From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-il1-x132.google.com (mail-il1-x132.google.com [IPv6:2607:f8b0:4864:20::132]) by mail.toke.dk (Postfix) with ESMTPS id 30E0B8C7729 for ; Fri, 1 Oct 2021 16:05:41 +0200 (CEST) Authentication-Results: mail.toke.dk; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NnECNGrr Received: by mail-il1-x132.google.com with SMTP id t15so8209410ilj.1 for ; Fri, 01 Oct 2021 07:05:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=lVf1pHrGASizO5l29rHiX8GFG7hNNt2k+3rVWGMHMjQ=; b=NnECNGrrfzo3sx7gDP7jilvkJRPx5HHnR+mMwuROFzuegqFd/QZu9AOwC1PwYXt90m kpg3+o3e9fDP8jsmERz7gyHZOMp9k52gP9FWiUhez6sPihvc6RXGbCGhrPEPY9uC6CwB J4+NURLN4I/5skGVn2dBlnVYRE1wdJjpP+7cLsiCVfKByaGmZ9E2Mpo+cPNk5QfplZZF MVuwFez2FHXwSbFjmYLboDoziuz2U8y5Objj/G/v3jLnXlKeFiNnIzeMChB6bTwaYEn4 qBxLXmQqXpqmOFItDfF5uZW1FpDA0IuHXlwXO394q7aRTJe2s5arECJJEsWvj/GPaSyC 1ZMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=lVf1pHrGASizO5l29rHiX8GFG7hNNt2k+3rVWGMHMjQ=; b=EveJTbvdww5j8TX71N0niazfHmc7w110Dz1Tynaa1iCgC7MFKzHwlmDhoYCluPLDsE RnVnirOBRYo7TvUaMIwxhgiaQP/wRwmforsp+Xi6lXhLJ6KTiVlwjouqKa0R+qOdFfTR PmdZNRV4sjILgXTnxlTQ6XM8abKOQZteqDhZziQi0lajc5Ik198SgEgc8xJGMuk2hGyr xR/e8K94CXcSN+nosE1bsDXSSUyWxz9sFV1SjLKqO+teFxNMdL2QFUPtUbat9qlI3Kx7 y8Oc4/bf4TiAcOR8tauQlyEwcKH/Z4BwjR9bwXWnitDxbyvZFQAcBJGyAMqQXBitOC9p xvEA== X-Gm-Message-State: AOAM533yTKIKSrDYEQHmIvB9tpsiBMinhlLTCKzl+KRCMBI37SQc4ZGj wEkYHyYirErmppQxQijIPlCgoHSPG6ctLYXYO/Q= X-Google-Smtp-Source: ABdhPJyH4L/EL6SdX2FIUM3LY43uukfBqAGXULTZvxQvp/fiUWeArYSBH0z3JDbWNsRlFwoTAVeU3qwfjRH28VgFtHc= X-Received: by 2002:a05:6e02:168f:: with SMTP id f15mr8826810ila.283.1633097139934; Fri, 01 Oct 2021 07:05:39 -0700 (PDT) MIME-Version: 1.0 References: <9SCVvWIB9TfyEmG6di6LYCmoEeeJ_2Fsqzh8Y58_q0wSF1hRxJ_2I3YKATYXSCnaZQMJ6CdhvseVnbHsDmnSheS5b9SvRk1f9xhna0e2Y5Q=@protonmail.com> <87pmsp3qnx.wl-jch@irif.fr> In-Reply-To: <87pmsp3qnx.wl-jch@irif.fr> From: Dave Taht Date: Fri, 1 Oct 2021 07:05:27 -0700 Message-ID: To: Juliusz Chroboczek Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 6XCWOSN2LGFU5P7ZU3NU4P6WTN642PEP X-Message-ID-Hash: 6XCWOSN2LGFU5P7ZU3NU4P6WTN642PEP X-MailFrom: dave.taht@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Jeroen van Veen , "galene@lists.galene.org" X-Mailman-Version: 3.3.4 Precedence: list Subject: [Galene] Re: User management List-Id: =?utf-8?q?Gal=C3=A8ne_videoconferencing_server_discussion_list?= Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Fri, Oct 1, 2021 at 4:55 AM Juliusz Chroboczek wrote: > > > Any thoughts on a separate users.json that contains entries like: > > > > [ > > {"name":"jeroen","password":"foobar","groups":{"pyrite": > > {"op":true,"presenter":true,"other":true}}}, > > {"name":"pyrite","password":"foobar","groups":{}} > > ] > > > > The idea is to be able to set permissions per group, while having only > > one user entry at a central place. > > I'm open to that. > > > After modifying users.json, there will be another action from the > > backend that updates all accompanying group files. As I understand it, > > there is only 1 administrator user defined in data/passwd? Would it be > > feasible to have multiple users in there, so each user can have an > > administrator flag? > > I think we should make the data/passwd file obsolete, and define the > administrator role per-user in the users.json file. > > > And what would be a good approach to delete or rename a group? Doing > > a request to the new group name works fine to make it available in the > > list, but I wonder what will happen to the group that is being > > renamed/deleted. > > The group will exist as long as there are users, but no new users should > be able to login. At least, that's the way the code was written, but > I don't recall if I've tested it. > > > Should I use protocol.js in the backend as well to connect to a group > > and kick all users out, before attempting to rename/delete it? > > I don't feel it's necesary, but it's up to you. > > > If so, would it be useful to have a 'hidden' user available that can ac= t > > on behalf of the backend? > > No, please no hidden users -- normal users should have full visibility > into what's being done to them. If you need a system user, please make i= t > visible. Yes, no sneaky users please. It's really hard to trust other "modern" videoconferencing servers. In fact I was thinking perhaps that having a "jch-blessed" binary might be of use, but I have not the foggiest idea how to go about having a means to prove, e2e, that you are really talking to a trusted videoconferencing server. I did rather like the insertable streams idea: https://webrtchacks.com/true-end-to-end-encryption-with-webrtc-insertable-s= treams/ > -- Juliusz > _______________________________________________ > Galene mailing list -- galene@lists.galene.org > To unsubscribe send an email to galene-leave@lists.galene.org --=20 Fixing Starlink's Latencies: https://www.youtube.com/watch?v=3Dc9gLo6Xrwgw Dave T=C3=A4ht CEO, TekLibre, LLC