Jitsi-meet: Jitsi Meet with ejabberd: authentication required

[rasos]

As ejabberd is already running on our server and to avoid port conflicts we want to replace Prosody with ejabberd. We followed this tutorial: https://jitsi.org/Projects/JitsiVideobridgeWithEjabberd

We have two issues:

1. After entering the conference room an additional xmpp login is needed. If I enter an xmpp user's login, I can proceed. We have not found out whether ejabberd can be configured to accept anonymous users in the docs: https://docs.ejabberd.im/admin/configuration/#authentication

1. Jicofo is connecting, but cannot establish a conference

Jicofo 2017-02-07 10:56:12.026 INFO: [15] org.jitsi.jicofo.FocusManager.log() XMPP provider reg state: RegistrationState=Registered
Jicofo 2017-02-07 10:56:12.026 INFO: [15] org.jitsi.impl.protocol.xmpp.XmppProtocolProvider.log() XMPP provider Jabber:[email protected]/[email protected] connected (JID: [email protected]/focus360826710359579)
Jicofo 2017-02-07 11:46:05.849 SEVERE: [30] org.jitsi.meet.ComponentMain.call().278 not-authorized, host:meet.domain.tld, port:5347
org.xmpp.component.ComponentException: not-authorized

We had adapted the following lines in /opt/ejabberd-16.04/conf/ejabberd.yml:

hosts:
  - "conference.meet.domain.tld"
  - "jitsi-videobridge.meet.domain.tld"

additional section:
-
    port: 5347
    module: ejabberd_service
    access: all
    shaper_rule: fast
    ip: "127.0.0.1"
    hosts:
      "jitsi-videobridge.meet.domain.tld":
         password: "1234#5"

Anybody running Jitsi meet with ejabberd?

[damencho]

Please use the mailinglist for questions and problems before opening issues.

The page you reference is just for videobridge and running it as a component inside ejabberd. You also need to configure and jicofo's component and also its xmpp user, which needs to be admin in order to run jitsi-meet.
Basically you need to duplicate the prosody config inside ejabberd. The template used inside jitsi-meet-prosody package is: https://github.com/jitsi/jitsi-meet/blob/master/doc/debian/jitsi-meet-prosody/prosody.cfg.lua-jvb.example
The script configuring prosody is here: https://github.com/jitsi/jitsi-meet/blob/master/debian/jitsi-meet-prosody.postinst, it configures prosody by filling the template and using same values to put them inside jicofo config.
Taking the template and following the steps will help you configure ejabberd.

[damencho]

Yep, you have a xmpp user, just make sure the user is an admin, needs to be able to set ownership to room participants. And also add jicofo's component and probably it will work.

[rasos]

For the records: We did some further investigatios and did not succeeed yet. jjicofo does not react correctly on the Pong of ejabberd:

$ grep "qycF9-69" /var/log/jitsi/jicofo.log
Jicofo 2017-02-09 10:43:54.311 SEVERE: [33] org.jitsi.xmpp.component.ComponentBase.run().629 Ping timeout for ID: qycF9-69

2017-02-09 10:43:49.311 [debug] <0.31994.3>@ejabberd_receiver:process_data:284 Received XML on stream = <<"<iq id=\"qycF9-69\" to=\"meet.domain.tld\" from=\"focus.meet..domain.tld\" type=\"get\"><ping xmlns=\"urn:xmpp:ping\"></ping></iq>">>
        packet {xmlel,<<"iq">>,[{<<"id">>,<<"qycF9-69">>},{<<"to">>,<<"meet.ucom.gv.at">>},{<<"from">>,<<"focus.meet.ucom.gv.at">>},{<<"type">>,<<"get">>}],[{xmlel,<<"ping">>,[{<<"xmlns">>,<<"urn:xmpp:ping">>}],[]}]}
2017-02-09 10:43:49.313 [debug] <0.31994.3>@ejabberd_receiver:process_data:284 Received XML on stream = <<"<iq type=\"result\" id=\"qycF9-69\" from=\"meet..domain.tld\" to=\"focus.meet..domain.tld\"/>">>
        packet {xmlel,<<"iq">>,[{<<"type">>,<<"result">>},{<<"id">>,<<"qycF9-69">>},{<<"from">>,<<"meet..domain.tld">>},{<<"to">>,<<"focus.meet..domain.tld">>}],[]}

But Jicofo says thePing is a timeout. Even with log-level org.jitsi.impl.protocol.xmpp.level=FINE in /etc/jitsi/jicofo/logging.properties we don't get more information.

The relevant ejabberd specs is http://xmpp.org/extensions/xep-0199.html

The password auth popup is from XMPP over Bosh (http://xmpp.org/extensions/xep-0206.html#preconditions-sasl) as behind /http-bind a reverse proxy is pointing on the ejabberd_http module. We have not found, how to deactivate authentification, though.

[damencho]

The logs show that ejabberd is receiving pings, but do you see whether ejabberd is responding to them? In prosody there is a module ping that you need to enable in order to make pings work.

So you need few components and few virtual hosts, not sure how this translates into ejabberd config.
Components:
Component "conference.jitmeet.example.com" "muc" // which is the actual muc, should be internal to the server or something like that
Component "jitsi-videobridge.jitmeet.example.com" // this is external component with password as described in the doc for jvb
Component "focus.jitmeet.example.com" // this is again an external component with password

And the virtual hosts:
VirtualHost "jitmeet.example.com" // this is the default one where every client will connect, and enabling only anonymous users there will not require authentication
I see on ejabberd docs something like:
{host_config, "public.example.org", [{auth_method, anonymous},
{anonymous_protocol, login_anon}]}.

VirtualHost "auth.jitmeet.example.com" // this one needs authentication, it is used by jicofo and its authenticated user, cause only those can be admins

[damencho]

I would love to see ejabberd integration inside jitsi-meet :) At least having the template of a working deployment, as we have for prosody.