I am using Openfire 4.0.3 for our chat application. My Openfire stop connecting xmpp Android client suddenly. While checking in error log following error found.

org.jivesoftware.openfire.container.PluginManager - /usr/share/openfire/plugins: Too many open files 

This repeated many times in error log. Can you please help me find out why my openfire stop connecting xmpp android client.

I am using Openfire 4.0.3 for our chat application. My Openfire stop connecting xmpp Android client suddenly. While checking in error log following error found.

This error occurring many times in error log file. Openfire stop responding xmpp clients. Xmpp client unable to join chat rooms. Can you please help me out.

Thanks!

We are using Openfire 4.0.1 and we do have chatting functionality from application ios and android.

Issue is openfire user never gets offline from mobile end when user is in foreground your openfire user will be online once you go in background your user in openfire will get offline.

Now Issue is there are some users which never gets offline i have tried to login using other utilities like spark or spark-web and logout user manually still they appear online only in openfire admin console.

We do have push notifications functionality of offline users but some users who never be offline in that case push notification functionality never works!

Is there any way that this user can be forcefully offline.

Any Help would be appreciated.

Hi All,

We encountered one strange issue, that Openfire is not accepting the custom message type (e.g. XYZ) while sending from client end. The issue occurring after we upgraded the OF to 4.1.1 while it was working with 4.0.3.

Is there any changes made in latest openfire version 4.1.1 about message type.

I found on web that openfire does support only these standard message type,

• Message.Type.normal -- (Default) a normal text message used in email like interface.
• Message.Type.chat -- a typically short text message used in line-by-line chat interfaces.
• Message.Type.groupchat -- a chat message sent to a groupchat server for group chats.
• Message.Type.headline -- a text message to be displayed in scrolling marquee displays.
• Message.Type.error -- indicates a messaging error.

For reference : Message.Type (Openfire 3.3.0 Javadoc)

Any help will be appreciated.

Thanks,

AKS

Hallo Zusammen,

nach dem Wochenende kann ich zwar SPARK noch starten, es werden aber die vorhandenen Kontakte nicht angezeigt

Es kommt folgende Fehlermeldung:

at com.exe4j.runtime.WinLauncher$1.run(Unknown Source)

2017.02.08 03:06:27 org.jivesoftware.database.DbConnectionManager - Unable to get a connection from the database pool (attempt 10 out of 10).

java.sql.SQLException: Cannot open database "openfire" requested by the login. The login failed.

Hello,

I have problem with both of these app ( Xabber, Openfire admin) on android. I am unable to connect to the local server. I'll attach screenshot, that's the message i am gettin when i am trying to connect with openfire admin. Also I will attach debug information from server, which i am gettingwhen i try to connect via Xabber.

Hello,

my name ist Thomas and i'm new in this forum.

I had installed Openfire 4.1.1 on Linux Debian Webserver in /opt/openfire.

I can reach the adminpanel here: http://mywebserversip:9090

Here can i administer without problems, create users and rooms, all ist fine and and ok?

Here are my simple questions to understand Openfire:

- How can users reach the chat, login, and discuss, which Port or url is necessary?

  By use of port 522 i get no connection.

  Port 7070 gives out the following (see above)

• /http-bind ---> o.e.j.s.ServletContextHandler@3133bc7a{/http-bind,null,AVAILABLE}
• /crossdomain.xml ---> o.e.j.s.ServletContextHandler@3b9b06d2{/crossdomain.xml,null,AVAILABLE}
• /http-bind ---> o.e.j.s.ServletContextHandler@6424c626{/http-bind,null,AVAILABLE}
• /crossdomain.xml ---> o.e.j.s.ServletContextHandler@2a4d1c27{/crossdomain.xml,null,AVAILABLE}

What does this mean?

- Is openfire now complete or need i some plugins (frontend) aditional too?

- In which directory can i find the css in order to customise my Openfire?

Thank you in advantage

Greetings

Thomas

Background:

When a client loses network connection Openfire may not become aware of this, after all TCP was designed to survive physical connection outtakes, and do not store incoming messages in the Offline storage. So messages in this situation are sent into void and are lost.

Workaround:

Set a system setting in Openfire (Server Settings > Client Connections > Disconnect clients after they have been idle for) to 30 seconds or any other reasonably low value to make this issue appear as rarely as possible. This means that Openfire will disconnect clients that have been idle for 30 seconds and are not responding to ping requests. One can set it even lower, but it can have a side effect: clients disconnecting and reconnecting often.

