Skip to content

Commit 114f0f4

Browse files
authored
Restrict access to LiveKit SFU by differentiating full-access and restricted Matrix users for room creation (#67)
* add new ENV variable LIVEKIT_FULL_ACCESS_HOMESERVERS to allow different handling between full-access and restricted users * full-access / restricted user detection * Create LiveKit room on the SFU in case of a full-acceess user prior to issuing the JWT token * Support full-access for all users via wildcard `*`for all homeservers * make the wildcard '*' the default of LIVEKIT_FULL_ACCESS_HOMESERVERS to mimic the previous behaviour * more idomatic variable nameing * More ideomatic order for of functions in main.go
1 parent 16a2ccf commit 114f0f4

File tree

6 files changed

+356
-265
lines changed

6 files changed

+356
-265
lines changed

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
.vscode
2+
lk-jwt-service

README.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
# LiveKit Token Management Service
22

3-
This service is currently used for a single reason: generate JWT tokens with a given identity for a given room, so that users can use them to authenticate against LiveKit SFU.
3+
This service is used for two reasons:
4+
- generate JWT tokens with a given LiveKit identity for a given LiveKit room, so that users can use them to authenticate against LiveKit SFU,
5+
- In case of local Matrix users which belong to the same deployment, the corresponding LiveKit room on the SFU will be created if necessary.
46

57
It works by allowing a token obtained via the Matrix Client-Server API [OpenID endpoint](https://spec.matrix.org/v1.13/client-server-api/#openid) to be exchanged for a LiveKit JWT token which can be used to access a LiveKit SFU.
68

79
This functionality is defined by [MSC4195: MatrixRTC using LiveKit backend](https://github.com/matrix-org/matrix-spec-proposals/pull/4195).
810

11+
Only for Matrix users of homeservers belonging to the same deployment (called local users) corresponding rooms on the LiveKit SFU will be automatically created. Hence, local homeservers need to be declared via the `LIVEKIT_FULL_ACCESS_HOMESERVERS` environment variable (see below).
12+
13+
Note access to LiveKit SFU is restricted for remote users (not belonging to the same deployment). Those users can join existing LiveKit SFU rooms, but missing rooms will not be automatically created to prevent misuse of infrastructure. Due to the SFU selection algorithm and the order of events this will NOT limit or prevent video conferences across Matrix federation.
14+
915
## Usage
1016

1117
This service is used when hosting the [Element Call](https://github.com/element-hq/element-call) video conferencing application against a LiveKit backend.
@@ -56,6 +62,13 @@ Variable | Description | Required
5662
`LIVEKIT_SECRET` or `LIVEKIT_SECRET_FROM_FILE` | The secret or secret file path for the LiveKit SFU | Yes
5763
`LIVEKIT_KEY_FILE` | file path to LiveKit SFU key-file format (`APIkey: secret`) | mutually exclusive with `LIVEKIT_KEY` and `LIVEKIT_SECRET`
5864
`LIVEKIT_JWT_PORT` | The port the service listens on | No - defaults to 8080
65+
`LIVEKIT_FULL_ACCESS_HOMESERVERS` | Comma-separated list of Matrix homeservers whose users are authorized with full access to LiveKit SFU features (supports `*` as a wildcard to allow all homeservers) | No - defaults to `*`
66+
67+
Please double check that LiveKit SFU room default settings ([config.yaml](https://github.com/livekit/livekit/blob/7350e9933107ecdea4ada8f8bcb0d6ca78b3f8f7/config-sample.yaml#L170)) are configured as
68+
```
69+
room:
70+
auto_create: false
71+
```
5972

