#1324 Add node_creation_policy option in mod_pubsub to change who can create nodes
Reporter
pep.
Owner
Zash
Created
Updated
Stars
★★★ (4)
Tags
Type-Enhancement
Status-Fixed
Priority-Medium
Milestone-0.13
pep.
on
Description of feature:
Add a configuration option to allow more than admins to create nodes.
Motivation: (Why?)
Movim and SàT-aware XMPP operators(!) often provide a pubsub component that their users can then use to create different groups/communities/nodes/however that is called.
I guess we would be looking at something similar to https://issues.prosody.im/1196#comment-3
node_creation_policy = "open" -- Anyone may create node
node_creation_policy = "admin" -- Only admins may create node
node_creation_policy = "host" -- Anyone on the "parent" host may create node
node_creation_policy = "server" -- Anyone on the same server may create node, regardless of host
Zash
on
We had a lengthy discussion on how to handle this, wherein we decided to add support for a kind of internal affiliations for things such as being an admin or a local user.
The way node creation is currently allowed is by admins having a default affiliation of 'owner'. Extending this to wider sets of users would suddenly give everyone admin access to all nodes, which obviously wouldn't be sensible.
By having internal affiliations such as 'prosody_admin' or 'prosody_user' then these could be granted permission to create nodes without also granting any of the permissions that the 'owner' affiliation gives.
Changes
tags Status-Accepted
PICCORO Lenz McKAY
on
What is the status for this issue? we are now over 0.12, thanks in advance
Description of feature: Add a configuration option to allow more than admins to create nodes. Motivation: (Why?) Movim and SàT-aware XMPP operators(!) often provide a pubsub component that their users can then use to create different groups/communities/nodes/however that is called. I guess we would be looking at something similar to https://issues.prosody.im/1196#comment-3 node_creation_policy = "open" -- Anyone may create node node_creation_policy = "admin" -- Only admins may create node node_creation_policy = "host" -- Anyone on the "parent" host may create node node_creation_policy = "server" -- Anyone on the same server may create node, regardless of host
We had a lengthy discussion on how to handle this, wherein we decided to add support for a kind of internal affiliations for things such as being an admin or a local user. The way node creation is currently allowed is by admins having a default affiliation of 'owner'. Extending this to wider sets of users would suddenly give everyone admin access to all nodes, which obviously wouldn't be sensible. By having internal affiliations such as 'prosody_admin' or 'prosody_user' then these could be granted permission to create nodes without also granting any of the permissions that the 'owner' affiliation gives.
ChangesWhat is the status for this issue? we are now over 0.12, thanks in advance
This will be addressed as part of https://blog.prosody.im/modern-xmpp-auth/
ChangesAdded integration with the new role framework in https://hg.prosody.im/trunk/rev/cfc42ed3892c Description of how to do the 4 configuration variants from the first post added at https://prosody.im/doc/modules/mod_pubsub#permissions
Changes