Hi,
The External Authentication Scripts page here: http://www.ejabberd.im/extauth refers to a non-existent developer's guide page for more info (at ). I have checked the dev doc pages here: and they are generated docs which seem next to useless in terms of actual documentation.
I would like to check the certificate supplied by the client during authentication to see if some value in it matches the expected value. Is this something I could do using an External Authentication script? I'm thinking no because the example scripts only take in username and password values. There is actually an XEP around this: XEP-0178 (Client Certificates for SASL EXTERNAL). Is this something that ejabberd might support natively in the future?
Thanks for any help!
evilfred wrote: The External
The External Authentication Scripts page here: http://www.ejabberd.im/extauth refers to a non-existent developer's guide page for more info (at ).
Ah, ejabberd was migrated from SVN to Git, and that link got old. I've updated it, check again.
I would like to check the certificate supplied by the client during authentication to see if some value in it matches the expected value. Is this something I could do using an External Authentication script? I'm thinking no because the example scripts only take in username and password values.
As you suspected, ejabberd's extauth is not capable or intended for that thing. You will see clearly now when you check its documentation.
I have checked the dev doc pages here: and they are generated docs which seem next to useless in terms of actual documentation.
Right, those are still almost empty from user-written information.
There is actually an XEP around this: XEP-0178 (Client Certificates for SASL EXTERNAL). Is this something that ejabberd might support natively in the future?
If somebody implements it, then yes :P
I didn't find any patch, not even a feature request for that XEP. So either you implement it, or get somebody onboard to implement it, or wait patiently to see if somebody does.
Ok, thanks
Ok, thanks
a different approach
Maybe I could put it in a more general way: are there any features in ejabberd I can use to validate that the client is who they say they are?
Not implemented
are there any features in ejabberd I can use to validate that the client is who they say they are?
Nothing like that is implemented.
Openfire implemented this feature two years ago using a simple verification method, but it was demonstrated to be very vulnerable: