I am trying to hit the endpoint /register on my ejabberd server
i am getting the following error -
{ status: 'error',
code: 10,
message: 'You are not authorized to call this command.' }
The api_permissions section is as follows
api_permissions:
"console commands":
from:
- ejabberd_ctl
- mod_http_api
who: all
what: "*"
"admin access":
who:
- access:
- allow:
- ip: "127.0.0.1/8"
- acl: admin
- oauth:
- scope: "ejabberd:admin"
- access:
- allow:
- ip: "127.0.0.1/8"
- acl: admin
what:
- "*"
- "!stop"
- "!start"
"public commands":
who: all
what:
- "status"
- "connected_users_number"
I am sending username and password in the auth request part of my header. The username is registered under the acl part of my ejabberd.yml file like so
admin:
user:
- "testuser#internal_ip_address"
N:B: I am sending the post request to http://127.0.0.1:5280/api/register from a nodejs script. I am getting the 'status connected' when i hit the .../api/status endpoint.
i have tried twicking my ejabberd.yml file and i still get that error. not sure how to give my user the right permissions to access the endpoint
In this section add:
"public commands":
who: all
what:
"status"
"connected_users_number"
"register"
Related
I downloaded the XAMPP server which has Apache and MySQL in it. link: https://www.apachefriends.org/download.html
I downloaded the 20.01 version of the ejabberd installer for windows 10 OS. After that, I run the installer and installed the ejabberd in my Program files folder.
I created the ejabberd database in http://localhost/phpmyadmin/index.php and imported all the tables from mysql.sql file using C:\Program Files\ejabberd-20.01\lib\ejabberd-20.01\priv\sql folder.
Database setup completed. After that,
I configured the ejabberd.yml file.
After that, I installed the Pidgin Client for a chat then I started the ejabberd node.
According to the below ejabberd.yml configuration, The ejabberd node is running fine and I am able to chat with users in the Pidgin client.
I registered a new user in the ejabberd dashboard But I am not getting the message data and registered user data (username and password) into the PHPMyAdmin MySQL database.
My purpose for this issue is to use the ejabberd MySQL database which is already created by me in PHPMyAdmin. I want to store chat messages in the ejabberd MySQL database.
ejabberd.yml file:
hosts:
- "localhost"
loglevel: 4
log_rotate_size: 10485760
log_rotate_date: ""
log_rotate_count: 1
log_rate_limit: 100
certfiles:
- "C:/ProgramData/ejabberd/conf/server.pem"
## - "/etc/letsencrypt/live/localhost/fullchain.pem"
## - "/etc/letsencrypt/live/localhost/privkey.pem"
ca_file: "C:/ProgramData/ejabberd/conf/cacert.pem"
listen:
-
port: 5222
module: ejabberd_c2s
max_stanza_size: 262144
shaper: c2s_shaper
access: c2s
starttls_required: true
-
port: 5269
module: ejabberd_s2s_in
max_stanza_size: 524288
-
port: 5443
module: ejabberd_http
tls: true
request_handlers:
"/admin": ejabberd_web_admin
"/api": mod_http_api
"/bosh": mod_bosh
"/captcha": ejabberd_captcha
"/upload": mod_http_upload
"/ws": ejabberd_http_ws
"/oauth": ejabberd_oauth
-
port: 5280
module: ejabberd_http
request_handlers:
"/admin": ejabberd_web_admin
-
port: 1883
module: mod_mqtt
backlog: 1000
s2s_use_starttls: optional
acl:
local:
user_regexp: ""
loopback:
ip:
- 127.0.0.0/8
admin:
user:
- "admin#localhost"
sql_type: mysql
sql_server: "localhost"
sql_database: "ejabberd"
sql_username: "root"
sql_password: ""
access_rules:
local:
allow: local
c2s:
deny: blocked
allow: all
announce:
allow: admin
configure:
allow: admin
muc_create:
allow: local
pubsub_createnode:
allow: local
trusted_network:
allow: loopback
api_permissions:
"console commands":
from:
- ejabberd_ctl
who: all
what: "*"
"admin access":
who:
access:
allow:
acl: loopback
acl: admin
oauth:
scope: "ejabberd:admin"
access:
allow:
acl: loopback
acl: admin
what:
- "*"
- "!stop"
- "!start"
"public commands":
who:
ip: 127.0.0.1/8
what:
- status
- connected_users_number
shaper:
normal: 1000
fast: 50000
shaper_rules:
max_user_sessions: 10
max_user_offline_messages:
5000: admin
100: all
c2s_shaper:
none: admin
normal: all
s2s_shaper: fast
max_fsm_queue: 10000
acme:
contact: "mailto:admin#localhost"
