28 lines
1.9 KiB
Markdown
28 lines
1.9 KiB
Markdown
# auth-mastodon.py
|
|
This is a Python script designed to run as an [ejabberd external auth](https://docs.ejabberd.im/developer/guide/#external) program, and validate user accounts directly from a [Mastodon](https://github.com/tootsuite/mastodon/) installation's database.
|
|
|
|
The code is derived from [ejabberd-auth-mysql](https://github.com/rankenstein/ejabberd-auth-mysql) and is licensed under the GNU GPLv3.
|
|
|
|
It is used on [Chinwag Social](https://social.chinwag.org) to provide XMPP messaging functionality to every account.
|
|
|
|
Discussion, questions and/or just saying hi in the [Chinwag Social Beergarden](xmpp:beergarden@rooms.chinwag.org?join) MUC (beergarden@rooms.chinwag.org) is welcomed!
|
|
|
|
## Setup
|
|
Edit the `auth-mastodon.py` file and add database connection credentials at the top. Moving this to a config file is next on the TODO list, as this makes updates an awful process. Sorry.
|
|
|
|
I recommend not using your main Mastodon database user account for this, and instead granting SELECT privileges on the Mastodon *accounts* and *users* tables to your ejabberd user instead.
|
|
|
|
The code here does not attempt any modification to the Mastodon tables at any point, so there's no reason to give it more than read-only rights.
|
|
|
|
Then configure ejabberd to use `auth-mastodon.py` as an external authentication provider, as described in the [ejabberd docs](https://docs.ejabberd.im/admin/configuration/#external-script):
|
|
|
|
```yaml
|
|
auth_method: external
|
|
extauth_program: "/path/to/auth-mastodon.py"
|
|
```
|
|
|
|
## To Do
|
|
1. Move all database and config elements to a simple file to be stored in /etc/ejabberd or similar
|
|
2. Verify domain part of request somehow. Maybe define a canonical domain to be used in config? Does this gain us anything at all?
|
|
3. Better error handling. Would be good to be more descriptive in the logs, perhaps.
|
|
4. Setup documentation is very brief, maybe include how to grant minimal permissions via pgsql.
|