Search code examples
ejabberdejabberd-api

ejabberd: AccessRules: Account does not have the right to perform the operation


I'm trying to follow API Permissions | ejabberd Docs and Configuring ejabberd | ejabberd Docs.

yet while trying to register a user:

# curl -sk -d '{"user":"test", "password":"testing", "host":"localhost"}' -H 'Content-Type: application/json' https://localhost:5443/api/register 

I get following in ejabberd.log:

# tail -2 ./home/ejabberd/logs/ejabberd.log 
2019-10-04 21:41:47.079 [info] <0.663.0>@mod_http_api:log:509 API call register [{<<"user">>,<<"test">>},{<<"password">>,<<"testing">>},{<<"host">>,<<"localhost">>}] from ::ffff:172.19.0.1:53740
2019-10-04 21:41:47.079 [info] <0.521.0>@ejabberd_listener:accept:256 (<0.663.0>) Accepted connection [::ffff:172.19.0.1]:53740 -> [::ffff:172.19.0.6]:5443
# 

ejabberd.yml' acl&api_permissions blocks:

acl:
  local:
    user_regexp: ""
  loopback:
    ip:
      - 127.0.0.0/8
      - ::1/128
      - ::FFFF:127.0.0.1/128
  admin:
    user:
      - "admin@localhost"
    ip:
      - ::/0
      - ::FFFF:10.0.0.0/8
      - ::FFFF:172.16.0.0/12
      - ::FFFF:172.19.0.0/12
      - ::FFFF:192.168.0.0/16

&

api_permissions:
  "console commands":
    from:
      - ejabberd_ctl
    who: all
    what: "*"
  "admin access":
    who: 
      access:
        allow:
          acl: loopback
          acl: admin
          ip:
            - ::/0
            - ::FFFF:10.0.0.0/8
            - ::FFFF:172.16.0.0/12
            - ::FFFF:172.19.0.0/12
            - ::FFFF:192.168.0.0/16
      oauth:
        scope: "ejabberd:admin"
        access:
          allow:
            acl: loopback
            acl: admin
    what:
      - "*"
      - "!stop"
      - "!start"
  "public commands":
    who:
      ip: 127.0.0.1/8
    what:
      - status
      - connected_users_number

Please advise.


Solution

  • I added my ip/range to admin AND loopback block:

    acl:
      local:
        user_regexp: ""
      loopback:
        ip:
          - 127.0.0.0/8
          - ::1/128
          - ::FFFF:127.0.0.1/128
          - ::FFFF:172.19.0.0/16
      admin:
        user:
          - "admin@localhost"
        ip:
          - ::FFFF:172.19.0.0/16
    

    and the error went away)