snapshot of https://github.com/jitsi/jitsi-meet.git @ fd1749dd28f4138aa80234fc7f311b19aaffa0e7 (2026-09-15)

resources/prosody-plugins/mod_auth_jitsi-shared-secret.lua

@@ -0,0 +1,69 @@
+-- Authentication with shared secret where the username is ignored
+-- Copyright (C) 2023-present 8x8, Inc.
+
+local new_sasl = require "util.sasl".new;
+local saslprep = require "util.encodings".stringprep.saslprep;
+local secure_equals = require "util.hashes".equals;
+
+local shared_secret = module:get_option_string('shared_secret');
+-- TODO: shared_secret_prev is probably broken. get_sasl_handler() returns shared_secret
+-- from its plain callback, so Prosody rejects any password other than the current secret.
+-- provider.test_password() handles shared_secret_prev correctly but is not called in the
+-- PLAIN SASL flow. To fix, get_sasl_handler() should use a plain_test profile instead.
+local shared_secret_prev = module:get_option_string('shared_secret_prev');
+if shared_secret == nil then
+    module:log('error', 'No shared_secret specified. No secret to operate on!');
+    return;
+end
+
+module:depends("jitsi_session");
+
+-- define auth provider
+local provider = {};
+
+function provider.test_password(username, password)
+    password = saslprep(password);
+    if not password then
+        return nil, "Password fails SASLprep.";
+    end
+
+    if secure_equals(password, saslprep(shared_secret)) then
+        return true;
+    elseif (shared_secret_prev ~= nil and secure_equals(password, saslprep(shared_secret_prev))) then
+        module:log("info", "Accepting login using previous shared secret, username=%s", username);
+        return true;
+    else
+        return nil, "Auth failed. Invalid username or password.";
+    end
+end
+
+function provider.get_password(username)
+    return shared_secret;
+end
+
+function provider.set_password(username, password)
+    return nil, "Set password not supported";
+end
+
+function provider.user_exists(username)
+    return true; -- all usernames exist
+end
+
+function provider.create_user(username, password)
+    return nil;
+end
+
+function provider.delete_user(username)
+    return nil;
+end
+
+function provider.get_sasl_handler(session)
+	local getpass_authentication_profile = {
+		plain = function(_, username, realm)
+			return shared_secret, true;
+		end
+	};
+	return new_sasl(module.host, getpass_authentication_profile);
+end
+
+module:provides("auth", provider);