jitsi-saml2jwt allows wildcard-scoped JWTs

[micolous]

Jitsi Meet uses two non-standard claims to scope a JWT:

• sub: which contains either a tenant identifier, domain, or * (allow all)
• room: which contains a room name or * (allow all)

getToken.php can call two different implementations of the token generator. These both pass $_REQUEST into the generator here:

Jitsi-SAML2JWT/src/services/getToken.php

Line 15 in 5a38452

$jsonResp = $tokenGenerator->getToken($_SERVER,$_REQUEST);

AdvancedTokenGenerator conditionally sets sub based on $_REQUEST["tenant"] here:

Jitsi-SAML2JWT/src/classes/AdvancedTokenGenerator.class.php

Lines 71 to 72 in 5a38452

	if (array_key_exists('tenant',$requestData))
	$tenant=rtrim($requestData['tenant'],"/");

TokenGenerator conditionally sets sub based on $_REQUEST["tenant"] here:

Jitsi-SAML2JWT/src/classes/TokenGenerator.class.php

Lines 50 to 51 in 5a38452

	if (array_key_exists('tenant',$requestData))
	$tenant=rtrim($requestData['tenant'],"/");

In both cases, when $_REQUEST["tenant"] is unset, it falls back to jitsi_domain.

However, because the tenant query parameter is under client control, it could set it to tenant=*. jitsi-saml2jwt will then issue a JWT with wildcard sub which may be accepted by multiple Jitsi instances.

This part I don't fully understand, but AdvancedTokenGenerator appears to perform some other checks to see if it is a valid room, but they only check for the presence of the room name in the debug output somewhere; but emailValidConference will return true if room=* or if tenant != private.