Jitsi-Keycloak Adapter

Allow Jitsi to use Keycloak as an identity and OIDC provider.

• 1. Features
• 2. Setup
  • 2.1 Token authentication
  • 2.2 Deno
  • 2.3 Adapter
  • 2.4 Nginx
• 3. Guest users
• 4. Similar projects
• 5. Sponsors

1. Features

• SSO support for Jitsi via OIDC
• Supports config params in URL (such as #config.prejoinConfig.enabled=true)
• Allows guest user and wait for host screen if needed
• Not based on the external JWT which will be deprecated in the near future.
• Not based on tokenAuthUrl

Check flows if you are interested in how it works.

2. Setup

2.1 Token authentication

Enable the token authentication for prosody.

apt-get install jitsi-meet-tokens

2.2 Deno

Install deno

apt-get install unzip

cd /tmp
wget -T 30 -O deno.zip https://github.com/denoland/deno/releases/latest/download/deno-x86_64-unknown-linux-gnu.zip
unzip deno.zip
cp /tmp/deno /usr/local/bin/

deno --version

2.3 Adapter

Clone the repo.

git clone ssh://[email protected]:22/nordeck/jitsi-keycloak-adapter.git

Copy the static files.

cd jitsi-keycloak-adapter
cp /usr/share/jitsi-meet/{body.html,body.html.$(date +'%H%M%S').bck}
cp templates/usr/share/jitsi-meet/body.html /usr/share/jitsi-meet/
cp templates/usr/share/jitsi-meet/static/oidc-* /usr/share/jitsi-meet/static/

Setup the adapter service.

adduser adapter --system --group --disabled-password --gecos ''

mkdir -p /home/adapter/app
cp config.ts /home/adapter/app/
cp adapter.sh /home/adapter/app/
cp adapter.ts /home/adapter/app/
chown adapter: /home/adapter/app -R

cp templates/etc/systemd/system/oidc-adapter.service /etc/systemd/system/

Update the settings according to your environment. Edit /home/adapter/app/config.ts

Start the service

systemctl daemon-reload
systemctl enable oidc-adapter.service
systemctl start oidc-adapter.service
systemctl status oidc-adapter.service

2.4 Nginx

Customize the nginx configuration. You may check /etc/jitsi/sites-available/example.conf

Add the following lines as the first location blocks

    # /oidc/redirect
    location = /oidc/redirect {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
    }

    # /oidc/tokenize
    location = /oidc/tokenize {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
    }

    # /oidc/auth
    location = /oidc/auth {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
    }

Change the location @root_path block as below

    # oidc: customized @root_path
    location @root_path {
        if ($arg_oidc) {
            rewrite ^/(.*)$ / break;
        }
        if ($arg_jwt) {
            rewrite ^/(.*)$ / break;
        }

        rewrite ^/(.*)$ /static/oidc-redirect.html;
    }

Restart the nginx service

systemctl restart nginx

3. Guest users

If you want to allow guest users to join the meeting after it's created by a moderator then add the guest domain for prosody

Create /etc/prosody/conf.avail/guest.cfg.lua file with the following contents.

VirtualHost "guest.domain.loc"
    authentication = "anonymous"
    c2s_require_encryption = false

Create a symbolic link for this config file.

ln -s ../conf.avail/guest.cfg.lua /etc/prosody/conf.d/

Comment token_verification in your /etc/prosody/conf.d/YOUR-DOMAIN.cfg.lua. This does not disable token validation, it disables room and sub checking which is acceptable in this use-case as there is no one defining the room in this scenario.

--"token_verification";

Restart the prosody service

systemctl restart prosody.service

Enable external XMPP authentication for jicofo

DOMAIN=$(hocon -f /etc/jitsi/jicofo/jicofo.conf get jicofo.xmpp.client.xmpp-domain)

hocon -f /etc/jitsi/jicofo/jicofo.conf set jicofo.authentication.enabled true
hocon -f /etc/jitsi/jicofo/jicofo.conf set jicofo.authentication.type XMPP
hocon -f /etc/jitsi/jicofo/jicofo.conf set jicofo.authentication.login-url $DOMAIN
hocon -f /etc/jitsi/jicofo/jicofo.conf set jicofo.authentication.authentication-lifetime "10 seconds"
hocon -f /etc/jitsi/jicofo/jicofo.conf set jicofo.conference.enable-auto-owner false

systemctl restart jicofo.service

Set anonymousdomain in config.js

echo "config.hosts.anonymousdomain = 'guest.domain.loc';" >> /etc/jitsi/meet/*-config.js

4. Similar projects

• jitsi-keycloak
• Jitsi-SAML2JWT

5. Sponsors