Hi@all,
we have been testing Kopano-Meet for a while for internal communication of Kopano users. Works.
Now I would also like to integrate users who access Kopano from outside.
(Kopano debug according to Wiki see at the end).
About the environment:
The master (with Open ID) runs under 192.168.24.5 (srv01.mydomain.local). Since there is another UCS backup (192.168.4.4) on which OpenID is not installed, I have changed the DNS CNAME “ucs-sso” so that it points exclusively to the master.
Kopano (Core, WebApp, Z-Push and Meet) runs on the host com01.mydomain.local (192.168.24.6). So that we can call Kopano from the same address both internally and externally, I have set a DNS entry for the subdomain gw.myexternaldomain.de -> WAN-IP (local gateway) on the external web server and routed it to the Kopano server at the pfSense using an HA proxy (based on the subdomain).
This also works without any problems. Since the pfSense does NAT reflection, I can also use Kopano from the LAN at: https://gw.myexternaldomain.de/webapp.
What do I have to do now so that this also works with Meet?
If I try to call Mett from an external location:
https://gw.myexternaldomain.de/meet
I am redirected to:
https://com01.mydomain.local/meet/
which of course does not work. Here are the relevant debug outputs:
om com01
root@com01:/etc/kopano/webapp# univention-app info
UCS: 4.4-7 errata870
Installed: fetchmail=6.3.26 kopano-core=8.7.1.0-1 kopano-meet=2.3.1_0 kopano-webapp=3.5.14.2539-2 z-push-kopano=2.4.5
Upgradable:
on com01
root@com01:/etc/kopano/webapp# univention-run-join-scripts
univention-run-join-scripts: runs all join scripts existing on local computer.
copyright (c) 2001-2020 Univention GmbH, Germany
Enter DC Master Account : Administrator
Enter DC Master Password:
Search LDAP binddn: done
Running pre-joinscripts hook(s): done
Running 00kopano4ucs-safemode-on.inst skipped (already executed)
Running 03univention-directory-listener.inst skipped (already executed)
Running 04univention-ldap-client.inst skipped (already executed)
Running 08univention-apache.inst skipped (already executed)
Running 11univention-pam.inst skipped (already executed)
Running 18python-univention-directory-manager.inst skipped (already executed)
Running 20univention-directory-policy.inst skipped (already executed)
Running 20univention-join.inst skipped (already executed)
Running 26univention-nagios-common.inst skipped (already executed)
Running 30univention-appcenter.inst skipped (already executed)
Running 30univention-nagios-client.inst skipped (already executed)
Running 33univention-portal.inst skipped (already executed)
Running 34univention-management-console-server.inst skipped (already executed)
Running 35univention-appcenter-docker.inst skipped (already executed)
Running 35univention-management-console-module-appcenter.inskipped (already executed)
Running 35univention-management-console-module-diagnostic.iskipped (already executed)
Running 35univention-management-console-module-join.inst skipped (already executed)
Running 35univention-management-console-module-lib.inst skipped (already executed)
Running 35univention-management-console-module-mrtg.inst skipped (already executed)
Running 35univention-management-console-module-quota.inst skipped (already executed)
Running 35univention-management-console-module-reboot.inst skipped (already executed)
Running 35univention-management-console-module-services.insskipped (already executed)
Running 35univention-management-console-module-setup.inst skipped (already executed)
Running 35univention-management-console-module-sysinfo.instskipped (already executed)
Running 35univention-management-console-module-top.inst skipped (already executed)
Running 35univention-management-console-module-ucr.inst skipped (already executed)
Running 35univention-management-console-module-updater.instskipped (already executed)
Running 36univention-management-console-module-apps.inst skipped (already executed)
Running 50kopano-meet.inst skipped (already executed)
Running 70kopano4ucs-udm.inst skipped (already executed)
Running 70kopano4ucs.inst skipped (already executed)
Running 71kopano4ucs-webapp.inst skipped (already executed)
Running 81univention-nfs-server.inst skipped (already executed)
Running 92univention-fetchmail-schema.inst skipped (already executed)
Running 92univention-fetchmail.inst skipped (already executed)
Running 92univention-management-console-web-server.inst skipped (already executed)
