Rocket.chat: Allow anonymous use of the chat [$250]

[mitar]

So currently, Rocket.Chat is a very much a Slack clone. But my main issue with Slack is that it is not open enough. So I would like an option to make Rocket.Chat more open. What I mean by that is that is that users can come and start reading what is happening on public channels without registration. So when a not-logged in user would open root address, they would get to the normal main screen, with all channels listed and so on. When they would open a channel, they could see what is happening there, but the message input box would be grayed out and a message to register/login to post would be there.

There is a $250 open bounty on this issue. Add to the bounty at Bountysource.

[mitar]

What does "Registration Required" set to false do? I have not seen any effect?

[frabrunelle]

:+1:

I am considering switching away from Slack and this is one of the main features I am looking for (being able to access and read the public channels without registration).

[AdrianoCahete]

This needs to be an option for each channel. If the creator wants it, the channel can be read for unregistred users.

[mitar]

Or written to. I would really like that it can be like: user comes, sees channels (maybe flagged as such), and can read them, and can write an reply. And if the are not logged in, they have also to fill in the name in the status bar (which stays stored locally).

[mitar]

Bump:

What does "Registration Required" set to false do? I have not seen any effect?

[rwakida]

@mitar Registration Required is not used at this time.

[mitar]

Heh, a setting which does nothing. ;-) OK, this is good, then it can be used for this particular purpose. So I would suggest that we make it so:

• if "registration required" is false, then user can come and read all channels
• if user wants to make a message, then another setting specifies if they have to register before doing that, or if they can just pick a name

I would say that concept of private and public channels should be for some other ticket/task.

[geekgonecrazy]

for sure agree with @AdrianoCahete this needs to be maybe global to allow it. But needs to be a per channel setting.

[mitar]

But if I want to have all channels public, I do not want to enable per channel it every time.

I think that per channel permissions can be added later. Because those are two pretty different use cases still.

[mitar]

Maybe we could use a Meteor package which automatically creates an account for every user, and then just use permissions to do the rest. And allowing users to change the username and set password would then allow them to register the account once they decide to do so.

There are packages like:

• https://github.com/artwells/meteor-accounts-guest
• https://github.com/brettle/meteor-accounts-anonymous-auto

Not sure which one is good.

[sampaiodiego]

I've used meteor-accounts-guest for livechat package, and I don't think it's a good idea to create a user for every person who access rocket.chat. And if you setup this, you'll have no registration form, since every visitor will be automatically registered as a guest user.

I think you should just rely on admin settings to force user registration or not.

[geekgonecrazy]

I agree. A user per guest is a bit too much over head just to let them see the channel.

[mitar]

And if you setup this, you'll have no registration form, since every visitor will be automatically registered as a guest user.

Yes, and then you have a registration-looking form which converts that guest user to a normal user. It sets username and password and e-mail, for example. It can look to the user the same as current registration form.

I agree. A user per guest is a bit too much over head just to let them see the channel.

I would like not just seeing the channels, but also posting. So posting without having to be registered (you just pick the name when you want to post).

[rodrigok]

IMHO

• We need an option to turn all or each channel public for read, no new users, just public as a web site
• If user want to post something he should click in "Join Channel" and create an account to post.

[gmsecrieru]

+1 to @rodrigok

[mitar]

Again, I think there are two features here and I think both should be supported:

• anonymous reading
• anonymous writing

I see that some people like the feature of anonymous reading, but I would also need anonymous writing.

[rodrigok]

@mitar anonymous write is possible, but we can't provide consistency and is much hard to prevent flooding.

[ShaRose]

For anonymous reading, you wouldn't need an account.
For anonymous writing, when you try to send your first message it should ask for you a temporary username (which would be bound to that IP address for, say, 24 hours after you last were in a channel), and also ask if you want to register an account.

Anonymous usernames might be pre or post pended with (Anon) or (Temp) or something as well, so users know they aren't registered (per server setting?).

Those sound like good ideas?

[joepie91]

+1

[geekgonecrazy]

@ShaRose Might as well just use a normal session. Binding to an IP is generally a bad idea. Think public access. More then one user in a library / coffee shop? I've been in situations where I went to a sight and I was suddenly logged in as someone else ;)

[mitar]

Might as well just use a normal session.

+1

This is why I was proposing autocreation of accounts for each guest when you are in "no registration required" mode.

