[feature] possibility to authenticate XMPP/Prosody users against Friendica api/json

[AlfredSK]

There is a possibility to authenticate XMPP users from ejabberd using their Friendica credentials. There is no such option for xmpp/prosody at the moment.

@annando suggested here

A lua script could directly do a http auth against "/api/account/verify_credentials.json"

So, I did some research and found this:

HTTP Authentication using custom JSON protocol:
https://modules.prosody.im/mod_auth_custom_http.html

Maybe it's possible to create an addon for this.

[fabrixxm]

This should work out of the box against "/api/account/verify_credentials.json" :-)

https://modules.prosody.im/mod_auth_http_async.html

[annando]

That script that @fabrixxm mentioned worked nearly out of the box. I had to manually deactivate the asynchronous mode by setting the variable local have_async in that script to false, but that is no Friendica issue. In Friendica nothing had to be modified to make it work.

Because of that I'm closing this issue.

[AlfredSK]

@annando I regularly get errors with this authentication method. It works w/o problems for days and then all of a sudden I can't login anymore. 'Conversations' says wrong username or password.

When this happens I can reproduce that it is related to this fatal PHP error: #7998 (comment)

Any idea what might be wrong?

[Quix0r]

Is it still an issue? I consider switching from ejabberd (I still love it) to prosody).

[Quix0r]

But shouldn't we better authenticate over a local script or socket (e.g. provided by the daemon) instead of this overflow of HTTPS connection which may cause (paid) traffic on some hoster?

[AlfredSK]

It works perfectly fine.

[fabrixxm]

But shouldn't we better authenticate over a local script or socket (e.g. provided by the daemon) instead of this overflow of HTTPS connection which may cause (paid) traffic on some hoster?

If it's on same server you should not generate traffic for a call to localhost.
If it's on another server you will generate traffic connecting to a socket anyway.

[annando]

Also the total number of HTTP connects of a single call to the network page will exceed the number of HTTP connects for authentication purposes per year, I guess.

[Quix0r]

Unfortunately localhost doesn't point to my Friendica instance, I have several virtual hosts here. Hmm, I might go like this: http://localhost/friendica/api/foo/bar.json I could map http://localhost/friendica/ to my actual Friendica instance, if that works?

[AlfredSK]

Why do you want to do that? The authentication requests are probably around 0.00001% of the overall network traffic.

[annando]

I just checked on squeet.me. Yesterday there had been 35 requests for api/account/verify_credentials.json. (I'm using Prosody on that serer). Today there had been 51 requests so far.

The total number of requests yesterday had been 1.262.511, today so far 578.027.

[Quix0r]

Okay, that isn't much to handle.