Running 98univention-pkgdb-tools.inst skipped (already executed)
Running 99kopano4ucs-safemode-off.inst skipped (already executed)
Running post-joinscripts hook(s): done
on com01
root@com01:/etc/kopano/webapp# ucr dump | grep kopano/docker | grep -v PASSWORD
kopano/docker/ENABLE_MCU_API: no
kopano/docker/FQDN_MEET: com01.mydomain.local
kopano/docker/FQDN_SSO: ucs-sso.mydomain.local
kopano/docker/GRID_WEBAPP: no
kopano/docker/INSECURE: no
kopano/docker/MEET_GUEST_ALLOW: no
kopano/docker/MEET_GUEST_REGEXP: ^group/public/.*
kopano/docker/PIPELINE_FORCED_REGEXP: @conference/.*
kopano/docker/TURN_SERVICE_URL: https://ucs-turn.kopano.com/turnserverauth/
kopano/docker/TURN_USER: KST0300-8YUG3GPVX
on srv01
root@srv01:~# ucr search --brief oidc/konnectd/issuer_identifier
oidc/konnectd/issuer_identifier: https://ucs-sso.mydomain.local
on srv01
root@srv01:~# curl $(ucr get oidc/konnectd/issuer_identifier)/.well-known/openid-configuration
{
"issuer": "https://ucs-sso.mydomain.local",
"authorization_endpoint": "https://ucs-sso.mydomain.local/signin/v1/identifier/_/authorize",
"token_endpoint": "https://ucs-sso.mydomain.local/konnect/v1/token",
"userinfo_endpoint": "https://ucs-sso.mydomain.local/konnect/v1/userinfo",
"end_session_endpoint": "https://ucs-sso.mydomain.local/signin/v1/identifier/_/endsession",
"check_session_iframe": "https://ucs-sso.mydomain.local/konnect/v1/session/check-session.html",
"jwks_uri": "https://ucs-sso.mydomain.local/konnect/v1/jwks.json",
"scopes_supported": [
"openid",
"offline_access",
"email",
"konnect/uuid",
"konnect/raw_sub",
"profile"
],
"response_types_supported": [
"id_token token",
"id_token",
"code id_token",
"code id_token token"
],
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256",
"RS384",
"RS512",
"PS256",
"PS384",
"PS512"
],
"userinfo_signing_alg_values_supported": [
"RS256",
"RS384",
"RS512",
"PS256",
"PS384",
"PS512"
],
"request_object_signing_alg_values_supported": [
"ES256",
"ES384",
"ES512",
"RS256",
"RS384",
"RS512",
"PS256",
"PS384",
"PS512",
"none",
"EdDSA"
],
"token_endpoint_auth_methods_supported": [
"client_secret_basic",
"none"
],
"token_endpoint_auth_signing_alg_values_supported": [
"RS256",
"RS384",
"RS512",
"PS256",
"PS384",
"PS512"
],
"claims_parameter_supported": true,
"claims_supported": [
"iss",
"sub",
"aud",
"exp",
"iat",
"name",
"family_name",
"given_name",
"email",
"email_verified"
],
"request_parameter_supported": true,
"request_uri_parameter_supported": false
}
on srv01
root@srv01:~# curl $(ucr get oidc/konnectd/issuer_identifier)/signin/v1/welcome
<!doctype html><html lang="en"><head data-kopano-build="0.33.11"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name="theme-color" content="#ffffff"><link rel="shortcut icon" href="./static/favicon.ico" type="image/x-icon"><meta property="csp-nonce" content="4T4XR4QjUHsE7sflnG7OHkrhVufsY-3T_hz7zzF6cpU="><title>Kopano Sign in</title><link href="./static/css/main.1c108bb6.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="bg"><div id="bg-thumb"></div><div id="bg-enhanced"></div></div><div id="root" data-path-prefix="/signin/v1"></div><div id="font-preloader"><span>aA</span>Bb</div><script src="./static/js/runtime-main.78a800d5.js"></script><script src="./static/js/main.2d77eadc.chunk.js"></script></body></html>r
on com01
root@com01:/etc/kopano/webapp# curl https://$(ucr get kopano/docker/FQDN_SSO)/signin/v1/welcome
<!doctype html><html lang="en"><head data-kopano-build="0.33.11"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name="theme-color" content="#ffffff"><link rel="shortcut icon" href="./static/favicon.ico" type="image/x-icon"><meta property="csp-nonce" content="luzpRAnqSLIY4MFJpphwThb-6pfWTDA2WRwmTMcPvwI="><title>Kopano Sign in</title><link href="./static/css/main.1c108bb6.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="bg"><div id="bg-thumb"></div><div id="bg-enhanced"></div></div><div id="root" data-path-prefix="/signin/v1"></div><div id="font-preloader"><span>aA</span>Bb</div><script src="./static/js/runtime-main.78a800d5.js"></script><script src="./static/js/main.2d77eadc.chunk.js"></script></body></html>r
on com01
root@com01:/etc/kopano/webapp# grep -v 'secret\|"d"\|"x"\|"y"' /etc/kopano/docker/konnectd-identifier-registration.yaml
clients: null
authorities:
- name: ucs-konnect
default: true
iss: https://ucs-sso.mydomain.local
client_id: kopano-meet
authority_type: oidc
response_type: id_token
scopes:
- openid
- profile
- email
trusted: true
end_session_enabled: true
