vnclagoon/vnctalk-hybridauth
14
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Analysis: does vnc-hybridauth2 still fit the VNCiac stack? (replace / modernize / keep) #1

New Issue
Open
opened 2026-08-19 12:43:17 +00:00 by git-admin · 0 comments
git-admin commented 2026-08-19 12:43:17 +00:00
Copy Link
Copy Source

Summary

This repo (vnctalk-hybrid-authenticator2, port 9544) is a Node.js/Express Basic-Auth bridge — not a real IdP. One 682-line app/app.js with /, /login2fa, /health. It takes an Authorization: Basic header and validates the user against five interchangeable backends, returning a profile JSON:

Backend Mechanism Profile returned
Redmine PostgreSQL (useRedmineAuth) sha1+salt hash vs users/tokens/organizations/departments uid, cn, email, memberOf, features, redmineapikey, tfa_enabled
Zimbra LDAP zimbraAccountStatus=active + zimbraMailStatus=enabled uid, mail, displayName, …
MS-AD sAMAccountName uid, mail, displayName
Legacy "old secret" time-seeded md5(timeseed + mangleduid + xmppToken) —
JWT jwt.verify(pw, xmppToken) —

History: created 2018-11-08, 100 commits, last functional change 2024-04 ("org lock"); everything after is infra/build noise (Trivy, Alpine, rootless, registry labels) through 2026-06.

Who consumes it

  1. auth-proxy /login — vnc-portal/uxf/api/auth-proxy/routes/index.js:886 calls config.hybridAuthURL (9543 = v1, 9544 = v2) with Basic auth, then mints its own JWT.
  2. Prosody XMPP chat — mod_auth_http_async → hybridaAuthUrl.
  3. Legacy docker/vnctalk-xmpp image — copies vnc-hybridauth.js as /etc/vnc-hybridauth2.js.

Relationship to the current VNCiac stack

  • Wrong org — lives in VNC, not the vnciac org where all current work happens.
  • Absent from the roadmap — BACKEND-CONSOLIDATION-PLAN.md never mentions it. Target auth = @vnciac/auth-proxy-core with passport SAML/custom-JWT + Redis session, not LDAP/Redmine-hash Basic auth.
  • Already re-pointed — the newer VNCmail-new auth-proxy config uses an OIDC endpoint: hybridAuthURL: 'https://xmpp.dev.vnc.de/ocauth/'.
  • Prosody re-pointed — VNCTALK-GCP-TO-VNCIAC-MIGRATION.md §4 repoints hybridaAuthUrl → vncdirectory.*.vnc.de in-cluster.
  • Identity is now Keycloak — infra/identity/README.md: Keycloak = OIDC/SAML/LDAP/SCIM/2FA engine; VNCdirectory (Redmine fork) = management layer.

Fact: architecturally superseded (role split between Keycloak OIDC + VNCdirectory), but may still have residual live dependents — XMPP chat auth until the Prosody migration lands (infra/prosody/ and infra/xmpp/ are empty .gitkeep stubs; migration doc §2 marks chat "Not migrated").

Security / maintainability debt

  • Plaintext secrets committed: LDAP bindPassword, xmppToken, Redmine/Prosody DB passwords (flagged in the consolidation plan's Phase 0 as still-live leaked creds).
  • md5/hmacsha1 legacy token; rejectUnauthorized: false on DB TLS; passwords logged under config.debug.
  • No tests ("test": "echo Error: no test specified"), no README, no lint.
  • / and /login2fa are ~330-line near-identical copy-paste; LDAP client bind/unbind per request.
  • CommonJS var, legacy deps (ldapjs@1.0.2, express@4, @cypress/request).

Options

A. Replace / retire (fold into Keycloak + VNCdirectory, delete repo)

  • Pro: single source of truth, matches the consolidation plan, removes the biggest live plaintext-secret liability, no ongoing maintenance.
  • Con: premature if Prosody chat still depends on it — retiring before mod_auth_http_async is repointed breaks XMPP login. /ocauth/VNCdirectory must provably return the same profile shape (memberOf, features, redmineapikey, tfa_enabled) or logins silently lose org/feature/2FA data.

B. Modernize (rewrite as a provider inside @vnciac/auth-proxy-core)

  • Pro: keeps the LDAP/Redmine bridge capability in typed, tested, secret-safe form for brownfield installs still on Zimbra/AD.
  • Con: likely throwaway work — the strategy is Keycloak OIDC, not a maintained LDAP-Basic bridge; duplicates VNCdirectory's role; cost without a clear long-term consumer.

C. Keep / freeze (maintain as-is until Prosody migration completes, then retire)

  • Pro: zero risk to running chat; proven in prod since 2018; lets the Prosody→VNCdirectory re-point land first.
  • Con: keeps carrying leaked-secret + no-test + no-owner debt; stays outside the vnciac consolidation scope as an invisible critical dependency.

Open question that gates the decision

Is hybridauth2 still the live auth backend for XMPP chat login?

  • If yes → C now, then A after the Prosody/VNCdirectory migration (§2 U4–U5 + repoint) lands.
  • If no → A immediately, after confirming no config block still references 9543/9544.

@Stefan-Sanger — please check and decide.