[rodrigok]

Per room or general access options (radio - choose one):

• No public (default)
  
  
  
  • READ: Only with an account
  
  
  • WRITE: Only with an account
  
  
• Public read
  
  
  
  • READ: Public, anyone can read all messages
  
  
  • WRITE: Only with an account
  
  
• Public read/write
  
  
  
  • READ: Public, anyone can read all messages
  
  
  • WRITE: Public, user will create an username (account without password and email) and this account can be used until user logout and keep using the same browser
  
  

Other options

• We can require an email instead the username for public write, so we can send a generated password via email and the user can login back if necessary
• We can generate a password and show to user in case he/she want to save the login data

[Sing-Li]

:+1: Perfect use case to put our permissions and roles system to work. Perhaps even the start of interpreted policies.

[geekgonecrazy]

:+1: that looks like a sound plan

[mitar]

Public, user will create an username (account without password and email) and this account can be used until user logout and keep using the same browser

I think this is a great idea! Instead of using guest accounts for all guests, we just create an account when they make the first post.

I would just make then there some visible button all the time present to such an user to register that username (not sure where, maybe in the sidebar on the left, or top bar). In that case they have to specify e-mail and password, and then it is theirs. Because they could not choose the username which already exists, this registration should work anyway.

We can require an email instead the username for public write

That might be confusing for @mention because of the @ in the e-mail address?

[mitar]

BTW, the important thing to remember is that this should also work for mobile apps. So that in the mobile app user should just add our server and then they could access public channels without having to register. This probably comes for free with Cordova, but just want to make sure.

[geekgonecrazy]

Yup if it works for desktop it works for mobile. :)

[rchikballapur]

Hi @engelgabriel - any progress on this feature? I have been following this up for months. Would love to see it appear on the release. Cheers!

[engelgabriel]

@marceloschmidt is working on that, but he is on holidays until march now :(

[mitar]

Is bounty still on? $250 is not so little for this feature. Are there any directions how this should be resolved?

[rchikballapur]

@marceloschmidt , please come back from vacation and build us this feature :)

[butaman]

+1
I added $20 bounty.

[Syirrus]

Being able to read the contents of a channel without logging in would be awesome indeed.

[Jack-Collins]

any update on this?

[adis-io]

Just letting read anonymously would be awesome. Waiting for this.

[garrisons]

@engelgabriel @marceloschmidt is this a planned feature? Was thinking about picking up the bounty on it, but don't want to over lap efforts with the rocketchat team!

Also, can non-team members pick up bounties? Not trying to steal income from you guys just am interested in this feature! :)

[geekgonecrazy]

@garrisons this is planned, but its not being worked on right now. Feel free to take a stab at it. 👍

[adis-io]

@garrisons We believe in you :)

[butaman]

I really need this!
I posted additional $30 bounty.

[adis-io]

@garrisons any update on this? I really need this feature.

[flantascience]

@garrisons or @marceloschmidt Anyone make progress here? Just added another $20 to the bounty - it's at $320 now.,

[oxidworks]

Would be very happy for such a feature ! Thanks

[Superhearing]

Just added $100 to the bounty ;)

[crackcomm]

Hey! @mitar @Superhearing @butaman @flantascience

I'm trying to come up with a solution for this issue.

There was a discussion about using guest accounts. I understand both points of view and trade-offs of both (maybe not all of them).

Main issue with having guest accounts from my point of view is amount of the data and it can be solved like that:

// example from https://atmospherejs.com/artwells/accounts-guest
/* clean out all guest accounts more than 2 hours old */
var before = new Date();
before.setHours(before.getHours() - 2);
Accounts.removeOldGuests(before);

The main issues with not having an account for a chat participant are following:

1. Deleting messages
2. Updating messages
3. User status (changing, observing)
4. Meteor.userId() used on almost every step

Those can also be solved but with a much greater effort.

Is not using guest account a prerequisite to solve this issue?

[flantascience]

I understood the goal was to allow non-members to view the channels without
axtualy posting anything. By nexessarily making a guest account but just
viewing capability to non-users.

On Sunday, January 8, 2017, Łukasz Kurowski [e-mail]
wrote:

Hey! @mitar https://github.com/mitar @Superhearing
https://github.com/Superhearing @butaman https://github.com/butaman
@flantascience https://github.com/flantascience

I'm trying to come up with a solution for this issue.

