Home » Forums » ejabberd & XMPP » ejabberd Development

IQ request for checking whether user existing or not,

Submitted by gvvijaykumar on Tue, 2009-01-06 04:58

Hi All,

I am Vijay, i am facing a problem with ejabberd.

I am trying to send a request to find a user is existing / registered with server through DiscoInfo query.
According to RFC if user (JID) is not registered with server, we will get response with Type="error", error code="404"
"Item-not-found", when i tested with Ejabberd it is giving response type="result" with feature list irrespective of user exists. But when i tested with Openfire i am getting proper responses, for user exist or not.
Is it a bug in ejabberd? or some proper reason for this?
May i know how to request ejabberd server to find a user is registered or not?

Refer link: http://xmpp.org/extensions/xep-0030.html#schemas-info
Examples: 1,2,3,4 and 5.

BR,
Vijay Kumar G V.

‹ How we can know the chat session of Xmpp user closed? message not getting delivered to bare id ›

Probably security concerns. Maybe ad-hoc commands help?

Submitted by mfoss on Tue, 2009-01-06 18:59.
gvvijaykumar wrote:

I am trying to send a request to find a user is existing / registered with server through DiscoInfo query.
According to RFC if user (JID) is not registered with server, we will get response with Type="error", error code="404"
"Item-not-found", when i tested with Ejabberd it is giving response type="result" with feature list irrespective of user exists.

Regardless of what XEP-0030 says, it seems ejabberd does not leak information to untrusted guys about whether an account exists or not. This is a good thing, right? Think, for example, in spam prevention and privacy concerns.

gvvijaykumar wrote:

May i know how to request ejabberd server to find a user is registered or not?

Let's imagine you only want a certain account (probably a bot) to perform such query.

Several ad-hoc commands defined in XEP-0133: Service Administration are implemented in ejabberd. In ejabberd 2.0.0 or newer, enable mod_adhoc and mod_configure, then give access for mod_configure to that trusted account.

I see two useful commands:

  • Query "4.6. Get User Password". If returns some password, then account exists.
  • Query "4.9. Get User Last Login Time". If doesn't return "Never", then the account exists.
»

Yes, i completely agree with

Submitted by gvvijaykumar on Wed, 2009-01-07 06:55.

Yes, i completely agree with you, and i will try with your suggestion to test with XEP-0133: Service Administration queries.

Thank you.

BR,
Vijay Kumar G V.

»
Syndicate content

User login