Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add transcriber authentication to hidden domain #1663

Closed
wants to merge 2 commits into from
Closed

Add transcriber authentication to hidden domain #1663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c0d2d5
generate prosody auth for transcriber
zobadaniel Dec 6, 2023
87c366c
add option to configure transcriber to require authentication
zobadaniel Dec 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,8 @@ services:
- JICOFO_COMPONENT_SECRET
- JIGASI_XMPP_USER
- JIGASI_XMPP_PASSWORD
- JIGASI_TRANSCRIBER_USER
- JIGASI_TRANSCRIBER_PASSWORD
- JVB_AUTH_USER
- JVB_AUTH_PASSWORD
- JWT_APP_ID
Expand Down
7 changes: 7 additions & 0 deletions env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,10 @@ ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background
# Enable guest access
#ENABLE_GUESTS=1

# Enable auth for Transcriber in Jigasi
# This can only be enabled if the other auth options above are not used
#JIGASI_TRANSCRIBER_AUTHENTICATION=1
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is very confusing. The transcriber should be authenticated always, like a recorder. Can this be dropped?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess that eventually, this can be dropped and the authentication of the transcriber can be made mandatory. I don't know whether this would be a "breaking change" though? Maybe it was never meant that the transcriber works without authentication, but I can't tell. Please see also my generic comment below.


# Select authentication type: internal, jwt, ldap or matrix
#AUTH_TYPE=internal

Expand Down Expand Up @@ -205,6 +209,9 @@ JIBRI_RECORDER_PASSWORD=
# XMPP password for Jibri client connections
JIBRI_XMPP_PASSWORD=

# Transcriber password to authenticate to the hidden (recorder) domain
JIGASI_TRANSCRIBER_PASSWORD=

#
# Docker Compose options
#
Expand Down
2 changes: 2 additions & 0 deletions gen-passwords.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,13 @@ JVB_AUTH_PASSWORD=$(generatePassword)
JIGASI_XMPP_PASSWORD=$(generatePassword)
JIBRI_RECORDER_PASSWORD=$(generatePassword)
JIBRI_XMPP_PASSWORD=$(generatePassword)
JIGASI_TRANSCRIBER_PASSWORD=$(generatePassword)

sed -i.bak \
-e "s#JICOFO_AUTH_PASSWORD=.*#JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}#g" \
-e "s#JVB_AUTH_PASSWORD=.*#JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}#g" \
-e "s#JIGASI_XMPP_PASSWORD=.*#JIGASI_XMPP_PASSWORD=${JIGASI_XMPP_PASSWORD}#g" \
-e "s#JIBRI_RECORDER_PASSWORD=.*#JIBRI_RECORDER_PASSWORD=${JIBRI_RECORDER_PASSWORD}#g" \
-e "s#JIBRI_XMPP_PASSWORD=.*#JIBRI_XMPP_PASSWORD=${JIBRI_XMPP_PASSWORD}#g" \
-e "s#JIGASI_TRANSCRIBER_PASSWORD=.*#JIGASI_TRANSCRIBER_PASSWORD=${JIGASI_TRANSCRIBER_PASSWORD}#g" \
"$(dirname "$0")/.env"
4 changes: 4 additions & 0 deletions jigasi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ services:
- XMPP_SERVER
- XMPP_PORT
- XMPP_DOMAIN
- XMPP_RECORDER_DOMAIN
- PUBLIC_URL
- JIGASI_DISABLE_SIP
- JIGASI_SIP_URI
Expand All @@ -30,6 +31,9 @@ services:
- JIGASI_SIP_DEFAULT_ROOM
- JIGASI_XMPP_USER
- JIGASI_XMPP_PASSWORD
- JIGASI_TRANSCRIBER_AUTHENTICATION
- JIGASI_TRANSCRIBER_USER
- JIGASI_TRANSCRIBER_PASSWORD
- JIGASI_BREWERY_MUC
- JIGASI_PORT_MIN
- JIGASI_PORT_MAX
Expand Down
9 changes: 8 additions & 1 deletion jigasi/rootfs/defaults/sip-communicator.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,14 @@ org.jitsi.jigasi.transcription.SAVE_TXT=true
org.jitsi.jigasi.transcription.SEND_TXT={{ .Env.JIGASI_TRANSCRIBER_SEND_TXT | default "false"}}
org.jitsi.jigasi.transcription.RECORD_AUDIO={{ .Env.JIGASI_TRANSCRIBER_RECORD_AUDIO | default "false"}}
org.jitsi.jigasi.transcription.RECORD_AUDIO_FORMAT=wav
{{end}}
{{ if .Env.JIGASI_TRANSCRIBER_AUTHENTICATION | default "0" | toBool }}
# authenticate transcriber to make it a hidden participant
org.jitsi.jigasi.xmpp.acc.USER_ID={{ $JIGASI_TRANSCRIBER_USER }}@{{ $XMPP_RECORDER_DOMAIN }}
org.jitsi.jigasi.xmpp.acc.ANONYMOUS_AUTH=false
org.jitsi.jigasi.xmpp.acc.PASS={{ .Env.JIGASI_TRANSCRIBER_PASSWORD }}
org.jitsi.jigasi.xmpp.acc.ALLOW_NON_SECURE=true
{{ end }}
{{ end }}

