This module provides external authentication via an external OAuth 2 authorization server and supports the SASL OAUTHBEARER authentication mechanism as well as PLAIN for legacy clients (this is all of them).
Clients retrieve tokens somehow, then show them to Prosody, which asks the Authorization server to validate them, returning info about the user back to Prosody.
Alternatively for legacy clients, Prosody receives the users username and password and retrieves a token itself, then proceeds as above.
-- authentication = "oauth_external"
= "https//auth.example.com/auth/realms/TheRealm/.well-known/openid-configuration"
oauth_external_discovery_url = "https//auth.example.com/auth/realms/TheRealm/protocol/openid-connect/token"
oauth_external_token_endpoint = "https//auth.example.com/auth/realms/TheRealm/protocol/openid-connect/userinfo"
oauth_external_validation_endpoint = "xmpp_username" oauth_external_username_field
oauth_external_issuer
oauth_external_discovery_url
oauth_external_issuer
is set, otherwise empty.
oauth_external_validation_endpoint
oauth_external_username_field
.
Commonly the OpenID
UserInfo
endpoint If left unset, only
SASL PLAIN
is supported and the username provided there is
assumed correct.
oauth_external_username_field
"preferred_username"
. Field in the JSON
structure returned by the validation endpoint that contains the XMPP
localpart.
oauth_external_resource_owner_password
true
. Whether to allow the
insecure resource owner password
grant and SASL PLAIN.
oauth_external_token_endpoint
oauth_external_client_id
oauth_external_client_secret
oauth_external_scope
"openid"
. Included in request for
resource owner password grant.
Version | Status |
---|---|
trunk | works |
0.12.x | OAUTHBEARER will not work, otherwise untested |
0.11.x | OAUTHBEARER will not work, otherwise untested |
Tested with
With the plugin installer in Prosody 0.12 you can use:
sudo prosodyctl install --server=https://modules.prosody.im/rocks/ mod_auth_oauth_external
For earlier versions see the documentation for installing 3rd party modules