This is only a workaround and there is still a chance to lose a message in this 30 or so seconds gap.

Stream Management:

Stream Management as defined in XEP-0198: Stream Management is meant to solve message loss because of network problems. Both a client and a server has to support this.

Openfire has a partial support of this since 4.0.0 version: [OF-446] Implement XEP-0198: Stream Management - Jive Software Open Source

Both endpoints of a XMPP stream must support Stream Management, so a client has to support this too. Smack library (which Spark and some other clients are based on) has added support for this recently (4.1.0 version): [SMACK-333] Implement XEP-0198: Stream Management - Jive Software Open Source

There is a ticket to add this functionality to Spark: https://issues.igniterealtime.org/browse/SPARK-1785

Message Delivery Receipts:

Another approach would be to implement XEP-0184: Message Delivery Receipts in a client. This way a client would get a notification that a message hasn't been delivered (or vice versa a notification that a message has been delivered). This is strictly a client side feature, server doesn't have to support this.

Smack already supports this (version 3.3.0): [SMACK-331] Add support for XEP-0184: Message Delivery Receipts - Jive Software Open Source

Spark is using the latest stable Smack version of 4.1 branch, but there is no GUI in Spark for this yet: [SPARK-1238] Add support for XEP-0184: Message Delivery Receipts - Jive Software Open Source

Most modern XMPP clients support Message Delivery Receipts. E.g. Gajim client shows a red cross icon beside a message which hasn't been delivered.

Chat Markers:

Similar to delivery receipts is the newer XEP-0333: Chat Markers which implements special markers for messages (e.g. read, displayed, acknowledged). This XEP is still in the proposal state. But some clients and libraries already support it.

Smack added support for it in the 4.2 branch [SMACK-736] Add support for Chat Markers (XEP-0333) - IgniteRealtime JIRA

Android client Conversations is known to support it also. Spark has an open ticket to add such functionality [SPARK-1834] Add support for XEP-0333 Chat Markers - IgniteRealtime JIRA

I'm trying to seed new XMPP servers with TLS settings, but these don't appear to be loaded.  Does anyone know why?

  <xmpp>

    <socket>

      <ssl>

        <client>

          <certificate>

            <accept-selfsigned>false</accept-selfsigned>

            <verify>

              <validity>true</validity>

            </verify>

          </certificate>

          <ciphersuites>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_25 6_CBC_SHA384,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS _ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WIT H_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_ CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_W ITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_A ES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECD SA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA _WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES _256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GC M_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,T LS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_D HE_RSA_WITH_AES_128_GCM_SHA256,TLS_EMPTY_RENEGOTIATION_INFO_SCSV</ciphersuites>

          <protocols>SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2</protocols>

        </client>

        <certificate>

          <accept-selfsigned>false</accept-selfsigned>

          <verify>

            <validity>true</validity>

          </verify>

        </certificate>

        <ciphersuites>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_25 6_CBC_SHA384,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS _ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WIT H_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_ CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_W ITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_A ES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECD SA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA _WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES _256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_GC M_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,T LS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_D HE_RSA_WITH_AES_128_GCM_SHA256,TLS_EMPTY_RENEGOTIATION_INFO_SCSV</ciphersuites>

        <protocols>SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2</protocols>

      </ssl>

    </socket>

  </xmpp>

What's the correct initial connection numbers of connection manager ? I got 500-600 connections when I started Connection Manager , but there is no clients connecting to the connection manager. After checking the connections, I found there are lots of connections connected by 127.0.0.1, is this right?

Since upgrade to 4.1 many Things about Users,Groups and Rostres have become strange or broken.

Without any Pattern or Regularity any Users on Admin Console shows as Member some Groups.

Above You can see "solonenko" and "surina" as member of many Groups

And next screen as Detail of User Groups:

Actually at the same time the User "solonenko" has no Groups and User "surina" is Member of Groups "hz2" and "omts"

SQL Output:

Your query: select count(*) from ofGroupUser where username like 'so%';

Your response: 

Your query: select * from ofGroupUser where username='surina';

Your response: 

Next restart of Openfire server users, which get wrong Group List today will be changed randomly but users "solonenko" and "surina" will be in right List

Version:	Openfire 4.1.1
Appserver:	jetty/9.2.z-SNAPSHOT
Java Version:	1.8.0_111 Oracle Corporation -- OpenJDK 64-Bit Server VM
OS / Hardware:	Linux / amd64
OS Process Owner:	daemon
Java Memory	1026.81 MB of 1820.50 MB (56.4%) used
Database and Version:	HSQL Database Engine 2.3.4

Java Version:

Hello,

I have a Server Connection - withe the WEB-Admin Concole on openfire I can see all the users I Need within my Company,

but all users have an empty SPARK window.