There was a discussion about using guest accounts
https://atmospherejs.com/artwells/accounts-guest. I understand both
points of view and trade-offs of both (maybe not all of them).

Main issue with having guest accounts from my point of view is amount of
the data and it can be solved like that:

// example from https://atmospherejs.com/artwells/accounts-guest/* clean out all guest accounts more than 2 hours old */var before = new Date();before.setHours(before.getHours() - 2);Accounts.removeOldGuests(before);

The main issues with not having an account for a chat participant are
following:

1. Deleting messages
2. Updating messages
3. User status (changing, observing)
4. Meteor.userId() used on almost every step

Those can also be solved but with a much greater effort.

Is not using guest account a prerequisite to solve this issue?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/RocketChat/Rocket.Chat/issues/604#issuecomment-271187076,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AL_pYhXTLXZcpPOUKjbdJiyqgBTkChR5ks5rQWvIgaJpZM4F0Lwk
.

--
Jim Flannery

jim-flannery.com
p. 860-212-8862
e. [email protected]
s. jim_flannery

[crackcomm]

@flantascience that was helpful, thanks.

[ghost]

Sorry if I'm distracting. But I did not know that at the beginning was the idea to only see public channels.

I liked what achieved riot.im/app

You can enter as guest, and it says this message:
"You are Rioting as a guest. Register or sign in to access more rooms and features."

You can enter a channel to see what they say. You can join as guest, and speak. Seems that you cannot create new channel or talk in private messages. Why not the possibility of all these features?

[mitar]

@crackcomm, my proposal for this issue is that you do not even have a quest account. It is just that data/channels are publicly readable. So that anyone can go around and read them (including robots like Google). You cannot really do anything with content and post, but you can read. One does not have to get a guest account. That would be the first step.

Then the next step would be that users can write to channels without having to register, maybe with some random username like guest1234. And they can configure that username if they register.

[snaiperskaya96]

Hi!
I've come out with a solution (see referenced PR).
The idea is basically to create a guest user automatically (We need a physical user due to the massive user checks), assign him guest role and eventually delete it when the session is over.

Again, we actually need to make an account for the anonymous user, cannot avoid it, there are too many checks.

Let me know 😄

[flantascience]

Does that mean that we can only have a single guest on the site at a time?
Or is a new user created each time? Will this leads to a huge and growing
list of guest users or will they be removed after a certain point?

Jim Flannery

jim-flannery.com
p. 860-212-8862
e. [email protected]
s. jim_flannery

On Wed, Jan 18, 2017 at 8:22 AM, Jury Verrigni [e-mail]
wrote:

Hi!
I've come out with a solution (see referenced issue).
The idea is basically to create a guest user automatically (We need a
physical user due to the massive user checks), assign him guest role and
eventually delete it when the session is over.

Again, we actually need to make an account for the anonymous user, cannot
avoid it, there are too many checks.

Let me know 😄

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/RocketChat/Rocket.Chat/issues/604#issuecomment-273473630,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AL_pYtOXSTgT2mn8k71YrhAIYSTLt0W_ks5rThITgaJpZM4F0Lwk
.

[snaiperskaya96]

No, of course you can have multiple guests at the same time, and the guest account will get deleted once logged out

[garg]

Thanks! I'll try this out soon. Looks promising!

[butaman]

@snaiperskaya96 Thanks a lot.

Just an idea, it would be nice if there is option to set display name at login screen for guest user.
because we may get confusing if a lot of guest-xxxx users join at the same time.

[garg]

@butaman Shouldn't they just register for an account if they want a username?

@snaiperskaya96 I fetched the pull request to a newly cloned rocket.chat project:

git fetch origin pull/5647/head:allow-anonymous-access

And then ran the allow-anonymous-access branch with 'meteor npm start', but I get the following:

