5 IControl 11.5.1,i have integrated ldap and working fine but i need to access F5 using icontrol rest service.
is there any rest end point available in 11.5.1?
what are parameters and how to pass for ldap?
iControlRest is available in 11.5.1. It was introduced in 11.4 as an early access feature and fully implemented in 11.5. The documentation for iControlRest can be found here. You can find the endpoints and examples for how to use them there. Here's another link to the PDF of the user manual for the 11.5.0 version.
The format for using iControlRest is https://BIGIP/mgmt/tm/ltm/pool. The endpoints use Basic authentication so you'll need to make sure to that the basic Authorization header. Also, you'll need to use an account that has admin permissions to the box.
There is no way to bypass LDAP/TACACS or remote authentication as of this time in any version. I recently opened a case for the same issue. The service account you use must exist in LDAP or you have to use the "admin" account.
Recently, F5 came up with a concept of Role Based Access Control (RBAC), — create a local user a/c but here you can be able to just add Username and Role. No password entry is available. Make sure you use Username that is not listed in the remote role groups on the remote authentication server (Active Directory - ldap).
I have been working on an Angular/Ionic application and am using the OAuth.io plugin to handle a facebook login to gain a user's information. From that I derive a simple database name based on the user's firstname and their Facebook ID number.
What I am wanting to do would be to sync this local pouchDB instance to an online CouchDB instance (currently using http://iriscouch.com) for replication to a desktop app, or something similar. The piece I am missing is how to handle user authentication/authorization to be able to only read and write to their own database and no one else's as all of the code currently lives on the client side with no app server to handle any login aside from the OAuth.io plugin.
Is this possible to handle without adding an app server layer, and without manual intervention to create a user on the CouchDB instance?
Currently you can only do per-user read-write permissions in CouchDB by having an additional process on the server side (details), which would be troublesome for you since you're using IrisCouch, so you'd need a separate server somewhere to host this process.
A few alternative options are available to you right now:
Couchbase, which has per-user databases
Janus, which works using Mozilla Persona rather than Facebook ID, and isn't ready yet, but should be unveiled shortly
UPDATE: I failed to mention earlier that we want solution that will be flexible with authenticating users from within our databases or by asking other servers to tell us if the user is authenticated. It is also worth mentioning that these other servers are not under our control so we can't enforce a specific user model.
I had a long and hard read on OAuth and OpenID but they are both not a suitable solution for our situation and will make the process harder to the user. This is something that has been solved a thousand times, yet I cannot find the solution.
What we are looking for is a framework that can be used in a REST services server to authenticate users (no third-party clients involved) with their username and password.
The solution must not pass the username and password except the first time on login and use tokens for further authentication. Even though OAuth does use tokens, it is designed to allow third-party clients access to the service-providers resources. That is not the case here, the services are for our own application only, the only thing needed is user authentication.
What do you guys think is the most appropriate solution?
Configuration:
-Spring server that provides RESTful services with our thinking going towards using Spring Security with some user management and token management framework.
-iOS Device that will be making HTTPS calls to the server.
What we ultimately want is to have the device send a login request and receive a token if the login was successful, later on make requests using that token. Just like Facebook, excluding third-party involvement.
Is there something that is ready to be configured in our server? Or should we consider building our own token management, comparison and generation software?
Is using Spring-Security with an iOS application without involving storing cookies or redirecting to pages possible?
OpenStack offers as part of it's many projects related to open source cloud... the project Keystone. Which does this pretty much exactly what you want.
You might want to check it out here:
http://docs.openstack.org/developer/keystone/