Could you please help me ? I am moving in circles since yesterday morning and I can not get a clue on it.

best regards,

Axel

Dear colleagues,

I have a jabber environment with next properties.

1. There is MS AD forest with single domain “DN=domain, DN=local”.
2. There is MS CA.
3. Xmpp domain name equals to “domain.local”.
4. There are two openfire servers in cluster with next FQDNs: “server1.domain.local” and “server2.domain.local”.
5. There is balancing based on SRV records in DNS zone.

I look next abnormal situation.

SSL certification subsystem of openfire requires (why?) that certificate has DN with “CN=xmpp_domain_name” not “CN=host_FQDN”, but clients (browsers for admin console, Gajim for messaging) require “CN=host_FQDN” (obviously, it is normal).

I partially solved this problem using certificates have DN with “CN=host_FQDN, CN=xmpp_domain_name”. In this case Openfire servers, browsers, Gajim work fine with SSL.

But Spark says (without ignoring incorrect SSL certificate name option): “Hostname verification of certificate failed”.

It is seem that developers of Openfire and Spark consider, that xmpp_domain_name MUST equals to host_FQDN.

I have a one question: when developers will solve this abnormal situation?

Evgeniy

Openfire uses caches to improve performance. Caches can be configured to hold more or less objects in memory and also the amount of time an object will be kept in memory. Big caches can improve performance but very big caches may decrease it since more memory will be used and Java may have to work hard to make room for other objects in memory. In summary, the proper size of the cache should be estimated for each installation based on the number of concurrent users, the roster size, vCard size, number of groups, etc.

Openfire does not provide the option to configure cache properties from the admin console in an easy way. For now you have to create new system properties in the admin console and set the required value. After changing a cache property you will need to restart the server so that the change is actually used.

These are the names of the properties that you can define and configure. The *.size properties define the max size in bytes the cache may be. The *.maxLifetime defines the default max lifetime of the cache, in milliseconds.?

More caches are defined in http://www.igniterealtime.org/fisheye/browse/svn-org/openfire/trunk/src/java/org /jivesoftware/util/cache/CacheFactory.java?r=trunk

Some values are set in http://fisheye.igniterealtime.org/browse/openfire/trunk/src/java/org/jivesoftwar e/util/cache/DefaultLocalCacheStrategy.java?hb=true

The information below contains the settings for Openfire 3.7.1.

Default values for size is 256 KB and lifetime 6 hours.

Having issues with users currently signed in to Openfire 4.1.2 and Spark 2.8.3.

Here is the situation:

On my Spark client, I see, lets say, 10 users online and a couple away.

However, on Openfire's user summary (http://localhost:9090/user-summary.jsp) the online column shows three online users.

I log out of my Spark client and log back in. Now only those three users appear in my contact list.

If I double-click on a user in the list of offline users that I know is actually online, they get the message. I also get a message that they are offline and will receive it when they are online again.

This is very odd. I did see this once when I cleared all server cache options to try and solve a different issue. But I am not doing that now and am consistently seeing discrepancies in online users.

Couldn't there would be some user "heartbeat" in place to see if someone is still online or not?

Version: Openfire 4.1.1

Click "Group Chat", "Room Administration", "Create New Room"

Click "Cancel"

If the Room ID field is empty it throws

java.lang.NullPointerException

at org.jivesoftware.openfire.admin.muc_002droom_002dedit_002dform_jsp._jspService( muc_002droom_002dedit_002dform_jsp.java:141)

at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)

at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:812)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1669)

at com.opensymphony.module.sitemesh.filter.PageFilter.parsePage(PageFilter.java:11 8)

at com.opensymphony.module.sitemesh.filter.PageFilter.doFilter(PageFilter.java:52)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1652)

at org.jivesoftware.util.LocaleFilter.doFilter(LocaleFilter.java:76)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1652)

at org.jivesoftware.util.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingF ilter.java:53)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1652)

at org.jivesoftware.admin.PluginFilter.doFilter(PluginFilter.java:226)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1652)

at org.jivesoftware.admin.AuthCheckFilter.doFilter(AuthCheckFilter.java:165)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.ja va:1652)

at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)

at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:22 3)

at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:11 27)

at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)

at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185 )

at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:106 1)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandler Collection.java:215)

at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.jav a:110)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)

at org.eclipse.jetty.server.Server.handle(Server.java:499)

at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)

at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)

at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)

at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635 )

at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)

at java.lang.Thread.run(Thread.java:745)

It doesn't seem to matter if any of the other fields are empty or not.

