Open pl-bamboo opened 1 week ago
badlop
commented
1 week ago ejabberd_auth_http depends on the fusco library, which was last updated 3 years ago... So it's to be expected that it isn't up to date with recent changes. There is no fork with that fixed. Fortunately it's a warning, and will work with Erlang/OTP 26 which is still the recommended version for some months.
Other than that, does ejabberd_auth_http work correctly for you?
pl-bamboo
commented
1 week ago Thanks for explanation!
Also, I'm having some problems integrating the ejabberd_auth_http plugin.
I have installed ejabberd to on-premise host behind Nginx, which terminates my ssl with *.mydomain.com wildcard certificate.
My authentication server is on another host.
I have only enabled port 5280 and am referring to a self-signed certificate, which is probably unnecessary (I also put my certificate in the container and got the same result)
When I call:
curl -u 'anonymous@ejabberd.mydomain.com:anonymous' https://ejabberd.mydomain.com/api/user_exists -L
it was return in logs:
ejabberd | 08:21:34.364 [debug] Bad Request: {:badmatch,
ejabberd | {:error,
ejabberd | {:options, :incompatible, [verify: :verify_peer, cacerts: :undefined]}}} [
ejabberd | {:ejabberd_auth_http, :http_request, 6,
ejabberd | [
ejabberd | file: ~c"/opt/ejabberd/.ejabberd-modules/sources/ejabberd-contrib/ejabberd_auth_http/src/ejabberd_auth_http.erl",
ejabberd | line: 230
ejabberd | ]},
ejabberd | {:ejabberd_auth_http, :check_password, 4,
ejabberd | [
ejabberd | file: ~c"/opt/ejabberd/.ejabberd-modules/sources/ejabberd-contrib/ejabberd_auth_http/src/ejabberd_auth_http.erl",
ejabberd | line: 64
ejabberd | ]},
ejabberd | {:ejabberd_auth, :db_check_password, 7,
ejabberd | [file: ~c"src/ejabberd_auth.erl", line: 724]},
ejabberd | {:ejabberd_auth, :"-check_password_with_authmodule/6-fun-0-", 8,
ejabberd | [file: ~c"src/ejabberd_auth.erl", line: 252]},
ejabberd | {:lists, :foldl, 3, [file: ~c"lists.erl", line: 1594]},
ejabberd | {:ejabberd_auth, :check_password_with_authmodule, 6,
ejabberd | [file: ~c"src/ejabberd_auth.erl", line: 250]},
ejabberd | {:ejabberd_auth, :check_password, 6,
ejabberd | [file: ~c"src/ejabberd_auth.erl", line: 225]},
ejabberd | {:mod_http_api, :extract_auth, 1, [file: ~c"src/mod_http_api.erl", line: 99]}
ejabberd | ]When I try to use http endpoint instead of https its return me only 301 responce code without redirection:
ejabberd | 08:20:48.739 [debug] Request result: 301: "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
ejabberd |
ejabberd | 08:20:48.769 [debug] Request result: 301: "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
ejabberd |
ejabberd | 08:20:48.799 [debug] Request result: 301: "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
ejabberd |
ejabberd | 08:20:48.829 [debug] Request result: 301: "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
ejabberd |
ejabberd | 08:20:48.858 [debug] Request result: 301: "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body>\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"Could you please tell me what I'm doing wrong
ejabberd.yml
hosts:
- localhost
- "ejabberd.mydomain.com"
certfiles:
- /home/ejabberd/conf/server.pem
ca_file: "/home/ejabberd/conf/cacert.pem"
...
install_contrib_modules:
- ejabberd_auth_http
auth_method: http
auth_opts:
host: "http://ejabberd-auth.mydomain.com"
path_prefix: "/api/v1/"
listen:
-
port: 5280
ip: "::"
module: ejabberd_http
request_handlers:
"/admin": ejabberd_web_admin
"/api": mod_http_api
"/bosh": mod_bosh
"/captcha": ejabberd_captcha
"/upload": mod_http_upload
"/ws": ejabberd_http_ws
"/oauth": ejabberd_oauth
"/register": mod_register_web
"/conversejs": mod_conversejs
"/xmlrpc": ejabberd_xmlrpc
...
docker-compose.yml
services:
main:
image: ghcr.io/processone/ejabberd:24.07
container_name: ejabberd
environment:
- CTL_ON_START=module_install ejabberd_auth_http
ports:
- "5280:5280"
volumes:
- ./ejabberd.yml:/opt/ejabberd/conf/ejabberd.yml:ro
- ./database:/opt/ejabberd/database
- ./package:/opt/ejabberd/conversejs/packageHi, I tried to replicate your problem, but I faced a pair of inconsistencies before reaching that state.
You are calling user_exists, which is not defined in https://docs.ejabberd.im/developer/ejabberd-api/admin-api/
If I try that query, I get as response "unknown_command"
Surprisingly, in you case that query gets converted to the proper command, called check_password
I don't know what implements that command-name conversion, did you install any other module, or using an older container image?
The ejabberd container image does not include mix or git, that means dependencies cannot get downloaded. This is what I get when I try your docker-compose using podman:
[main] | 10:02:42.489 [info] Start accepting TCP connections at [::]:5280 for :ejabberd_http
[main] | :> ejabberdctl module_install ejabberd_auth_http
[main] | I'll download "fusco" using git because I can't use Mix to fetch from hex.pm:
[main] | /bin/sh: mix: not found
[main] | Fetching dependency cuesport: /bin/sh: git: not found
[main] | Fetching dependency fusco: /bin/sh: git: not found
[main] | Module ejabberd_auth_http has been installed.
[main] | Now you can configure it in your ejabberd.yml
[main] | I'll download "fusco" using git because I can't use Mix to fetch from hex.pm:
[main] | /bin/sh: mix: not foundIn your ejabberd log file, it shows git is installed and used. Did you install it manually, or are using another container image?
The precise problem appears when ejabberd_auth_http executes
fusco:request(Connection, Url, MethodStr, Headers, Query, 2, 5000),
this should return {ok, ...}
but it instead returns
{:error,
{:options, :incompatible, [verify: :verify_peer, cacerts: :undefined]}
}I don't know if that means that some option provided to fusco is problematic, or maybe there was some problem and fusco is simply returning the options it used...
on the ejabberd-24