haskal
/
jiti-meet
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

supports a '*' in the sub claim to allow access to any room

This commit is contained in:
Aaron van Meerten 2019-01-28 16:19:43 -06:00
parent 63ff0c27a9
commit 13165990fc
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
resources/prosody-plugins/token/util.lib.lua
View File

@ -357,11 +357,20 @@ function Util:verify_room(session, room_address)
room_to_check = room_node; room_to_check = room_node;
end end
else else
-- no wildcard, so check room against authorized room in token
room_to_check = auth_room; room_to_check = auth_room;
end end
local auth_domain = session.jitsi_meet_domain; local auth_domain = session.jitsi_meet_domain;
local subdomain_to_check;
if target_subdomain then if target_subdomain then
if auth_domain == '*' then
-- check for wildcard in JWT claim, allow access if found
subdomain_to_check = target_subdomain;
else
-- no wildcard in JWT claim, so check subdomain against sub in token
subdomain_to_check = auth_domain;
end
-- from this point we depend on muc_domain_base, -- from this point we depend on muc_domain_base,
-- deny access if option is missing -- deny access if option is missing
if not self.muc_domain_base then if not self.muc_domain_base then
@ -370,12 +379,19 @@ function Util:verify_room(session, room_address)
end end
return room_address_to_verify == jid.join( return room_address_to_verify == jid.join(
"["..auth_domain.."]"..string.lower(room_to_check), self.muc_domain); "["..subdomain_to_check.."]"..string.lower(room_to_check), self.muc_domain);
else else
if auth_domain == '*' then
-- check for wildcard in JWT claim, allow access if found
subdomain_to_check = self.muc_domain;
else
-- no wildcard in JWT claim, so check subdomain against sub in token
subdomain_to_check = self.muc_domain_prefix.."."..auth_domain;
end
-- we do not have a domain part (multidomain is not enabled) -- we do not have a domain part (multidomain is not enabled)
-- verify with info from the token -- verify with info from the token
return room_address_to_verify == jid.join( return room_address_to_verify == jid.join(
string.lower(room_to_check), self.muc_domain_prefix.."."..auth_domain); string.lower(room_to_check), subdomain_to_check);
end end
end end