From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; spf=pass (mailfrom) smtp.mailfrom=irif.fr (client-ip=2001:660:3301:8000::1:2; helo=korolev.univ-paris7.fr; envelope-from=jch@irif.fr; receiver=) Authentication-Results: mail.toke.dk; dkim=pass (2048-bit key; unprotected) header.d=irif.fr header.i=@irif.fr header.a=rsa-sha256 header.s=dkim-irif header.b=XHAxK8fD Received: from korolev.univ-paris7.fr (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]) by mail.toke.dk (Postfix) with ESMTPS id DC6BD9FB340 for ; Tue, 4 Apr 2023 01:36:15 +0200 (CEST) Received: from potemkin.univ-paris7.fr (potemkin.univ-paris7.fr [IPv6:2001:660:3301:8000::1:1]) by korolev.univ-paris7.fr (8.14.4/8.14.4/relay1/82085) with ESMTP id 333NaAX6002956 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 4 Apr 2023 01:36:10 +0200 Received: from mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [81.194.30.253]) by potemkin.univ-paris7.fr (8.14.4/8.14.4/relay2/82085) with ESMTP id 333NaA7x016826 for ; Tue, 4 Apr 2023 01:36:10 +0200 Received: from mailhub.math.univ-paris-diderot.fr (localhost [127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTP id 5D3E232826 for ; Tue, 4 Apr 2023 01:36:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=irif.fr; h= content-type:content-type:mime-version:user-agent:subject :subject:from:from:message-id:date:date:received:received; s= dkim-irif; t=1680564968; x=1681428969; bh=oNTNBMQL7YWA9D18ceww9S 0ZOZi21PVFXTUcJ7jhdv4=; b=XHAxK8fDV4lhx+uqMG6URv104z5tlgODto+6l6 GTmEofKUJaeZHx8pvjwn7E32nbNheEVVl9juBXFcv0/owvY6YRZSMA197vdLz4uW uv+s8S5XgLwAIyHze5Rp/itGiWw68X92f7O01BUuh38vvGDsQqDlAq3o8cojaBH5 q/glakn/UWZCM6hJez7qWlpQ+vy08GhHDl89lYmOUWpdVrS1qbqNdR/leLpflIIs HdlwiuE7lR5XJsf3Q01sE8W5/NC+fFitru/iVfh8Bn2j92sPP5uz1FcKDdXEZdrC p7R9LVoJaYVJmZVrrmGujGYP21kgMJeS6xxULsBG3U7xbkWA== X-Virus-Scanned: amavisd-new at math.univ-paris-diderot.fr Received: from mailhub.math.univ-paris-diderot.fr ([127.0.0.1]) by mailhub.math.univ-paris-diderot.fr (mailhub.math.univ-paris-diderot.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id g15mKByd6_Xh for ; Tue, 4 Apr 2023 01:36:08 +0200 (CEST) Received: from pirx.irif.fr (unknown [78.194.40.74]) (Authenticated sender: jch) by mailhub.math.univ-paris-diderot.fr (Postfix) with ESMTPSA id B49F632741 for ; Tue, 4 Apr 2023 01:36:08 +0200 (CEST) Date: Tue, 04 Apr 2023 01:36:08 +0200 Message-ID: <87y1n8edxz.wl-jch@irif.fr> From: Juliusz Chroboczek To: galene@lists.galene.org User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/28.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (korolev.univ-paris7.fr [IPv6:2001:660:3301:8000::1:2]); Tue, 04 Apr 2023 01:36:12 +0200 (CEST) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (potemkin.univ-paris7.fr [194.254.61.141]); Tue, 04 Apr 2023 01:36:10 +0200 (CEST) X-Miltered: at korolev with ID 642B62EA.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-Miltered: at potemkin with ID 642B62EA.000 by Joe's j-chkmail (http : // j-chkmail dot ensmp dot fr)! X-j-chkmail-Enveloppe: 642B62EA.000 from potemkin.univ-paris7.fr/potemkin.univ-paris7.fr/null/potemkin.univ-paris7.fr/ X-j-chkmail-Enveloppe: 642B62EA.000 from mailhub.math.univ-paris-diderot.fr/mailhub.math.univ-paris-diderot.fr/null/mailhub.math.univ-paris-diderot.fr/ X-j-chkmail-Score: MSGID : 642B62EA.000 on korolev.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Score: MSGID : 642B62EA.000 on potemkin.univ-paris7.fr : j-chkmail score : . : R=. U=. O=. B=0.000 -> S=0.000 X-j-chkmail-Status: Ham X-j-chkmail-Status: Ham Message-ID-Hash: KKSXAA6ED6PRCJFUFHSUIVAPDMK43LKT X-Message-ID-Hash: KKSXAA6ED6PRCJFUFHSUIVAPDMK43LKT X-MailFrom: jch@irif.fr X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list Subject: [Galene] Token-based invitation merged into master List-Id: =?utf-8?q?Gal=C3=A8ne_videoconferencing_server_discussion_list?= Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi, I've just merged the stateful token code into Galene. You may test it at . # Basic usage In order to generate a token, you must either be group operator or have specified "allow-tokens": true in the group description. In order to invite a single person, you type /invite username This will generate a link that you may send to said user and that will allow logging-in without the need to specify either a username or password. By default, tokens are valid for one week, but you may specify a different duration: /invite username 15d In order to make a wildcard invitation (one that you may send to multiple users), simply type: /invite This will generate a link that will lead to a simplified login dialog, where the password field has been removed. Again, you may specify a different duration: /invite '' 15d There's a menu entry on the context menu of your own username that allows generating a wildcard token valid a day. This should be expanded to pop up a friendly dialog, but I'm not likely to do that myself. # Token management Unlike the stateless tokens previously implemented, the tokens used by the /invite command are stateful: we keep track of all the tokens that we have generated in a file on the server. If you have the "op" privilege, you may view the list of all (stateful) tokens generated for the group: /listtokens You may revoke a token: /revoke https://galene.org:8443/group/public/?token=xxx and you may extend its lifetime (even if it's been revoked): /reinvite https://galene.org:8443/group/public/?token=xxx 2d # Token storage Tokens are stored in the file `data/var/tokens.jsonl`. They are deleted one week after their expiration date. The expiration date is stored in absolute time, so your server better have accurate time if you want accurate expiration of tokens. It should be safe to modify the file while Galene is running (the server will notice your modifications straight away), although of course you might suffer from the lost update problem if two entities modify the file at the same time. There are some features that I've implemented that can currently only be accessed by editing the token file directly, such as tokens with unusual permissions (permission to record, permission to create new tokens) or tokens that are only valid *after* a certain date. I'll extend the protocol support if there's demand. Enjoy, -- Juliusz