The mod_auth_ldap2 override redeclares VirtualHost "meet.jitsi" with
authentication = "ldap2". It was staged whenever LDAP was enabled, also
with SSO, where JITSI_AUTH_TYPE is internal and ENABLE_AUTH is false:
the web client then logs in anonymously, Prosody offers no matching
mechanism, and every conference join fails with
"connfail[no-auth-mech]" and reloads every 17 seconds. The role's own
spec only reaches the prejoin lobby, so it never noticed.
The override is now staged only when JITSI_AUTH_TYPE is ldap, and an
override left by an earlier deploy is removed otherwise.
Found by the new Matrix Jitsi spec against the shared Jitsi (#1165).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Adds the four-container Jitsi Meet stack (web, prosody, jicofo, jvb) with a
3-variant matrix: V1 oauth2-proxy gate + Keycloak LDAP federation, V2
no-auth anonymous, V3 direct prosody mod_auth_ldap2 against svc-db-openldap.
Auth model is oauth2-proxy at the reverse proxy because Jitsi has no
native OIDC adapter — JWT-via-Keycloak would require a custom token
server outside this repo. The role injects a fixed-position
`[data-injected-logout]` button via templates/javascript.js.j2 so the
no-built-in-logout React SPA satisfies the persona contract's
no-direct-URL logout rule. V2/V3 declare PERSONA_BIBER_BLOCKED /
PERSONA_ADMINISTRATOR_BLOCKED because the shared persona helpers only
model the OIDC redirect chain.
Final FULL-matrix `mode=reinstall full_cycle=true` run green across all
three variants (V1: 6/6 pass, V2/V3: 2 pass + 4 blocked skips).
Also lands utils/parse_trace.py — a small zipfile helper used during
the iteration to extract URL traces from playwright .trace bundles.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5