search

processone / ejabberd-contrib

Growing and curated ejabberd contributions repository - PR or ask to join !
http://ejabberd.im
250 stars 140 forks source link

how to choose request method for ejabberd_auth_http #202

Closed melaniebalaz closed 7 years ago

melaniebalaz commented 7 years ago

I have gotten the ejabberd_auth_http module up and running and now tried authenticating a user from Adium. Now the requests arrived at my authentication server correctly, however appearantly the get_password method was called for sending out the request because it was contained in the query string I read from my webserver logs:

GET /drupal/auth/get_password?user=testuser&server=example.com&pass= HTTP/1.1

Instead of the get_password method being called and then having to make the actual comparison of passwords on the XMPP Server, I would like to have the whole authentication process on the authentication server and it just returning true or false, as is the purpose of check_password. How can I tell it to use check_password instead of get_password?

auth_method: http auth_opts: host: "https://AuthenticateServerIP:443" connection_pool_size: 10 connection_opts: [] basic_auth: "" path_prefix: "/drupal/auth/"

melaniebalaz commented 7 years ago

I found a solution for this, I will write it here just in any case anyone else stumbles upon the same thing and is genereally clueless like me!

So the reason why get_password was chosen was because the password was already hashed between the client (Adium or Pidgin in my case) and the ejabberd Server, so there was no plaintext password it could send on to the Auth Server. This is why it actually says in the Documentation of the module that Digest MD-5 must be disabled. Because even if you tell your client that plaintext is allowed, it will use the strongest Encryption it is offered by the Server, so if you want to get around to it using Plain and sending a check_password request to your Auth Server, you need to disable the stronger Encryption methods. There is a feature that was implemented in ejabberd at some point which can do exactly this, and I both disabled MD-5 and SCRAM with it and then Plain was used. Probably I will move on to OAuth in the end, but just for playing around this is what I needed.

adiii717 commented 6 years ago

Hi I add the following in yml file but server not getting any request from ejabberd. would like to share your experience how u did that

auth_method: http
auth_opts:
  host: "http://192.168.1.23:3000"
  connection_pool_size: 10
  connection_opts: []
  basic_auth: ""
  path_prefix: "/"