ca_url: "https://acme-v01.api.letsencrypt.org"
modules:
mod_adhoc: {}
mod_admin_extra: {}
mod_announce:
access: announce
mod_avatar: {}
mod_blocking: {}
mod_bosh: {}
mod_caps: {}
mod_carboncopy: {}
mod_client_state: {}
mod_configure: {}
mod_disco: {}
mod_fail2ban: {}
mod_http_api: {}
mod_http_upload:
put_url: https://#HOST#:5443/upload
mod_last: {}
mod_mam:
## Mnesia is limited to 2GB, better to use an SQL backend
## For small servers SQLite is a good fit and is very easy
## to configure. Uncomment this when you have SQL configured:
## db_type: sql
assume_mam_usage: true
default: never
mod_mqtt: {}
mod_muc:
access:
- allow
access_admin:
- allow: admin
access_create: muc_create
access_persistent: muc_create
access_mam:
- allow
default_room_options:
allow_subscription: true # enable MucSub
mam: false
mod_muc_admin: {}
mod_offline:
access_max_user_messages: max_user_offline_messages
mod_ping: {}
mod_privacy: {}
mod_private: {}
mod_proxy65:
access: local
max_connections: 5
mod_pubsub:
access_createnode: pubsub_createnode
plugins:
- flat
- pep
force_node_config:
## Avoid buggy clients to make their bookmarks public
storage:bookmarks:
access_model: whitelist
mod_push: {}
mod_push_keepalive: {}
mod_register:
## Only accept registration requests from the "trusted"
## network (see access_rules section above).
## Think twice before enabling registration from any
## address. See the Jabber SPAM Manifesto for details:
## https://github.com/ge0rg/jabber-spam-fighting-manifesto
ip_access: trusted_network
mod_roster:
versioning: true
mod_s2s_dialback: {}
mod_shared_roster: {}
mod_stream_mgmt:
resend_on_timeout: if_offline
mod_vcard: {}
mod_vcard_xupdate: {}
mod_version:
show_os: false
### Local Variables:
### mode: yaml
### End:
### vim: set filetype=yaml tabstop=8
I registered a new user in the ejabberd dashboard But I am not getting the message data and registered user data (username and password) into the PHPMyAdmin MySQL database.
If you login in ejabberd WebAdmin with an admin account, and go to -> Nodes -> your node -> Database, you will see that the internal Mnesia table "passwd" has 1 Element. That means one account is registered in ejabberd, and stored in the Mnesia database. That's the internal database used by default.
ejabberd.yml file:
sql_type: mysql
sql_server: "localhost"
sql_database: "ejabberd"
sql_username: "root"
sql_password: ""
Ok, those options tell ejabberd what SQL database you want to use, and how to connect to it.
I want to store chat messages in the ejabberd MySQL database.
Then, tell ejabberd to use sql for the tasks that you want. For example, add also those options to your config:
auth_method: sql
default_db: sql
See:
https://docs.ejabberd.im/admin/configuration/toplevel/#auth-method
https://docs.ejabberd.im/admin/configuration/toplevel/#default-db
I'm trying to follow API Permissions | ejabberd Docs and Configuring ejabberd | ejabberd Docs.
yet while trying to register a user:
# curl -sk -d '{"user":"test", "password":"testing", "host":"localhost"}' -H 'Content-Type: application/json' https://localhost:5443/api/register
I get following in ejabberd.log:
# tail -2 ./home/ejabberd/logs/ejabberd.log
2019-10-04 21:41:47.079 [info] <0.663.0>#mod_http_api:log:509 API call register [{<<"user">>,<<"test">>},{<<"password">>,<<"testing">>},{<<"host">>,<<"localhost">>}] from ::ffff:172.19.0.1:53740
2019-10-04 21:41:47.079 [info] <0.521.0>#ejabberd_listener:accept:256 (<0.663.0>) Accepted connection [::ffff:172.19.0.1]:53740 -> [::ffff:172.19.0.6]:5443
#
ejabberd.yml' acl&api_permissions blocks:
acl:
local:
user_regexp: ""
loopback:
ip:
- 127.0.0.0/8
- ::1/128
- ::FFFF:127.0.0.1/128
admin:
user:
- "admin#localhost"
ip:
- ::/0
- ::FFFF:10.0.0.0/8
- ::FFFF:172.16.0.0/12
- ::FFFF:172.19.0.0/12
- ::FFFF:192.168.0.0/16
&
api_permissions:
"console commands":
from:
- ejabberd_ctl
who: all
what: "*"
"admin access":
who:
access:
allow:
acl: loopback
acl: admin
ip:
- ::/0
- ::FFFF:10.0.0.0/8
- ::FFFF:172.16.0.0/12
- ::FFFF:172.19.0.0/12
- ::FFFF:192.168.0.0/16
oauth:
scope: "ejabberd:admin"
access:
allow:
acl: loopback
acl: admin
what:
- "*"
- "!stop"
- "!start"
"public commands":
who:
ip: 127.0.0.1/8
what:
- status
- connected_users_number
Please advise.
