Login via POST or pre-configured endpoint

[ZenenTreadwell]

Bonjour et merci beaucoup pour ton travail avec ce projet.

I'm hoping to integrate this with a system I've been building. To integrate it properly, I would like to bypass the login screen by POSTing the login credentials without any further input from the user. I know that ConverseJS has support for a /credentials endpoint, which would also work.

What do you think would be the best course of action here. Should I implement something and make a PR or is there something built-in already?

[nioc]

Hi @ZenenTreadwell, thanks for the kind words in French 😃

Automatic authentication can be handled in different ways, an easy way would be to add query string parameters like #/login?jid={jid}&password={password}&redirect=/, this is not very secure but it may be ok if done through a SSO proxy.

Can you tell me more about the mechanics you're planning from your system?

[ZenenTreadwell]

I was also considering querystring parameters, but there's a few vulnerabilities with GET requests that I would like to avoid if possible.

My system uses a deterministic key generator, and the idea is that users who have logged in will be able to generate the password from their account's session object. The idea is that, once the user is logged in to the main system, there will be a link available to open up xmpp-web that somehow bypasses its login page.

Does that help to clarify?

[nioc]

Yes, but it sounds very specific and I'd rather avoid it.

If you think you can use an SSO system, on the other hand, we should be able to take a look at it.

sequenceDiagram
    autonumber
    actor U as User
    participant B as Browser (including SPA)
    participant RP as SSO Reverse Proxy
    participant XW as XMPP Web Nginx
    participant X as XMPP server (Prosody)
    U->>+B: Login to SSO<br>(https://your-sso/auth)
    B->>+RP: Login to SSO<br>(https://your-sso/auth)
    RP->>RP: Authentication stuff
    RP-->>-B: Logged in<br>(cookie or whatever)
    B-->>-U: 
    U->>+B: Access to XMPP-web<br>(https://your-sso/xmpp/login)
    B->>+RP: Access to XMPP-web<br>(https://your-sso/xmpp/login)
    RP->>RP: Check auth and<br>forward request
    RP->>+XW: /login
    # XW->>XW: Transform request header
    XW-->>-RP: 
    RP-->>B: Add XMPP jid and password<br>as response headers 
    B->>B: Use response header for setting<br>jid and password in login form
    B->>X: XMPP authentication
    X-->>B: 
    B->>B: Load main component<br>(or redirect if provided)
    B-->>-U: 

Loading

In this sequence, all the auth/proxy work is on your side, I just have to add the 12th line: add in SPA the getting of jid and password from headers, initialize the login form and launch authentication function

[nioc]

By the way, this credentials_url is a public JSON file containing user login and password... very poor security, worst than providing as query parameter 😆

[ZenenTreadwell]

Haha, well of course I wouldn't make it a public endpoint! It would require a session key.

I was taking some time to look around at different SSO options, I don't have much of a feel for this sort of technology, but I'm pretty sure that Solid implements an option here. Their spec is here: https://solidproject.org/TR/oidc

Would something like this work for the process you're imagining?

[nioc]

Haha, well of course I wouldn't make it a public endpoint! It would require a session key.

The JSON file would be loaded on exposed network (xmpp-web, as any SPA, is client side code), I do not know how this can be secured.

Their spec is here: https://solidproject.org/TR/oidc

This is OpenID Connect mechanism. I do not know if XMPP server handle it. I have quicky seen xep-0493 and this Prosody module but in alpha and require you login to obtain an access token.

I keep this open, if someone would like to dig further.

[f1-outsourcing]

Hi Nicolas,

I just installed your software, and was also wondering how to get this to work with single sign on using openid or saml2, and found this issue. I am currently testing a bit with keycloak.
If you want I can give you a login on my keycloak to experiment with.

[nioc]

Hello, I will not handle an OAuth2 implementation, I keep it opened if someone (else) would like to propose a PR for implementing it.

[nioc]

I added a basic SSO mechanism.

You have to expose a secured endpoint which will be requested in GET method (handled in sso.endpoint in local.js). It must return a OK status (200) and both jid and password in response headers (you can choose header name, default is jid and password which can be changed in local.js.

Basic example:

$ curl http://localhost:1880/xmpp-auth --head
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
jid: admin
password: mypassword
Access-Control-Expose-Headers: jid, password
X-Content-Type-Options: nosniff
Content-Type: application/json; charset=utf-8
Content-Length: 4
ETag: W/"4-K+iMpCQsduglOsYkdIUQZQMtaDM"
Date: Sun, 16 Feb 2025 18:04:59 GMT
Connection: keep-alive
Keep-Alive: timeout=5

If xmpp-web and auth server (like Authelia) are not on the same domain, you will have to add this header:

Access-Control-Expose-Headers: jid, password