search

d3473r / jitsi-keycloak

Login to jitsi with keycloak https://github.com/d3473r/jitsi-keycloak/pkgs/container/jitsi-keycloak
https://github.com/d3473r/jitsi-keycloak
MIT License
54 stars 23 forks source link

jitsi-keycloak does not issue scoped JWTs #103

Closed micolous closed 6 days ago

micolous commented 1 week ago

Jitsi Meet uses two non-standard claims to scope a JWT:

jitsi-keycloak sets both of these to *:

https://github.com/d3473r/jitsi-keycloak/blob/5a895d88e735a89c8936a754c29545b676087aaf/server/src/app.js#L47-L48

https://github.com/d3473r/jitsi-keycloak/blob/5a895d88e735a89c8936a754c29545b676087aaf/server/src/app.js#L67

There does not appear to be any way to limit the scope of the issued tokens, so they will be valid for any Jitsi instance or room which accepts JWTs from the jitsi-keycloak instance.

d3473r commented 6 days ago

Hi, thank you for issue, with version v1.3.0 (commit https://github.com/d3473r/jitsi-keycloak/commit/1972e255b59808cfe1bb8bcb15f54e8ad6387556) it is now possible to use the ALLOWED_SUB and ALLOWED_ROOM environment variables to restrict the generated jwt