I added my ip/range to admin AND loopback block:
acl:
local:
user_regexp: ""
loopback:
ip:
- 127.0.0.0/8
- ::1/128
- ::FFFF:127.0.0.1/128
- ::FFFF:172.19.0.0/16
admin:
user:
- "admin#localhost"
ip:
- ::FFFF:172.19.0.0/16
and the error went away)
With this minimal configuration:
listen:
-
port: 5443
ip: "::"
module: ejabberd_http
tls: true
request_handlers:
"/api": mod_http_api
acl:
admin:
ip:
- "127.0.0.1"
api_permissions:
"admin commands":
who: admin
what:
- register
If I execute this in machine 127.0.0.1, it works:
$ curl -sk -d '{"user":"test", "password":"testing", "host":"localhost"}' -H 'Content-Type: application/json' https://localhost:5443/api/register
"User test#localhost successfully registered"
I have my rails app. And whenever user registers, I want to register user on ejabberd node as well. But, whenever i call register API using curl request, it gives be following error:
{"status":"error","code":32,"message":"AccessRules: Account does not have the right to perform the operation."}
My curl request is:
curl -X POST --data '{"user": "bob", "host": "localhost", "password": "password"}' http://localhost:5443/api/register
My ejabberd.yml file is as below:
hosts:
- "localhost"
loglevel: 5
log_rotate_size: 10485760
log_rotate_date: ""
log_rotate_count: 1
log_rate_limit: 100
certfiles:
- "/etc/letsencrypt/live/localhost/fullchain.pem"
- "/etc/letsencrypt/live/localhost/privkey.pem"
listen:
-
port: 5222
ip: "::"
module: ejabberd_c2s
max_stanza_size: 262144
shaper: c2s_shaper
access: c2s
starttls_required: false
-
port: 5269
ip: "::"
module: ejabberd_s2s_in
max_stanza_size: 524288
-
port: 5443
ip: "0.0.0.0"
module: ejabberd_http
request_handlers:
"/api": mod_http_api
"/bosh": mod_bosh
"/upload": mod_http_upload
"/ws": ejabberd_http_ws
"/oauth": ejabberd_oauth
web_admin: true
captcha: true
tls: false
commands_admin_access: configure
commands:
- add_commands: [user, admin, open]
oauth_expire: 3600
oauth_access: all
s2s_use_starttls: optional
acl:
admin:
user:
- "admin#localhost"
local:
user_regexp: ""
loopback:
ip:
- "127.0.0.0/8"
- "::1/128"
- "::FFFF:127.0.0.1/128"
access_rules:
local:
- allow: local
c2s:
- deny: blocked
- allow
announce:
- allow: admin
configure:
- allow: admin
muc_create:
- allow: local
pubsub_createnode:
- allow: local
register:
- allow
trusted_network:
- allow: loopback
oauth:
- scope: "ejabberd:admin"
- allow: admin
api_permissions:
"console commands":
from:
- ejabberd_ctl
who: all
what: "*"
"admin access":
who:
- access:
- allow:
- acl: admin#localhost
- oauth:
- scope: "ejabberd:admin"
- access:
- allow:
- acl: admin#localhost
what:
- "*"
- "!stop"
- "!start"
"public commands":
who:
- ip: "0.0.0.0"
what:
- "register"
- "status"
- "connected_users_number"
shaper:
normal: 1000
fast: 50000
shaper_rules:
max_user_sessions: 10
max_user_offline_messages:
- 5000: admin
- 100
c2s_shaper:
- none: admin
- normal
s2s_shaper: fast
modules:
mod_adhoc: {}
mod_admin_extra: {}
mod_announce:
access: announce
mod_avatar: {}
mod_blocking: {}
mod_bosh: {}
mod_caps: {}
mod_carboncopy: {}
mod_client_state: {}
mod_configure: {}
mod_disco: {}
mod_fail2ban: {}
mod_http_api: {}
mod_http_upload:
put_url: "https://#HOST#:5443/upload"
mod_last: {}
mod_mam:
## Mnesia is limited to 2GB, better to use an SQL backend
## For small servers SQLite is a good fit and is very easy
## to configure. Uncomment this when you have SQL configured:
## db_type: sql
assume_mam_usage: true