{{ if .Env.JIGASI_SIP_DEFAULT_ROOM }}
org.jitsi.jigasi.DEFAULT_JVB_ROOM_NAME={{ .Env.JIGASI_SIP_DEFAULT_ROOM }}
Expand Down
7 changes: 7 additions & 0 deletions jigasi/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,3 +51,10 @@ if [[ $ENABLE_TRANSCRIPTIONS -eq 1 || $ENABLE_TRANSCRIPTIONS == "true" ]]; then
}' \
> /config/key.json
fi

# check that no conflicting authentications are configured
if [[ $ENABLE_AUTH -eq 1 && $JIGASI_TRANSCRIBER_AUTHENTICATION -eq 1 ]]; then
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah nobody will understand this. Let's make it work authenticated always, like a recorder please.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree, not actually intuitive.

echo 'Conflicting authentications specified!'
exit 1
fi

10 changes: 10 additions & 0 deletions prosody/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ fi
[ -z "${JIBRI_RECORDER_USER}" ] && export JIBRI_RECORDER_USER=recorder
[ -z "${JIBRI_XMPP_USER}" ] && export JIBRI_XMPP_USER=jibri
[ -z "${JIGASI_XMPP_USER}" ] && export JIGASI_XMPP_USER=jigasi
[ -z "${JIGASI_TRANSCRIBER_USER}" ] && export JIGASI_TRANSCRIBER_USER=transcriber
[ -z "${JVB_AUTH_USER}" ] && export JVB_AUTH_USER=jvb
[ -z "${XMPP_DOMAIN}" ] && export XMPP_DOMAIN=meet.jitsi
[ -z "${XMPP_AUTH_DOMAIN}" ] && export XMPP_AUTH_DOMAIN=auth.meet.jitsi
Expand Down Expand Up @@ -104,6 +105,15 @@ if [[ ! -z $JIGASI_XMPP_PASSWORD ]]; then
prosodyctl --config $PROSODY_CFG register $JIGASI_XMPP_USER $XMPP_AUTH_DOMAIN $JIGASI_XMPP_PASSWORD
fi

if [[ ! -z $JIGASI_TRANSCRIBER_PASSWORD ]]; then
OLD_JIGASI_TRANSCRIBER_PASSWORD=passw0rd
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This never existed, so we don't need to check for it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Honestly I just copied the handling of other paswords. I don't know why this password would have to be handled specially. Or is this some sort of legacy stuff that is simply no longer necessary for newly introduced passwords?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The latter.

if [[ "$JIGASI_TRANSCRIBER_PASSWORD" == "$OLD_JIGASI_TRANSCRIBER_PASSWORD" ]]; then
echo 'FATAL ERROR: Jigasi transcriber password must be changed, check the README'
exit 1
fi
prosodyctl --config $PROSODY_CFG register $JIGASI_TRANSCRIBER_USER $XMPP_RECORDER_DOMAIN $JIGASI_TRANSCRIBER_PASSWORD
fi

if [[ "$PROSODY_MODE" == "visitors" ]]; then
[ -z "$VISITORS_XMPP_DOMAIN" ] && VISITORS_XMPP_DOMAIN="meet.jitsi"
[ -z "$PROSODY_VISITOR_INDEX" ] && PROSODY_VISITOR_INDEX=0
Expand Down
Loading