0

I'm in the midst of testing mod_http_api to replace the existing usage of mod_rest in our implementation.

I can unrestrict access to some commands from group of IP addresses by using option "admin_ip_access". I can successfully execute some commands (e.g. change_password).

However, for some cases, we may require login as well for both user (own)and admin(own and other user).

However, when I tried to login with Basic Auth. It's not successful. I'm keep on getting the following. If my assumption is correct, this might be related to configuration.

Will be much appreciated if someone could show me how the correct configuration should be done.

{
  "status": "error",
  "code": 31,
  "message": "Command need to be run with admin priviledge."
}

Current config

modules:
  mod_http_api:
    admin_ip_access: admin_ip_access_rule

acl:
  admin_ip_acl:
     ip:
       - "xx.xx.xx.xx/32"

access:
  admin_ip_access_rule:
    admin_ip_acl:
       - all

EDIT

For testing purpose, I've enabled the following configuration:

commands_admin_access: configure
commands:
  - add_commands:
     - status
     - get_roster
     - change_password
     - register
     - unregister
     - registered_users
     - muc_online_rooms
     - oauth_issue_token

I able to run both of user and admin commands successfully for those listed commands inside add_commands tags. It works as expected. However, I still facing some issues, most related to the IP restriction. Calling the API from the host that is not listed in admin_ip_acl also successful where I expect to get error when calling for non-whitelited host

lxnx
  • 194
  • 2
  • 17

1 Answers1

0

The API requires an OAuth token for authentication. You need to generate one with correct scope. When a command is restricted to an admin, you need to also pass the HTTP header: "X-Admin: true" to let ejabberd know that it should consider you would like to act as an admin.

Mickaël Rémond
  • 9,035
  • 1
  • 24
  • 44
  • Hi @mickaël-rémond, is that mean I can't use basic authentication at all with this AP, or maybe for certain scenario, basic auth is still applicable? – lxnx Sep 02 '16 at 03:10
  • No, with mod_http_api, only oauth is implemented. – Mickaël Rémond Sep 02 '16 at 06:56
  • I just updated the question. Maybe you can give a bit clue how it supposes to work. – lxnx Sep 02 '16 at 12:05
  • You need to use new ACL format that include IP restrictions. Here you have just using the configure ACL rules, which is not the one you have defined. – Mickaël Rémond Sep 02 '16 at 12:59