Use a newly generated access_token while joining Jitsi

[emrahcom]

Checklist

• Tests written for new code (and old code if feasible)
• Linter and other CI checks pass
• Sign-off given on the changes (see CONTRIBUTING.md)

This commit is related with Jitsi widget. It updates the token request time from the setup phase to the join phase. For now, OIDC access token is requested when initializing the widget. If the participant waits longer than the token expire time before clicking the join conference button, the participant gets the authentication failed error because of the expired OIDC token and they cannot join the video conference.

This problem only occurs if openidtoken-jwt is enabled.

The widget puts OIDC access token into Jitsi token as a field and it always uses the access token received at the widget setup time.

Steps to reproduce the issue:

• click the video conference button or reactivate the conference widget in the Matrix room
• wait a while (depending on the expire time set in your system) without clicking join conference button which is inside the widget
• click join conference button
• the widget will open jitsi page but the conference will not be started because of the authentication failed error

How does the issue occur:

• when jitsi widget is initialized in the Matrix room, it sends a request to Matrix server to get an access token
• A typical response is like the following

{
"access_token":"KNYEtwBkaxKFwAxaOCapIjrE",
"token_type":"Bearer",
"matrix_server_name":"​ Element ",
"expires_in":3600
}

• the expire time for this access token is 3600 seconds. It is set by the server
• when the participant clicks join conference button, the widget puts this access token into JWT without renew it.
• if the participant has waited 3600 seconds before clicking the button then the authentication fails because of the expire time.

How this commit solves the issue

It gets OIDC access token after clicking the join conference button, just before creating JWT.

Signed-off-by: Emrah Eryilmaz emrah.com@gmail.com
Fixes: #24687

---

Here's what your changelog entry will look like:

🐛 Bug Fixes

• Use a newly generated access_token while joining Jitsi (#24646). Fixes Authentication failure when joining Jitsi conference due to expired OIDC access token #24687. Contributed by @emrahcom.

[richvdh]

Hi @emrahcom thank you for your contribution! A couple of requests:

1. Please could you open a new issue clearly describing the (symptoms of the) problem you are fixing. I know that you have described it in the PR description, but it is somewhat confusing to have it mixed in with an explanation of the fix.

2. It looks like we will now request a new openIdToken every time we try to join the call. It seems like that will involve a number of HTTP requests at least. Can we cache the results of a successful authentication?

[richvdh]

I don't understand this comment. If it also makes no sense to you, I suggest we remove it rather than copying it.

[turt2live]

This comment is older than the code - it should be removed.

[richvdh]

For now, Matrix access token is requested when initializing the widget

Note that the access token returned by the openid endpoint is not a matrix access token: it cannot be used for calling Matrix APIs. It is an OpenID Connect (OIDC) access token. Please could you update the PR description to correct this?

[richvdh]

It looks like we will now request a new openIdToken every time we try to join the call. It seems like that will involve a number of HTTP requests at least. Can we cache the results of a successful authentication?

@turt2live tells me that the lifetime of the openId tokens is relatively short, so caching them is not worthwhile. Please ignore this suggestion!

[emrahcom]

1. Please could you open a new issue clearly describing the (symptoms of the) problem you are fixing. I know that you have described it in the PR description, but it is somewhat confusing to have it mixed in with an explanation of the fix.

Issue #24687

[andybalaam]

@emrahcom what is the state of this PR? Are you waiting for feedback? It looks to me from the comments like we're waiting for you to respond to the reviewer feedback. Is that right? If so, I recommend moving its status back to Draft until it's ready.

Thanks for the contribution!

[emrahcom]

@emrahcom what is the state of this PR? Are you waiting for feedback? It looks to me from the comments like we're waiting for you to respond to the reviewer feedback. Is that right?

No, I'm waiting for you. I think the PR is already ready. The updates according to the reviewer feedback were applied 3 weeks ago

[andybalaam]

No, I'm waiting for you. I think the PR is already ready. The updates according to the reviewer feedback were applied 3 weeks ago

OK, I clicked "Re-request review" so @richvdh knows you're looking for more feedback.

[richvdh]

@emrahcom did this happen:

Please could you open a new issue clearly describing the (symptoms of the) problem you are fixing. I know that you have described it in the PR description, but it is somewhat confusing to have it mixed in with an explanation of the fix.

?

[emrahcom]

@emrahcom did this happen:

Yep, Issue #24687

[richvdh]

@emrahcom did this happen:

Yep, Issue #24687

Thanks, have linked it from the PR description

[richvdh]

Thanks for this! Looks good!