{"id":20218053,"url":"https://github.com/matrix-org/prosody-mod-auth-matrix-user-verification","last_synced_at":"2025-08-22T01:17:11.685Z","repository":{"id":43697704,"uuid":"291701271","full_name":"matrix-org/prosody-mod-auth-matrix-user-verification","owner":"matrix-org","description":"Matrix user verification auth for Prosody","archived":false,"fork":false,"pushed_at":"2023-11-22T08:34:27.000Z","size":204,"stargazers_count":25,"open_issues_count":7,"forks_count":12,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-24T13:36:22.698Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/matrix-org.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-08-31T11:51:15.000Z","updated_at":"2025-02-18T17:59:03.000Z","dependencies_parsed_at":"2023-01-18T05:00:54.864Z","dependency_job_id":null,"html_url":"https://github.com/matrix-org/prosody-mod-auth-matrix-user-verification","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matrix-org%2Fprosody-mod-auth-matrix-user-verification","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matrix-org%2Fprosody-mod-auth-matrix-user-verification/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matrix-org%2Fprosody-mod-auth-matrix-user-verification/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matrix-org%2Fprosody-mod-auth-matrix-user-verification/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/matrix-org","download_url":"https://codeload.github.com/matrix-org/prosody-mod-auth-matrix-user-verification/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248243511,"owners_count":21071055,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-14T06:36:59.772Z","updated_at":"2025-04-10T15:45:52.192Z","avatar_url":"https://github.com/matrix-org.png","language":"Lua","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Prosody Auth Matrix User Verification\n\nMatrix user verification auth for Prosody for Jitsi Meet widget usage.\n\n## Description\n\nContains two Prosody modules:\n\n### `mod_auth_matrix_user_verification`\n\nProsody auth for glue between Jitsi widgets utilizing the Jitsi Meet external API \nand [Matrix user verification service](https://github.com/matrix-org/matrix-user-verification-service)\nto handle verifying a given Matrix user exists and that they are in a room that\nmatches the Jitsi room ID.\n\n### `mod_matrix_power_sync`\n\nOptional. Ensures that only users who have power level equal to `state_default` or more\nin the room are made owners. Jitsi will not give room ownership to the first joiner\nif they don't have the right power level and auto-owner cycling on owners leaving\nthe conference room is disabled.\n\nRequires `mod_auth_matrix_user_verification` to also be enabled to work.\n\n## Flow diagrams\n\nThese diagrams explain how the different components fit together around these Prosody modules.\n\n### Jitsi widget creation\n\n![](widget_creation.png)\n            \n### Widget load\n\n![](widget_load.png)\n              \n## Usage\n\n### Widget initialization\n\nWhen loading the Jitsi widget, the Jitsi Meet external API should be \ninitialized with the following options:\n\n* `roomName`: base32 encoded Matrix room ID to check the user is in (without padding)\n* `jwt`: a JWT token, example;\n\n```json\n{\n  \"context\": {\n    \"user\": {\n      \"avatar\": \"https:/gravatar.com/avatar/abc123\",\n      \"name\": \"John Doe\"\n    },\n    \"matrix\": {\n      \"token\": \"DX81zuBbR1Qt7WGnyiIQYdqbDSm2ECnx\",\n      \"room_id\": \"!qwertyasdfgh:matrix.org\",\n      // OPTIONAL\n      \"server_name\": \"matrix.org\"\n    }\n  },\n  \"aud\": \"jitsi\",\n  \"iss\": \"issuer\",\n  \"sub\": \"jitsi.example.com\",\n  \"room\": \"*\"\n}\n```\n\nFor generating the token, note the following:\n\n* `content.user` will be used for the Jitsi Meet session.\n* `matrix.token` is an OpenID token from the Matrix C2S API, see [here](https://matrix.org/docs/spec/client_server/r0.6.1#id154).\n* `matrix.room_id` should be the Matrix room ID we want to check the user is in. When base32 encoded (without padding) it must match the Jitsi room ID.\n* `matrix.server_name` (optional) is the server name the `matrix.token` relates to. If not given, we assume UVS will be configured for a single server.\n* `aud` can be for example \"jitsi\", should match Prosody token auth issuers/audience if needed.\n* `iss` issuer of the token, must match `app_id` below in Prosody config.\n* `sub` should be the Jitsi Meet domain.\n* `room` is not used at the moment, a `*` works here.\n\nNOTE! The JWT can be signed with any kind of secret string. The backend Prosody module\ndoes not verify the signature, we're only interested in passing data through Jitsi to the\nProsody module piggybacking on the token auth mechanism.\n\n### Jitsi auth well-known\n\nOn the Jitsi Meet domain, you'll need to host a `/.well-known/element/jitsi` \nJSON file containing the following:\n\n```json\n{\"auth\": \"openidtoken-jwt\"}\n```\n\n### Matrix User Verification service\n\nAn instance of [Matrix user verification service](https://github.com/matrix-org/matrix-user-verification-service)\nneeds to be running and configured to point to the same Synapse server that issues\nthe OpenID tokens.\n\n### Prosody configuration and plugins\n\nCopy the `mod_auth_matrix_user_verification.lua` and (if needed) `mod_matrix_power_sync.lua`\nfiles to your Prosody plugins folder.\n\nAdd the auth to your Jitsi Meet Prosody virtualhost section:\n\n```lua\nVirtualHost \"example.com\"\n    authentication = \"matrix_user_verification\"\n\n    -- Must be set for the auth token to be passed through\n    -- Must match what is being set as `iss` in the JWT\n    app_id = \"issuer\"\n\n    -- Base URL to the matrix user verification service (without ending slash)\n    uvs_base_url = \"https://uvs.example.com\"\n    -- (optional) UVS auth token, if authentication enabled\n    -- Uncomment and set the right token if necessary\n    --uvs_auth_token = \"changeme\"\n    -- (optional) Make Matrix room moderators owners of the Prosody room.\n    -- Enabling this will mean once a participant, authed using this module,\n    -- joins a call, their power in the relevant Matrix room will be checked\n    -- via UVS and if they have more or equal the configured power here,\n    -- they will be made an owner of the Prosody room.\n    -- This is disabled by default, uncomment to enable below and ensure\n    -- you also add the muc module as below.\n    --uvs_sync_power_levels = true\n```\n\nIf you want to sync power levels (ie have `uvs_sync_power_levels` above enabled), \nyou'll also need to add the power level module to your MUC config, for example as follows:\n\n```lua\nComponent \"conference.example.com\" \"muc\"\n    modules_enabled = {\n        \"matrix_power_sync\";\n    }\n```\n\n## License\n\nApache 2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatrix-org%2Fprosody-mod-auth-matrix-user-verification","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatrix-org%2Fprosody-mod-auth-matrix-user-verification","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatrix-org%2Fprosody-mod-auth-matrix-user-verification/lists"}