Folks;

upgrading our OpenFire from 4.0.x to 4.1.2 rendered our nagios / sendxmpp integration useless. We use sendxmpp in order to deliver status messages to XMPP recipients / groups, and by now this worked pretty well. Starting with 4.1.2, it doesn't, anymore; sendxmpp just terminates like this:

XML::Stream: Send: (<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>YXV0aHppZD0ia3JAd3d3LnBsYW5jb25uZWN0Lm V1QG9wZW5maXJlMiIsY2hhcnNldD11dGYtOCxjbm9uY2U9Ijg0NmRjZGJlNTMzZmE4ODlmMWMyMGI4Zm ZlN2M0OWVlIixkaWdlc3QtdXJpPSJ4bXBwL29wZW5maXJlMiIsbmM9MDAwMDAwMDEsbm9uY2U9IkNlNG pQR2R2U21ET0k3U0Q3TnR2ZGtjZ3RKbnZxOEZwZ3Blb1dkL3MiLHFvcD1hdXRoLHJlYWxtPSJ3d3cucG xhbmNvbm5lY3QuZXUiLHJlc3BvbnNlPWY1NWM4YzRiOGM0NmExZmZkYWRlNWJlZWZmMTc3ZjhhLHVzZX JuYW1lPSJrckB3d3cucGxhbmNvbm5lY3QuZXUi</response>)

XML::Stream: Process: block(0)

XMPP::Conn: AuthSASL: haven't authed yet... let's wait.

XMPP::Conn: Process: timeout(1)

XML::Stream: Read: buff(<failure xmlns="urn:ietf:params:xml:ns:xmpp-sasl"><not-authorized/></failure>)

XML::Stream: Node: _handle_element: sid(pl3eh5iw0) sax(XML::Stream::Parser=HASH(0x25f4228)) tag(failure) att( xmlns urn:ietf:params:xml:ns:xmpp-sasl )

XML::Stream: Node: _handle_element: check( -1 )

XML::Stream: Node: _handle_element: sid(pl3eh5iw0) sax(XML::Stream::Parser=HASH(0x25f4228)) tag(not-authorized) att( )

XML::Stream: Node: _handle_element: check( 0 )

XML::Stream: Node: _handle_close: sid(pl3eh5iw0) sax(XML::Stream::Parser=HASH(0x25f4228)) tag(not-authorized)

XML::Stream: Node: _handle_close: check( 1 )

XML::Stream: Node: _handle_close: check2( 0 )

XML::Stream: Node: _handle_close: sid(pl3eh5iw0) sax(XML::Stream::Parser=HASH(0x25f4228)) tag(failure)

XML::Stream: Node: _handle_close: check( 0 )

XML::Stream: Node: _handle_close: check2( -1 )

XML::Stream: Process: block(0)

XMPP::Conn: AuthSASL: Authentication failed.

Error 'AuthSend': error: not-authorized[?]

XML::Stream: Send: (</stream:stream>)

XML::Stream: SetCallBacks: tag(node) func(CODE(0x1703a68))

XMPP::Conn: Disconnect: bye bye

sendxmpp: Disconnect

Any ideas? Any hints on which information required to help track this down?

TIA,

K.

I rebooted the Windows server that Openfire runs on and now I Openfire is now throwing errors.  I would appreciate any help on resolving this and getting Openfire back up. I am on 4.1.2 with the embedded Db.

Found old database version 22 for openfire. Upgrading to version 25...

Database update successful.

Openfire 4.1.2 [Feb 23, 2017 10:49:29 AM]

Admin console listening at http://rait-vmw-vc:9090

Successfully loaded plugin 'admin'.

Successfully loaded plugin 'avatarresizer'.

Successfully loaded plugin 'broadcast'.

Successfully loaded plugin 'justmarried'.

Successfully loaded plugin 'clientcontrol'.

Successfully loaded plugin 'motd'.

Successfully loaded plugin 'search'.

Successfully loaded plugin 'subscription'.

Successfully loaded plugin 'userimportexport'.

Successfully loaded plugin 'monitoring'.

Finished processing all plugins.

