Skip to content

Latest commit

 

History

History
285 lines (199 loc) · 6.43 KB

setup-standalone.md

File metadata and controls

285 lines (199 loc) · 6.43 KB

Standalone setup

The setup guide to install Jitsi Keycloak Adapter v2 on a standalone Jitsi server.

Tested on Debian 12 Bookworm with Jitsi v2.0.9823. Use root account while running the commands.

1. Token authentication

Enable the token authentication for prosody.

1.1 jitsi-meet-tokens package

apt-get install jitsi-meet-tokens

Check related parameters in your /etc/prosody/conf.d/YOUR-DOMAIN.cfg.lua. They should be already set by apt-get command.

VirtualHost "<YOUR-DOMAIN>"
    authentication = "token";
    app_id="<YOUR_APP_ID>"
    app_secret="<YOUR_APP_SECRET>"

1.2 Testing

Test the JWT authentication with a valid token. You may generate the token on Jitok. The meeting link should be like the following:

https://jitsi.mydomain.tld/myroom?jwt=<PASTE_TOKEN_HERE>

2. Deno

Install deno:

apt-get install unzip

cd /tmp
wget -T 30 -O deno.zip https://github.com/denoland/deno/releases/latest/download/deno-x86_64-unknown-linux-gnu.zip
unzip -o deno.zip
cp /tmp/deno /usr/local/bin/

deno --version

3. Keycloak adapter

3.1 Cloning the repository

Clone the repository:

apt-get install git

git clone https://github.com/nordeck/jitsi-keycloak-adapter-v2.git
cd jitsi-keycloak-adapter-v2

As an alternative way, you may download the released package from Releases.

3.2 Adapter service

Setup the adapter service.

3.2.1 Adapter user

adduser adapter --system --group --disabled-password --shell /bin/bash --home /home/adapter

3.2.2 Adapter application

mkdir -p /home/adapter/app
cp src/config.ts /home/adapter/app/
cp src/adapter.ts /home/adapter/app/
cp src/context.ts /home/adapter/app/
cp templates/home/adapter/app/adapter.sh /home/adapter/app/
chown adapter: /home/adapter/app -R

3.2.3 Adapter settings

Update the adapter settings according to your environment. Edit /home/adapter/app/config.ts.

You may also use environment variables instead of updating this config file.

  • KEYCLOAK_ORIGIN

    Keycloak address

  • KEYCLOAK_ORIGIN_INTERNAL

    Internal Keycloak address if KEYCLOAK_ORIGIN is not accessible for the adapter service.

  • KEYCLOAK_REALM

    Keycloak realm

  • KEYCLOAK_CLIENT_ID

    Keycloak client ID

  • JWT_APP_ID

    The token app_id. It must be the same with Prosody app_id.

  • JWT_APP_SECRET

    The token app_secret. It must be the same with Prosody app_secret.

  • JWT_EXP_SECOND

    The token expire time

  • HOSTNAME

    The IP address for the adapter service. Don't update its default value since it is on the same server with Nginx.

3.2.4 Production notes

Disable the testing line and enable the prod line in /home/adapter/app/adapter.sh if keycloak has a trusted certificate. It should be for the production environment.

# testing: allow self-signed certificate for Keycloak
#deno run --allow-net --allow-env --unsafely-ignore-certificate-errors $BASEDIR/adapter.ts

# prod
deno run --allow-net --allow-env $BASEDIR/adapter.ts

3.2.5 Systemd unit

cp templates/etc/systemd/system/oidc-adapter.service /etc/systemd/system/

systemctl daemon-reload
systemctl enable oidc-adapter.service
systemctl start oidc-adapter.service
systemctl status oidc-adapter.service

4. Nginx

Add OIDC config:

cp templates/etc/jitsi/meet/jaas/oidc.conf /etc/jitsi/meet/jaas/

And restart the nginx service:

systemctl restart nginx

5. Jitsi-meet

Set tokenAuthUrl and tokenAuthUrlAutoRedirect in config.js:

DOMAIN=$(hocon -f /etc/jitsi/jicofo/jicofo.conf get jicofo.xmpp.client.xmpp-domain | tr -d '"')

echo "config.tokenAuthUrl = 'https://${DOMAIN}/oidc/auth?state={state}';" >> /etc/jitsi/meet/*-config.js
echo "config.tokenAuthUrlAutoRedirect = true;" >> /etc/jitsi/meet/*-config.js

6. Guest users

If you want to allow guest users to join the meeting after it's created by a moderator then apply the followings.

6.1 Wait for host

Enable persistent_lobby and muc_wait_for_host in your /etc/prosody/conf.d/<YOUR-DOMAIN>.cfg.lua.

Put persistent_lobby into VirtualHost's modules_enabled:

VirtualHost "<YOUR-DOMAIN>"
    ...
    ...
    modules_enabled = {
        ...
        ...
        "muc_lobby_rooms";
        "persistent_lobby";
        ...

Put muc_wait_for_host into Component's modules_enabled:

Component "conference.<YOUR-DOMAIN>" "muc"
    ...
    ...
    modules_enabled = {
        ...
        ...
        "token_verification";
        "muc_wait_for_host";
        ...

6.2 Allow empty token

Set allow_empty_token in your /etc/prosody/conf.d/<YOUR-DOMAIN>.cfg.lua:

VirtualHost "<YOUR-DOMAIN>"
    authentication = "token";
    app_id="<YOUR_APP_ID>"
    app_secret="<YOUR_APP_SECRET>"
    allow_empty_token=true

6.3 Guest domain

Add the guest domain for prosody. Create /etc/prosody/conf.avail/guest.cfg.lua file with the following contents:

VirtualHost "guest.domain.loc"
    authentication = "jitsi-anonymous"
    c2s_require_encryption = false

Create a symbolic link for this config file:

ln -s ../conf.avail/guest.cfg.lua /etc/prosody/conf.d/

6.4 Restart Prosody

Restart the prosody service:

systemctl restart prosody.service

6.5 Jitsi-meet

Set anonymousdomain in config.js:

echo "config.hosts.anonymousdomain = 'guest.domain.loc';" >> /etc/jitsi/meet/*-config.js