=> Started proxy.                             
=> Started MongoDB.                           
I20170119-22:59:36.566(-5)? Will load cache for users
I20170119-22:59:36.622(-5)? 2 records load from users
I20170119-22:59:36.623(-5)? Will load cache for rocketchat_room
I20170119-22:59:36.623(-5)? 1 records load from rocketchat_room
I20170119-22:59:36.624(-5)? Will load cache for rocketchat_subscription
I20170119-22:59:36.624(-5)? 1 records load from rocketchat_subscription
I20170119-22:59:36.624(-5)? Will load cache for rocketchat_settings
I20170119-22:59:36.625(-5)? 442 records load from rocketchat_settings
I20170119-22:59:36.625(-5)? Updating process.env.MAIL_URL
I20170119-22:59:36.625(-5)? Will load cache for rocketchat_permissions
I20170119-22:59:36.626(-5)? 63 records load from rocketchat_permissions
I20170119-22:59:36.626(-5)? ufs: store created at 
I20170119-22:59:36.626(-5)? Exception in callback of async function: Error: [Can't find migration version 81]
I20170119-22:59:36.627(-5)?   at Object.Migrations._findIndexByVersion (/Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/packages/rocketchat_migrations.js:413:8)
I20170119-22:59:36.627(-5)?   at Object.Migrations._migrateTo (/Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/packages/rocketchat_migrations.js:281:22)
I20170119-22:59:36.627(-5)?   at Object.Migrations.migrateTo (/Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/packages/rocketchat_migrations.js:221:20)
I20170119-22:59:36.627(-5)?   at meteorInstall.server.startup.migrations.xrun.coffee.js (/Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/app/app.js:3871:25)
I20170119-22:59:36.628(-5)?   at fileEvaluate (packages/modules-runtime.js:188:9)
I20170119-22:59:36.628(-5)?   at require (packages/modules-runtime.js:111:16)
I20170119-22:59:36.629(-5)?   at /Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/app/app.js:8314:1
I20170119-22:59:36.629(-5)?   at /Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/boot.js:295:34
I20170119-22:59:36.629(-5)?   at Array.forEach (native)
I20170119-22:59:36.630(-5)?   at Function._.each._.forEach (/Users/username/.meteor/packages/meteor-tool/.1.4.2_3.1i5aaok++os.osx.x86_64+web.browser+web.cordova/mt-os.osx.x86_64/dev_bundle/server-lib/node_modules/underscore/underscore.js:79:11)
I20170119-22:59:36.630(-5)?   at /Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/boot.js:128:5
I20170119-22:59:36.630(-5)?   at /Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/boot.js:344:5
I20170119-22:59:36.631(-5)?   at Function.run (/Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/profile.js:480:12)
I20170119-22:59:36.631(-5)?   at /Users/username/Code/anonymous-rocket-chat/Rocket.Chat/.meteor/local/build/programs/server/boot.js:343:11
I20170119-22:59:36.632(-5)? 

Checking out and running the master or develop branches works just fine though. Is this a bug or have I patched the code incorrectly? Thanks again!

[butaman]

@garg ah, I quite forgot that main purpose of this issue is not guest access but anonymous access. changing username is not very important thing here.

However, my idea was from @rodrigok's suggestion

WRITE: Public, user will create an username (account without password and email) and this account can be used until user logout and keep using the same browser

and Skype guest access.

https://support.skype.com/en/faq/FA34572/how-do-i-join-a-skype-conversation-using-the-link-i-received

In addition, I simply think it may looks ugly if there were a lot of guest-xxxx account in channel.

[snaiperskaya96]

@butaman you won't be able to see that a guest has joined the default channels, also they cannot write so the normal user cannot see lots of "guest-xx" has joined or has wrote.
Anyway I could just add an option to let guests show their name, no problem I think.

@garg that happened to me a few times but it's not branch related. Can you test it in a brand new installation? Try with git clone https://github.com/snaiperskaya96/Rocket.Chat and git checkout allow-anonymous-access

[garg]

@snaiperskaya96 That worked for me! And it seems to be working great. Just noticed a few things:

• When not logged in, going to localhost:3000 immediately redirects to the lobby. Can it be so that going to localhost:3000 always shows the login form if not logged in?

• When do the guest accounts get deleted? I made about 4 but they all haven't been deleted yet.

• As guest, clicking on the top left area where it says guest-X opens the left menu which says 'login'. When clicked on 'login', it shows the login form briefly and then goes back into the lobby and logs in as 'guest-X+1'

• When it automatically goes to the lobby, sometimes it starts a continuous loading graphic. Clicking on the channel name doesn't change anything. It requires a browser refresh.

The rest looks great!

Some suggestions for further improvements

• It could probably use some UI related changes like @pedro-nonfree's riot-im screenshot

I've used Chrome and Safari for the above tests.

[snaiperskaya96]

Hi @garg!
Thanks for your feedback!

