0

I am getting 400 bad request error while calling "/api/get_roster" endpoint of ejabberd. I had kept "get_roster" in the scope while requesting the oauth token.

400 bad request error in ejabberd

I guess there is some issue with the permissions. Here is my configuration file:

https://www.dropbox.com/s/his89bx39qhvr1h/ejabberd2.yml?dl=0

I have tried to follow the official documentation. As per the API permission guide, I have also tried adding following properties:

api_permissions:
  - "Admin access":
    - who:
      - admin
    - what
      - "\*"
      - "!stop"

But there was no change. I have following questions:

  1. What am I doing wrong here?
  2. What are possible scopes?
Vikas Roy
  • 13
  • 2
  • 8
  • As per document, Note:: To use get_roster scope, you need to have mod_admin_extra enabled. Otherwise, the command is unknown and you will get an invalid_scope error. – Girdhar Sojitra Apr 11 '17 at 15:30
  • I have mentioned mod_admin_extra in the modules section of yml file. I did not get invalid_scope error. I am able to acquire token. It is just that when I use that token in POST call to API Endpoint, it says 400 bad request. – Vikas Roy Apr 11 '17 at 15:38
  • What version of ejabberd you are using? – Darshan Apr 15 '17 at 16:57
  • I am using ejabberd 16.01. – Vikas Roy Apr 16 '17 at 06:19

3 Answers3

0

Your request should contain Authorization header as below:

curl -v -X POST -H "Authorization: Bearer <Oauth_token>" http://localhost:5280/api/get_roster -d '[]'
Girdhar Sojitra
  • 648
  • 4
  • 14
  • I am doing the same: https://www.dropbox.com/s/rgh88lua0jdytu5/Screen%20Shot%202017-04-11%20at%209.24.13%20PM.png?dl=0 – Vikas Roy Apr 11 '17 at 15:55
  • here it is https://www.dropbox.com/s/vrlw2gc6p15e5dx/ejabberd_error_log_11_april.log?dl=0. it is not recognising "api_permissions" property. I have misplaced it? – Vikas Roy Apr 11 '17 at 16:07
  • From logs , it seems that, oauth module is not started correctly. – Girdhar Sojitra Apr 11 '17 at 16:14
0

You can refer to this link for more details. If you are accessing as admin you can use commands_admin_access rule to provide access to api commands and specify the commands you want to access as follows:

commands:
  - add_commands:
    - get_roster
commands_admin_access: configure
The Maverick
  • 336
  • 1
  • 8
0

You are using very old version of Ejabberd. Latest is 17.04 which has lots of changes in API permission framework from 16.01 . api_permission related configuration came in 16.12 version. Please refer this for more detail.

Community
  • 1
  • 1
Darshan
  • 151
  • 5
  • 13