Setup XMPP server to use other JSON API on webserver for user storage and authentication - xmpp

We are developing a consumer hardware product. Each device is registered on a central webserver and the owner also have a user account to which the device is linked. The owner may also choose to share the device with other users.
Now, to solve the problem of getting through firewalls etc we are using XMPP: the user access his/her devices using an iOS/Android app. The app connects to the XMPP-server and so does the hardware devices. So the app can access the devices by sending custom XMPP stanzas.
Currently the device and the mobile app use the same JID, so the device will allow messages only from the same bare JID as itself uses. To allow for sharing devices we are planning to use the roster instead: the device will get its own JID ("hw381983829#thexmppserver.com") and will accept stanzas from all JID's in its roster.
The problem I'm having is that the users, devices and device-sharing data are stored on the webserver. I would like to use this same information on the XMPP-server: all users and devices on the webserver are allowed to login to XMPP and the roster of a device is the same as the users that may access it. This information can be accessed through a JSON API.
One way would be to mirror changes as they happen, but I don't like that idea since there are too many steps that could go wrong.
The best solution I can think of is to let the XMPP server use the JSON API instead of its builtin database. It would be read-only, but that is not a problem since all registration and sharing should be done on the webserver.
Any ideas on how to proceed? The functionality described above is more or less all that we need: we don't need S2S, offline messages, etc. We are currently using Ejabberd, but Prosody or Openfire are perhaps better alternatives?

For authentication, it looks like this ejabberd contribution does exactly what you need:
https://github.com/processone/ejabberd-contrib/tree/master/ejabberd_auth_http
For roster, it is easy to write a custom roster module that will be hitting your HTTP backend instead of query the database thanks to ejabberd API.
You can have a look at mod_roster as a guide to implement the methods: https://github.com/processone/ejabberd/blob/master/src/mod_roster.erl

Related

User status message for iOS chat app

I am developing an iPhone chat application using robbiehanson/XMPPFramework and I am using OpenFire on the server side. I want to implement the user status feature on my app like the whatsapp status concept.
How can I achieve this, is there any default support on the openfire server for storing the user status messages ?
Thanks in advance
I am not sure what you call 'user status'. You can add information about the presence of the user in presence packets. This is purely transient information and is generally not stored in XMPP server.
You can also decide to publish status information in a more persistent way using Personal Eventing Protocol (PEP). The last status is generally stored by server to be resend / retrieved at a later time.
Reference: http://xmpp.org/extensions/xep-0163.html

Ejabberd: How to limit the fetching of jabber user directory (JUD)

I'm developing a client jabberd application for mobile(android) using (a)Smack.
Since, in my application, the users are registered by their phone numbers, the application should be able to recognize which contact has a jabber account on the server and suggest him/her for chatting.
After googlling the web I found that there is a jabber user directory (JUD) which I can use to check there is an account for a specific mobile number or not. (I'm using UserSearchManager).
My questions:
1- It seems that there is no record in JUD for a user who has not updated his vCard yet, so I cannot find him. Is there any solution to check the existence of this kind of users?
2- It seems that by using JUD, everyone outside of my application can fetch some important information of users such as mobile numbers, emails, etc. Is there any solution to limit JUD search engine? (for example, getting only "user field" as a input and returning only "full name field" of existing accounts or other useful limitation).
So by this way, I can recognize which person from the contact list has an account on the server and also other people cannot fetch important information of the exiting users.
Any command or advice is appreciated. Thank you.
I do not think it is possible as default, without customizing ejabberd application code.

Facebook Chat limitations

My company develop a product for customer support on Facebook and we want to give the representatives a way to contact the customer via Facebook Chat.
I have read the Chat API documentations and it is not clear whether users MUST be friends on Facebook in order to chat or is it just enough they both installed a Facebook app? more limitations?
any insight will be appreciated.
Thanks in advance for you answers,
Yaniv Hakim
Facebook provides an XMPP port to the outside world while internally it implements MQTT. As per XMPP specs, messaging works between two entities without they being in each other roster list (friend/contact list). However, Facebook seems to have this limitation as part of their own business requirement. I think even GoogleTalk disallows this if two federated entities try to send message to each other without being on the roster list.
In short, yes you can just send the message. You don't need a presence authorization from someone in order to send messages to them (in XMPP world). HOWEVER, some services has a policy of requiring this, despite the fact that this is not mandated by the XMPP specifications.

Best way to integrate an XMPP Server into Webapplication

I'm working on a middle size community project, using php and the php framework symfony2 atm.
We are planning to integrate XMPP as a support chat and premium feature for our users. The users will be able to connect via a webclient and also via normal xmpp clients.
So here are my questions:
About the Rosters: I want to have the users from the friends list listed in the users contact list. I know that this can be done with rosters. But how can I implement this on a simple and stable way? Is there a good Server implementation that can get the users roster out of a sql database like pgsql?
What happens on the client when the roster datas are beeing changed while the user is logged in on the xmpp server?
Can I group the users that are listed in the roster of a user?
Which XMPP server project would you recommend for that kind of project?
Thanks for your help in advance!
most existing XMPP servers support all popular DBRMs. So this should be no problem.
probably nothing when you make the changes directly do the database. So have to find a server where you can initiate a roster push to all connected clients. See also the XMPP RFCs for roster updates.
yes, roster groups are a core feature of XMPP.
You can find a list of XMPP servers here: http://xmpp.org/xmpp-software/servers/ You have to check which servers support pgsql and allow you to update the roster and initiate the roster pushes to connected resources.

How to check if a person in your iPhone contact list has an app installed?

I want to allow people to privately share data with each other using their contacts list to select people to share with. I'm planning on using Push Notifications to notify others that they have been shared with, but how can I handle those that do not have the app installed?
The cases are that I have their phone # and/or email. I can simply send them a message saying "X wants to share Y with you", but how can I determine if I need to send a Push Notification or an email/text?
If you're looking for API then you're out of luck. You can always collect this personal data server-side with agreement of your users. There you can also manage groups and other community relations.
Check here:
https://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/ApplePushService/ApplePushService.html
The crux of it though will be that you will need to store a token when the device is registered anyway to be able to send notifications to them, so you can use that.
And using The Feedback Service alluded to in the documentation, you can remove the token, should it fail too often.
But, as rokjarc said, if you're expecting a third-party API to exist, you're pretty much out of luck. Apple ahs done most of the work for you already anyway.
When the app registeres for push notifications you need to pass additional data to your server. The user could input their own email/phone which will be sent to the server so that users can find each other. The email/phone can be stored alongside with the push token. When someone wants to share something, you would search the corresponding push token in the database and send the notification through APNS. Note there can be multiple push tokens for one email or phone i.e. when a user has multiple devices.
The users of your app should be aware of the data which is stored on your server and should have the option to delete it. Also use the APNS feedback service to detect and remove invalid push tokens.