When not logged in, going to localhost:3000 immediately redirects to the lobby. Can it be so that going to localhost:3000 always shows the login form if not logged in?

Guess this could be an additional settings option, someone may prefer a direct login as guest (the main request is to open Rocket.Chat and being able to read), someone may prefer the user to choice

When do the guest accounts get deleted? I made about 4 but they all haven't been deleted yet.

They get deleted after they logout, I guess i will have to setup a timer that check if guests are logged in and delete them eventually

As guest, clicking on the top left area where it says guest-X opens the left menu which says 'login'. When clicked on 'login', it shows the login form briefly and then goes back into the lobby and logs in as 'guest-X+1'

Shouldn't happen (doesn't happen on mine, i faced this issue and fixed it, but i will double check it)

When it automatically goes to the lobby, sometimes it starts a continuous loading graphic. Clicking on the channel name doesn't change anything. It requires a browser refresh.

Gonna have a look!

It could probably use some UI related changes like @pedro-nonfree's riot-im screenshot

As above

Thanks for your feedback again, I'll keep you in the loop :)

[snaiperskaya96]

Hey @garg, I've fixed the issues you have found (except the login one that i couldn't reproduce).
There is now an option to enable/disable automatic login as guest. The infinite loading shouldn't happen anymore and the guests get instantly deleted as soon as the session finish (like closing the tab).
Let me know! 😄
(Btw, git pull origin allow-anonymous-access should be enough to update it 😃 )

[garg]

@snaiperskaya96 Thanks! That appears to be working well. I had a few of the redirect issues but that may have been because of something cached in the browser because I can't repeat it right now. I'll test some more with different browsers and settings to confirm.

Deleting 'guest' accounts when tab closes works perfectly.

One other thing -- if I close my browser (in this case, Safari), and then reopen, and then paste http://localhost:3000/channel/general then I get either only the login page, or an error message 'Invalid User'. I think if someone has a URL to a public room, then guest should be able to go right in to that room by use visiting the URL directly.

I'll read through this thread again to make sure that there wasn't something else mentioned in here.

Thanks again!

[snaiperskaya96]

Hello @garg!

One other thing -- if I close my browser (in this case, Safari), and then reopen, and then paste http://localhost:3000/channel/general then I get either only the login page, or an error message 'Invalid User'. I think if someone has a URL to a public room, then guest should be able to go right in to that room by use visiting the URL directly

The `Invalid user' pops out because the browser is trying to login using a deleted user.
About the direct URL thing I think that I might be part of another issue, something like "allows redirect from login page" so that if you go to /channel/room1 without being authenticated you get redirected to something like /login? p=/channel/page1 and after login (or automatic login if guest) you get redirected to the initial page you wrote.
Can you leave a feedback on the PR please? :) (#5647 Allow anonymous use of the chat)

[garg]

@snaiperskaya96 I left a comment on the PR! :) Thanks

[patcon]

fwiw, if this is critical to anyone, riot chat allows world-readable channels already: https://chat.tomesh.net/#/directory

[rasos]

Where can I define, which public channels are listed in the left column when arriving anonymously at the start page? Currently I see "undefined" only and directory does not allow to search (which is okay for users, but it should list public channels).

[lunitic]

@rasos Make the channel/rrom default and it will be showed there

[rasos]

@lunitic tnx, but where do I set a channel room to become default? Can't find it in any menu. We're on RC 0.62. I only can set it as favorite which is a per user setting.

[flantascience]

If you set them as "default" channels, I think they will show up
automatically.

Jim Flannery

jim-flannery.com
p. 860-578-4966
e. [email protected]
s. jim_flannery

On Mon, Apr 23, 2018 at 5:07 AM, Roland [e-mail] wrote:

Where can I define, which public channels are listed in the left column
when arriving anonymously at the start page? Currently I see "undefined"
only and directory does not allow to search (which is okay for users, but
it should list public channels).

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/RocketChat/Rocket.Chat/issues/604#issuecomment-383506707,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AL_pYhDmCLmGEQSoJNmbdGXo_ut6SHd4ks5trZnjgaJpZM4F0Lwk
.

[leonardorocc0]

Hi there
I don't see this is possible to make some channels available to anonymous users.
There is a public/private setting for each channel and the default flag but it doesn't mean I can exclude anonymous user from writing or seeing other public channels.
Do you think this could be added as a feature?
Thank you!