default: always
mod_muc:
access:
- allow
access_admin:
- allow: admin
access_create: muc_create
access_persistent: muc_create
default_room_options:
mam: true
mod_muc_admin: {}
mod_offline:
access_max_user_messages: max_user_offline_messages
mod_ping: {}
mod_privacy: {}
mod_private: {}
mod_proxy65:
ip: "localhost"
access: local
max_connections: 5
mod_pubsub:
access_createnode: pubsub_createnode
plugins:
- "flat"
- "pep"
force_node_config:
## Change from "whitelist" to "open" to enable OMEMO support
## See https://github.com/processone/ejabberd/issues/2425
"eu.siacs.conversations.axolotl.*":
access_model: whitelist
## Avoid buggy clients to make their bookmarks public
"storage:bookmarks":
access_model: whitelist
mod_push: {}
mod_push_keepalive: {}
mod_register:
## Only accept registration requests from the "trusted"
## network (see access_rules section above).
## Think twice before enabling registration from any
## address. See the Jabber SPAM Manifesto for details:
## https://github.com/ge0rg/jabber-spam-fighting-manifesto
ip_access: trusted_network
mod_roster:
versioning: true
mod_s2s_dialback: {}
mod_shared_roster: {}
mod_stream_mgmt:
resend_on_timeout: if_offline
mod_vcard: {}
mod_vcard_xupdate: {}
mod_version:
show_os: false
Can someone point me where exactly I might be wrong?
Thanks in advance.
If you want to use mod_http_api from localhost to register accounts, you can grant it permission in this way:
api_permissions:
"http_api commands":
who:
- ip: "127.0.0.1"
from:
- mod_http_api
what:
- "register"
See https://docs.ejabberd.im/developer/ejabberd-api/permissions/
Are you logged in before requesting this? or r u using any kind of authentication mechanism?
If you r requesting without this try adding the ip from which you are requesting insode
"public commands":
who:
- ip: "0.0.0.0"
what:
- "register"
- "status"
- "connected_users_number"
part.
Else try adding allow all under register in api_permission section
I am working on ejabberd API to invite users to MUC room. I have setup OAuth for API.
I have tested oauth with get_room_occupants and its working fine.
Now, I am trying to access /api/send_direct_invitation, but as per logs, I don't have permission to access this api
I have generated oauth with command line
ejabberdctl oauth_issue_token admin#host 31540000 "ejabberd:admin"
Do I need to pass any extra permissions
Ejabberd Version: 17.11
Installed on: ubuntu 16.04
Configuered DB: mysql
Here is a ejabberd.yml file
api_permissions:
"console commands":
from:
- ejabberd_ctl
who: all
what: "*"
"admin access":
who:
- access:
- allow:
- user: admin#host
- oauth:
- scope: "ejabberd:admin"
- access:
- allow:
- user: admin#host
what:
- "*"
- "!stop"
- "!start"
"public commands":
who:
- ip: "127.0.0.1/8"
what:
- "status"
- "connected_users_number"
commands_admin_access:
- allow:
- user: "admin#host"
commands:
add_commands:
- status
- registered_users
- register
- unregister
- get_roster
- connected_users
- send_stanza_c2s
- send_stanza
- join_cluster
- send_direct_invitation
oauth_expire: 3600
oauth_access: all
I tried running this via command line and got this error
command: ejabberdctl send_direct_invitation naviteam1519 conference.xxx.yyy.com "" "You need this room!" KESH2FABDE#xxx.yyy.com
error:
Problem 'error {bad_jid,<<"KESH2FABDE#xxx.yyy.com">>}' occurred executing the command.