Error starting 5223: null

Error starting 5276: null

Error starting 5263: null

How to Setup Openfire SSO on Windows Server 2008r2/2012r2 with a Domain level  of 2008r2/2012r2

1. Verified DNS - Must have PTR record for openfire server or SSO will not work.

2. Create a user account that will be used for the keytab.  I used "keytab" in this example. Under account properties, check "This Account Supports Kerberos AES 128 bit encryption"

3. On the domain controller set spn to username 'keytab' and other mappings.

Note: The spn should match what you are using for xmpp.domain.  ie xmpp/xmpp.domain. In this example, xmpp.domain is the fqdn of the server, lab2.lab.local

*case sensitive

setspn -S xmpp/lab2.lab.local@LAB.LOCAL keytab

4. Next use ktpass to set additional information and create keytab file

Note: The -princ  should match what you are using for xmpp.domain. ie -princ xmpp/xmpp.domain. In this example, xmpp.domain is the fqdn of the server, lab2.lab.local

*case sensitive

ktpass -princ xmpp/lab2.lab.local@LAB.LOCAL -mapuser keytab@lab.local -crypto all -pass * -ptype KRB5_NT_PRINCIPAL -out xmpp.keytab (enter same password that you used when you created the keytab user account)

5. On the server running openfire

create krb5.ini and place c:\windows

set the following key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

allowtgtsessionkey reg-dword value 1

6. Copy your keytab created in step 4 (xmpp.keytab) file to openfire/resources

7. Copy/create your gss.conf file in openfire/conf

8. Add the follwing to system properties in openfire

sasl.gssapi.config  C:\Program Files (x86)\Openfire\conf\gss.conf

sasl.gssapi.debug  false

sasl.gssapi.useSubjectCredsOnly  false

sasl.mechs  GSSAPI

sasl.realm  LAB.LOCAL

restart openfire service

9.  Install spark on a workstation.

On workstations make the following registry change

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

reg dword allowtgtsessionkey value 1

10 copy krb5.ini in c:\windows

11. Launch spark and test

Hi,

I've been using Openfire 4.0.2 for a while and I used discovery service to retrieve users full jids with resources by their bare jids.

It's possible to get full jids from presense, but discovery showed results for any user, even those who is not in the roster.

It also showed all users in group chats with their resources. Now it's broken after Openfire update to 4.1.1 and 4.1.2, maybe even earlier.

When i'm requesting disco#items info by user bare jid or by MUC jids there is always exception - XMPPError: item-not-found - cancel.

This happens even if users is in the roster. As soon as i provide resource for user request i receive response.

But than its pointless for me, because i want to use discovery to get resources, like in the XEP-0030 (Examples 14 and 15):

https://xmpp.org/extensions/xep-0030.html

Group chats discovery is broken, because MUC jid do not have resource.

Am i missing something or it's a bug in Openfire?

Here's traces captured on Openfire 4.0.2 when it worked:

Single chat:

<iq to='android02@192.168.17.114' id='Cb87E-826' type='get'>

  <query xmlns='http://jabber.org/protocol/disco#items'/>

</iq>

<iq to='android01@192.168.17.114/a-4b7c5af7-0796-3f8e-a91d-c21997663033' from='android02@192.168.17.114' id='Cb87E-826' type='result'>

  <query xmlns='http://jabber.org/protocol/disco#items'>

  <item jid='android02@192.168.17.114/a-31358406-200b-34c1-a9a6-3cf1fb049003'/>

  </query>

</iq>

Group chat:

<iq to='ab8daded-9465-4442-abfa-918819cd7323@conference.192.168.17.114' id='Cb87E-1412' type='get'>

  <query xmlns='http://jabber.org/protocol/disco#items'/>

</iq>

<iq to='android01@192.168.17.114/a-4b7c5af7-0796-3f8e-a91d-c21997663033' from='ab8daded-9465-4442-abfa-918819cd7323@conference.192.168.17.114' id='Cb87E-1412' type='result'>

  <query xmlns='http://jabber.org/protocol/disco#items'>

  <item jid='ab8daded-9465-4442-abfa-918819cd7323@conference.192.168.17.114/android02@1 92.168.17.114/a-31358406-200b-34c1-a9a6-3cf1fb049003'/>

  <item jid='ab8daded-9465-4442-abfa-918819cd7323@conference.192.168.17.114/android01@1 92.168.17.114/a-4b7c5af7-0796-3f8e-a91d-c21997663033'/>

  </query>

</iq>