{"action":"created","issue":{"url":"https://api.github.com/repos/jsxc/jsxc/issues/402","repository_url":"https://api.github.com/repos/jsxc/jsxc","labels_url":"https://api.github.com/repos/jsxc/jsxc/issues/402/labels{/name}","comments_url":"https://api.github.com/repos/jsxc/jsxc/issues/402/comments","events_url":"https://api.github.com/repos/jsxc/jsxc/issues/402/events","html_url":"https://github.com/jsxc/jsxc/issues/402","id":189248785,"number":402,"title":"TURN configuration","user":{"login":"christophschw","id":13663130,"avatar_url":"https://avatars.githubusercontent.com/u/13663130?v=3","gravatar_id":"","url":"https://api.github.com/users/christophschw","html_url":"https://github.com/christophschw","followers_url":"https://api.github.com/users/christophschw/followers","following_url":"https://api.github.com/users/christophschw/following{/other_user}","gists_url":"https://api.github.com/users/christophschw/gists{/gist_id}","starred_url":"https://api.github.com/users/christophschw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christophschw/subscriptions","organizations_url":"https://api.github.com/users/christophschw/orgs","repos_url":"https://api.github.com/users/christophschw/repos","events_url":"https://api.github.com/users/christophschw/events{/privacy}","received_events_url":"https://api.github.com/users/christophschw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2016-11-14T22:48:46Z","updated_at":"2016-12-08T04:45:15Z","closed_at":null,"body":"\r\n[ejabberd.yml.txt](https://github.com/jsxc/jsxc/files/590701/ejabberd.yml.txt)\r\n\r\nHey,\r\nI got troubles with the TURN server configuration. I registered an account at numb.viagenie.ca. Video is working if clients are in the same network, but not if there are in different. The known problem when dialling:\r\n\r\n> ICE_connection_failure\r\n> Anruf beendet: jingle_reason_failed-transport.\r\n> Anruf beendet: jingle_reason_failed-transport.\r\n\r\nConfiguration: owncloud 9.0.4\r\nXMPP: ejabbered\r\nServer NGINX\r\nOS: CentOS 7 with firewalld (I already stopped it temporarily)\r\n\r\n> XMPP domain: server's IP\r\n> BOSH URL: /http-bind/ \r\n\r\n→ is reachable (because of SLL redirect the proxy pass directs to https://localhost/http-bind)\r\n\r\n> TURN URL: numb.viagenie.ca\r\n> TURN Username: as registered, my email address \r\n> TURN Password: as registered\r\n> TURN Secret: empty\r\n> TURN TTL: 86400\r\n\r\nWhich information should I provide? How can I debug?\r\nThanks in advance,\r\nChristoph\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/jsxc/jsxc/issues/comments/265651938","html_url":"https://github.com/jsxc/jsxc/issues/402#issuecomment-265651938","issue_url":"https://api.github.com/repos/jsxc/jsxc/issues/402","id":265651938,"user":{"login":"dteleguin","id":13701445,"avatar_url":"https://avatars.githubusercontent.com/u/13701445?v=3","gravatar_id":"","url":"https://api.github.com/users/dteleguin","html_url":"https://github.com/dteleguin","followers_url":"https://api.github.com/users/dteleguin/followers","following_url":"https://api.github.com/users/dteleguin/following{/other_user}","gists_url":"https://api.github.com/users/dteleguin/gists{/gist_id}","starred_url":"https://api.github.com/users/dteleguin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dteleguin/subscriptions","organizations_url":"https://api.github.com/users/dteleguin/orgs","repos_url":"https://api.github.com/users/dteleguin/repos","events_url":"https://api.github.com/users/dteleguin/events{/privacy}","received_events_url":"https://api.github.com/users/dteleguin/received_events","type":"User","site_admin":false},"created_at":"2016-12-08T04:45:15Z","updated_at":"2016-12-08T04:45:15Z","body":"@popindavibe also thanks for sharing the config. Seems like we've missed the important `relay-ip` option. Without it, coturn's behavior is quite different from what we wanted.\r\n\r\nAs for exposing TURN credentials, it's a well-known problem that has been addressed more or less. Basically, we have the following options:\r\n* Long-term credentials (`-a, --lt-cred-mech` coturn flags), aka traditional login-password authentication. This means TURN server maintains a user database. This is the simplest variant, but, as you've mentioned, it's insecure in the sense of exposing plain-text credentials even to unauthenticated users;\r\n* Ephemeral credentials aka TURN REST API (`--use-auth-secret`). This is more secure because clients don't have access to any persistent credentials. Instead, they obtain temporary credentials from an URL. The issuing server and the TURN server should share a cryptographic secret so that the credentials could be verified on the TURN side. (The process is described in full detail [here](https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00).)\r\n\r\nThe problem is, JSXC is a purely client-side solutions and does not (and probably should not) provide any server-side code; so it's your responsibility to provide an URL of an endpoint that would issue credentials, trusted by your TURN server. I think this logic could be implemented as a part of an integration plugin.\r\n\r\nBTW, we've revived a [JSXC RoundCube plugin](https://github.com/AcutusPro/jsxc.roundcube) (@sualko, pls see my ML posting on that). I think I'll give it a try and integrate ephemeral credential issuing into the plugin as a proof-of-concept, hopefully by the end of the week.\r\n\r\n* oAuth token-based authentication/authorization (I'll write about it a bit later)."}}
{"actor":{"display_login":"dteleguin"}}