Stacktrace: [{jid,decode,1,[{file,"src/jid.erl"},{line,138}]},
{mod_muc_admin,'-get_users_to_invite/2-fun-1-',2,
[{file,"src/mod_muc_admin.erl"},{line,840}]},
{lists,filtermap,2,[{file,"lists.erl"},{line,1317}]},
{mod_muc_admin,send_direct_invitation,5,
[{file,"src/mod_muc_admin.erl"},{line,826}]},
{ejabberd_ctl,call_command,4,
[{file,"src/ejabberd_ctl.erl"},{line,352}]},
{ejabberd_ctl,try_call_command,4,
[{file,"src/ejabberd_ctl.erl"},{line,321}]},
{ejabberd_ctl,process2,4,
[{file,"src/ejabberd_ctl.erl"},{line,271}]},
{ejabberd_ctl,process,2,
[{file,"src/ejabberd_ctl.erl"},{line,249}]}]
You did not show us your ejabberdctl send_direct_invitation command and the logs.
My bet is that you don't have correctly formatted command:
from the send_direct_invitation api it should look like this:
POST /api/send_direct_invitation
{
"name": "room1",
"service": "muc.example.com",
"password": "",
"reason": "Check this out!",
"users": "user2#localhost:user3#example.com"
}
Then an example would look like this:
ejabberdctl send_direct_invitation aRoom conference.localhost "" "You need this room!" msg_test1#localhost
As for your ejabbered.yml file. Are you sure you have:
admin#host user? Shouldn't that be for you a admin#localhost?
Edit
Based on the comment: The OP is missing mod-client-state configuration
mod-client-state configuration:
Example configuration:
modules:
...
mod_client_state:
queue_chat_states: true
queue_pep: false
queue_presence: true
...
I want my users to be able to block each other. So I did some research and figured out that it can be done with privacy_set.
So I added mod_privacy and mod_blocking in config file.
The problem is when I run the following command nothing is getting inserted in mysql.
I copied xml from here.
ejabberdctl privacy_set userA localhost "<iq from='userA#localhost/l' type='set' id='block1'> <block xmlns='urn:xmpp:blocking'> <item jid='userB#montague.net'/> </block> </iq>"
I also tied this one, still no luck:
Copied from here
ejabberdctl privacy_set userA localhost "<iq from='userA#localhost/l' type='set' id='iq1'> <query xmlns='jabber:iq:privacy'> <list name='iq-jid-example'> <item type='jid' value='userB#localhost' action='deny' order='29'> <iq/> </item> </list> </query> </iq>"
This is the content of my ejabberd yml file:
loglevel: 5
log_rotate_size: 10485760
log_rotate_date: ""
log_rotate_count: 1
log_rate_limit: 100
watchdog_admins:
- "admin#localhost"
acl:
admin:
user:
- "admin": "localhost"
access:
configure:
admin: allow
webadmin_view:
viewers: allow
hosts:
- "localhost"
listen:
-
port: 5222
module: ejabberd_c2s
max_stanza_size: 65536
shaper: c2s_shaper
access: c2s
-
port: 5281
module: ejabberd_http
request_handlers:
## "/oauth": ejabberd_oauth
"/api": mod_http_api
web_admin: true
http_bind: true
http_poll: true
captcha: false
commands_admin_access:
- allow:
- user: "admin#localhost"
commands:
- add_commands: [send_stanza, destroy_room, connected_users_info, get_room_options, user, admin, open, status, stats, connecteo_users, get_vcard, change_password, check_account, register, create_room, create_room_with_opts, send_direct_invitation]
oauth_access: all
modules:
mod_vcard: {}
mod_ping: {}
mod_admin_extra: {}
mod_mam: {}
mod_roster: {}
mod_shared_roster: {}
mod_stats: {}
mod_offline: {}
mod_privacy:
db_type: sql
mod_blocking: {}
api_permissions:
"console commands":
from:
- ejabberd_ctl
who: all
what: "*"
"admin access":
who:
- admin
- oauth:
- scope: "ejabberd:admin"
- admin
what:
- "*"
- "!stop"
- "!start"
shaper_rules:
max_user_sessions: 10
max_user_offline_messages:
- 5000: admin
- 100
c2s_shaper:
- none: admin
- normal
s2s_shaper: fast
access_rules:
local:
- allow: local
c2s:
- deny: blocked
- allow
announce:
- allow: admin
configure:
- allow: all
register:
- allow
trusted_network:
- allow: loopback
auth_password_format: scram
auth_method: sql
default_db: sql
sql_type: mysql
sql_server: "localhost"
sql_database: "ejabberd"
sql_username: "ejabberd"
sql_password: "123456"
## If you want to specify the port:
sql_port: 3306
Any help would be appreciated.
I found the answer with the help from a console based XMPP client called Profanity
This is how it can be done:
ejabberdctl send_stanza_c2s userA localhost l '<iq id="1212" type="set"><block xmlns="urn:xmpp:blocking"><item jid="userB#localhost"/></block></iq>'