Authorization via login/password for Coturn

[ZelChief]

Coturn server will not work with static-auth-secret under NAT as a TURN server. You can find information about this issue here:

1. TURN Server not working coturn/coturn#162 (comment)
2. Stun on CoTurn doesnt work coturn/coturn#933 (comment)

But if configure in /etc/turnserver.conf static login and password, Coturn will work as turn server under NAT.

lt-cred-mech
user=turnuser:secret

Describe the solution you'd like
Can you add а variable to matrix-coturn to setup lt-cred-mech and to disable static-auth-secret?

[ZelChief]

@spantaleev can you show the way to setup login and password for Coturn?

[ZelChief]

In homeserver.yaml.j2 there is necessary variables:

# The Username and password if the TURN server needs them and
# does not use a token
#
turn_username: "TURNSERVER_USERNAME"
turn_password: "TURNSERVER_PASSWORD"

Maybe there is a way to use them for external Coturn server?

[spantaleev]

This is now implemented.

As described in the new Changing the authentication mechanism documentation section, the only thing you should need to make use of it is this additional configuration:

matrix_coturn_authentication_method: lt-cred-mech

Credentials will be generated automatically and passed to all components involved.

The aforementioned bug reports indicate that switching to lt-cred-mech helps, but I see no explanation why. If we find out more about it, we may consider making lt-cred-mech the default for the playbook.