## Summary This repo (`vnctalk-hybrid-authenticator2`, port 9544) is a Node.js/Express **Basic-Auth bridge** — not a real IdP. One 682-line `app/app.js` with `/`, `/login2fa`, `/health`. It takes an `Authorization: Basic` header and validates the user against five interchangeable backends, returning a profile JSON: | Backend | Mechanism | Profile returned | |---|---|---| | Redmine PostgreSQL (`useRedmineAuth`) | sha1+salt hash vs `users`/`tokens`/`organizations`/`departments` | `uid, cn, email, memberOf, features, redmineapikey, tfa_enabled` | | Zimbra LDAP | `zimbraAccountStatus=active` + `zimbraMailStatus=enabled` | `uid, mail, displayName, …` | | MS-AD | `sAMAccountName` | `uid, mail, displayName` | | Legacy "old secret" | time-seeded `md5(timeseed + mangleduid + xmppToken)` | — | | JWT | `jwt.verify(pw, xmppToken)` | — | History: created **2018-11-08**, 100 commits, last *functional* change 2024-04 ("org lock"); everything after is infra/build noise (Trivy, Alpine, rootless, registry labels) through 2026-06. ## Who consumes it 1. **`auth-proxy` `/login`** — `vnc-portal/uxf/api/auth-proxy/routes/index.js:886` calls `config.hybridAuthURL` (9543 = v1, 9544 = v2) with Basic auth, then mints its own JWT. 2. **Prosody XMPP chat** — `mod_auth_http_async` → `hybridaAuthUrl`. 3. **Legacy `docker/vnctalk-xmpp` image** — copies `vnc-hybridauth.js` as `/etc/vnc-hybridauth2.js`. ## Relationship to the current VNCiac stack - **Wrong org** — lives in `VNC`, not the `vnciac` org where all current work happens. - **Absent from the roadmap** — `BACKEND-CONSOLIDATION-PLAN.md` never mentions it. Target auth = `@vnciac/auth-proxy-core` with **passport SAML/custom-JWT + Redis session**, *not* LDAP/Redmine-hash Basic auth. - **Already re-pointed** — the newer `VNCmail`-new auth-proxy config uses an OIDC endpoint: `hybridAuthURL: 'https://xmpp.dev.vnc.de/ocauth/'`. - **Prosody re-pointed** — `VNCTALK-GCP-TO-VNCIAC-MIGRATION.md` §4 repoints `hybridaAuthUrl` → `vncdirectory.*.vnc.de` in-cluster. - **Identity is now Keycloak** — `infra/identity/README.md`: Keycloak = OIDC/SAML/LDAP/SCIM/2FA engine; VNCdirectory (Redmine fork) = management layer. **Fact:** architecturally superseded (role split between Keycloak OIDC + VNCdirectory), but may still have **residual live dependents** — XMPP chat auth until the Prosody migration lands (`infra/prosody/` and `infra/xmpp/` are empty `.gitkeep` stubs; migration doc §2 marks chat "Not migrated"). ## Security / maintainability debt - Plaintext secrets committed: LDAP `bindPassword`, `xmppToken`, Redmine/Prosody DB passwords (flagged in the consolidation plan's Phase 0 as still-live leaked creds). - `md5`/`hmacsha1` legacy token; `rejectUnauthorized: false` on DB TLS; passwords logged under `config.debug`. - No tests (`"test": "echo Error: no test specified"`), no README, no lint. - `/` and `/login2fa` are ~330-line near-identical copy-paste; LDAP client bind/unbind per request. - CommonJS `var`, legacy deps (`ldapjs@1.0.2`, `express@4`, `@cypress/request`). ## Options ### A. Replace / retire (fold into Keycloak + VNCdirectory, delete repo) - **Pro:** single source of truth, matches the consolidation plan, removes the biggest live plaintext-secret liability, no ongoing maintenance. - **Con:** premature if Prosody chat still depends on it — retiring before `mod_auth_http_async` is repointed breaks XMPP login. `/ocauth`/VNCdirectory must provably return the same profile shape (`memberOf`, `features`, `redmineapikey`, `tfa_enabled`) or logins silently lose org/feature/2FA data. ### B. Modernize (rewrite as a provider inside `@vnciac/auth-proxy-core`) - **Pro:** keeps the LDAP/Redmine bridge capability in typed, tested, secret-safe form for brownfield installs still on Zimbra/AD. - **Con:** likely throwaway work — the strategy is Keycloak OIDC, not a maintained LDAP-Basic bridge; duplicates VNCdirectory's role; cost without a clear long-term consumer. ### C. Keep / freeze (maintain as-is until Prosody migration completes, then retire) - **Pro:** zero risk to running chat; proven in prod since 2018; lets the Prosody→VNCdirectory re-point land first. - **Con:** keeps carrying leaked-secret + no-test + no-owner debt; stays outside the `vnciac` consolidation scope as an invisible critical dependency. ## Open question that gates the decision **Is hybridauth2 still the live auth backend for XMPP chat login?** - If **yes** → C now, then A after the Prosody/VNCdirectory migration (§2 U4–U5 + repoint) lands. - If **no** → A immediately, after confirming no config block still references 9543/9544. @Stefan-Sanger — please check and decide.
Stefan-Sanger was assigned by git-admin 2026-08-19 12:43:17 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Andrea (Andrea Wörrlein) Ateq-Ejaz (Ateq Ejaz) Bernd-Rodler (Bernd Rodler) Stefan-Sanger (Stefan Sänger) chandravnc (Chandrashekhar Kumar) gaurav.krishan (Gaurav Krishan) hamza.ejaz (Hamza Ejaz) macanhhuy (Mac Anh Huy) matthias.laesker (Matthias Läsker) muhammad.sharif (muhammad.sharif) ramiz.raja (Ramiz Raja) sebastian.varga (Sebastian Varga) vnc-coding-bot (VNC Coding Bot)
No Assignees Stefan-Sanger
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vnclagoon/vnctalk-hybridauth#1