search

bigbluebutton / bbb-lti

0 stars 3 forks source link

BBB-LTI: deny attendants to open rooms they can't access #4

Open PhMemmel opened 3 years ago

PhMemmel commented 3 years ago

Describe the bug When an attendant is trying to access a meeting it is being created (visible in getMeetings), even though the attendant isn't allowed to create the meeting at all. The attendant cannot join, of course (because it is restricted by waiting room access). So the meeting is created, but it has no attendants or moderators. This is found on 2.2.31 with up-to-date scalelite.

To Reproduce Steps to reproduce the behavior:

  1. Open meeting as attendant from e. g. moodle via LTI
  2. meeting is created on BBB server

Expected behavior User gets denied before meeting is being created on BBB server

Actual behavior meeting is being created and takes a few minutes to time out again.

Additional context This is a real issue, especially when running BBB behind a scalelite load balancer, because scalelite most likely counts these practically non existing meetings as actual meetings, so this can impact balancing quality. So it would be awesome to make BBB not create these meetings.

basisbit commented 3 years ago

this is a bug in your frontend, not in BigBlueButton. Please create the issue in the repository of the lti which you use.

basisbit commented 3 years ago

For moodle, this should be the correct repository: https://github.com/blindsidenetworks/moodle-mod_bigbluebuttonbn

PhMemmel commented 3 years ago

I'm not sure if this is a frontend bug. I am not talking about the moodle plugin, but the possibility to access the BBB server API via bbb-lti: As I wrote in the issue title, I'm accessing BBB via the bbb-lti module/endpoint which is part of this project, right?

I don't think the LTI client (in my case the LTI integration in moodle) can decide whether to open a room or not. It shouldn't even be aware of the fact it connects to a web conferencing system. The LTI client just sends a requests providing some information of the LTI client's context (role, username etc.) to the LTI external endpoint (which is bbb-lti grails application in this case) which then processes the request and decides what to do with it, in this case opening a room or not. So in my understanding this is an issue of bbb-lti.

Please correct me, if I'm wrong. If this is the case: sorry for opening this issue in the wrong tracker :-)

basisbit commented 3 years ago

BigBlueButton does not know the users permissions. If the tool tells BBB to create a room, it will do so and then return success. The join call is another separate call. Please create a new issue for this for your LTE addin so it can be optimized instead.

PhMemmel commented 3 years ago

First of all: I'm really sorry to bother you guys again, but:

Well...that's what I'm trying to do... :-) "bbb-lti" is part of this project, so this is the place to report this issue, isn't it? It's not MY addin, the module bbb-lti is part of this project: https://github.com/bigbluebutton/bigbluebutton/tree/develop/bbb-lti