6073
### Reverse Proxy and well-known requirements
6174

go.mod

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ toolchain go1.24.4
77
require (
88
github.com/golang-jwt/jwt/v5 v5.2.2
99
github.com/livekit/protocol v1.34.0
10+
github.com/livekit/server-sdk-go/v2 v2.5.0
1011
github.com/matrix-org/gomatrix v0.0.0-20220926102614-ceba4d9f7530
1112
github.com/matrix-org/gomatrixserverlib v0.0.0-20250619052822-904c8f04597e
1213
)
@@ -17,6 +18,7 @@ require (
1718
cel.dev/expr v0.19.0 // indirect
1819
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
1920
github.com/benbjohnson/clock v1.3.5 // indirect
21+
github.com/bep/debounce v1.2.1 // indirect
2022
github.com/bufbuild/protovalidate-go v0.8.0 // indirect
2123
github.com/cespare/xxhash/v2 v2.3.0 // indirect
2224
github.com/dennwc/iters v1.0.1 // indirect
@@ -26,22 +28,26 @@ require (
2628
github.com/gammazero/deque v1.0.0 // indirect
2729
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
2830
github.com/go-logr/logr v1.4.2 // indirect
31+
github.com/go-logr/stdr v1.2.2 // indirect
2932
github.com/google/cel-go v0.22.1 // indirect
3033
github.com/google/uuid v1.6.0 // indirect
34+
github.com/gorilla/websocket v1.5.3 // indirect
3135
github.com/jxskiss/base62 v1.1.0 // indirect
32-
github.com/klauspost/compress v1.17.9 // indirect
36+
github.com/klauspost/compress v1.17.11 // indirect
3337
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
3438
github.com/kr/pretty v0.3.1 // indirect
3539
github.com/lithammer/shortuuid/v4 v4.2.0 // indirect
3640
github.com/livekit/mageutil v0.0.0-20230125210925-54e8a70427c1 // indirect
41+
github.com/livekit/mediatransportutil v0.0.0-20241220010243-a2bdee945564 // indirect
3742
github.com/livekit/psrpc v0.6.1-0.20250205181828-a0beed2e4126 // indirect
43+
github.com/magefile/mage v1.15.0 // indirect
3844
github.com/matrix-org/util v0.0.0-20221111132719-399730281e66 // indirect
39-
github.com/nats-io/nats.go v1.36.0 // indirect
40-
github.com/nats-io/nkeys v0.4.7 // indirect
45+
github.com/nats-io/nats.go v1.38.0 // indirect
46+
github.com/nats-io/nkeys v0.4.9 // indirect
4147
github.com/nats-io/nuid v1.0.1 // indirect
4248
github.com/pion/datachannel v1.5.10 // indirect
4349
github.com/pion/dtls/v3 v3.0.4 // indirect
44-
github.com/pion/ice/v4 v4.0.5 // indirect
50+
github.com/pion/ice/v4 v4.0.6 // indirect
4551
github.com/pion/interceptor v0.1.39 // indirect
4652
github.com/pion/logging v0.2.3 // indirect
4753
github.com/pion/mdns/v2 v2.0.7 // indirect
@@ -54,7 +60,7 @@ require (
5460
github.com/pion/stun/v3 v3.0.0 // indirect
5561
github.com/pion/transport/v3 v3.0.7 // indirect
5662
github.com/pion/turn/v4 v4.0.0 // indirect
57-
github.com/pion/webrtc/v4 v4.0.8 // indirect
63+
github.com/pion/webrtc/v4 v4.0.9 // indirect
5864
github.com/puzpuzpuz/xsync/v3 v3.5.0 // indirect
5965
github.com/redis/go-redis/v9 v9.7.3 // indirect
6066
github.com/sirupsen/logrus v1.9.3 // indirect
@@ -71,7 +77,7 @@ require (
7177
go.uber.org/zap v1.27.0 // indirect
7278
go.uber.org/zap/exp v0.3.0 // indirect
7379
golang.org/x/crypto v0.38.0 // indirect
74-
golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c // indirect
80+
golang.org/x/exp v0.0.0-20250207012021-f9890c6ad9f3 // indirect
7581
golang.org/x/net v0.40.0 // indirect
7682
golang.org/x/sync v0.14.0 // indirect
7783
golang.org/x/sys v0.33.0 // indirect

0 commit comments

Comments
 (0)