Openfire is a real time collaboration (RTC) server supporting XMPP (Jabber) and WebRTC.

Quick upgrade

yum --enablerepo=clearos-contribs-testing install app-openfire

yum --enablerepo=clearos-contribs-testing upgrade openfire app-openfire

Quick install

yum --enablerepo=clearos-contribs-testing install app-openfire

Detailed Install

Assumptions

• This guide assumes your ClearOS server will be the main server for your domain. Thus, your website (powered by Tiki, which includes the ConverseJS XMPP client) will be on the same server. E-mails could also be handled (with Roundcube on ClearOS) but are also easily handled by your domain name provider.

Information

To Install Openfire 4.x on ClearOS 7.x within the WikiSuite environment follow the next steps.

1.- Install a fresh ClearOS Server, be sure to run the latest Software updates to the core system

2.- Make sure the clearos-epel repository is enabled

3- Include in the installation of:

a. The Web Server

Configure domain name

How to set domain name on ClearOS

Install Openfire

1.-Login to your ClearOS via SSH using root

2.-Install the Openfire app

Type:

yum --enablerepo=clearos-contribs-testing install app-openfire

Go to "Server / Communication and Collaboration / Openfire' in the menu (https://yourserver.wikisuite.org:81/app/openfire):

Configure OpenLDAP

1.-Click "Install and Initialize Built-in Directory" (Grab a coffee, this will take several minutes)
1.-Initialize your OpenLDAP service through the Webconfig-Open LDAP Directory Server Module (https://yourserver.wikisuite.org:81/app/openldap_directory).

2.-On the Directory Server Settings page set the server mode and Base Domain (https://yourserver.wikisuite.org:81/app/openldap_directory/settings/edit)

3.-On the Directory Server Policies page set the Publish Policy and Accounts access according to your requirements (https://yourserver.wikisuite.org:81/app/openldap_directory/policies/edit)

4.-Don't forget to create one or two users as they will be used in the Openfire configuration phase. Use: (https://yourserver.wikisuite.org:81/app/users/add)

Configure SSL certificates / Let's Encrypt

Go to "Server / Communication and Collaboration / Openfire' in the menu (https://yourserver.wikisuite.org:81/app/openfire):

- Click "Configure security Certificates" to use a self-signed certificate.
- (TODO: Document what happens when Letsencrypt is enabled : http://wikisuite.org/How-to-install-Let-s-Encrypt-SSL-certificates-on-ClearOS)

Configure Firewall

The Openfire app will take care of opening the following ports:

However, you will probably want to open more than those. ClearOS's Firewall should configured to block all ports, and open the following:

Notes:

• Ports 7070 and 9090 are used for plain HTTP traffic. Each have a more secure HTTPS counterpart: 7443 and 9091 respectively. Consider disabling the HTTP ports, which could hurt interoperability and performance., but will increase security.
• An earlier draft of this page listed ports 5229 and 5349 (for Openfire). There is no known application for these ports. Where they included by mistake?

Configure Openfire

WARNING: 2018-03-12: In openfire 4.2.2, plugins don't upgrade properly: apparently fixed in 4.2.3 (https://issues.igniterealtime.org/browse/OF-1464), which isn't released as of this writing

1.- Use a web browser to connect to the admin console. The default port for the web-based Initial setup admin console is 9090 (9091 for https). Initial setup and administration can be done from a remote computer using LAN IP address instead or hostname if it is resolvable by the remote computer. i.e. (https://yourserver.wikisuite.org:9090). The link is provided in the Openfire app for ClearOS.

Source: http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/install-guide.html

Install and configure Openfire Plugins

The Openfire app for Clearos will have already installed and done basic setup of the following plugins:

• Openfire Meetings Plugin
• Openfire Fastpath plugin

Configure Openfire Meetings Plugin

1.- For security, Openfire Meetings Plugin creates an user focus. You need to create this user focus in ClearOS (https://yourserver.wikisuite.org:81/app/users). Then , go back in Openfire Meeting plugin tab, click on Setting in left menu and Security section for change the password for same that a ClearOS User's Focus.

Source: http://www.igniterealtime.org/projects/openfire/plugins/ofmeet/readme.html

Configure Openfire Fastpath plugin

1.- Once the plugin has been successfully installed, the Fastpath tab should be available, click on it to configure Workgroups (https://yourserver.wikisuite.org:9091/plugins/fastpath/workgroup-summary.jsp)

Notes:

• You can find a Quick start guide here: http://wikisuite.org/Fastpath

• The snippet is provided on the Openfire Admin Console (Fastpath -> Workgroup Manager -> Workgroup Settings -> Text)

• jivelive.jsp is available on https://example.org:9091/webchat/jivelive.jsp - perhaps you'll need to edit the snippet above, if you're redirecting access to that resource through a reversed proxy.

• There's a simple landing page here: https://example.org:9091/webchat/

Install additional Openfire plugins

1.- Login to your Openfire Admin Console with a administrator user.

2.- Click on the Plugins Tab to manage Plugins

3.- Click on the available plugins link and scroll down to find the plugin you want

4.- Click on then ¨+¨ to add the plugin to the Openfire server

Add more Openfire admins

Currently, the Openfire clearos app only allows adding one admin user. As of this writing (2017-03-14), it will even clobber all other admins except the newly selected one if you change it.

To add more admins, you need to go into the Openfire admin interface, and in

Server / Server Manager / System Properties edit property "admin.authorizedJIDs". It takes a coma-separated list of fully qualified Openfire users.

To add more admin users,

Configure Tiki, ConverseJS and OpenFire

To get a transparent authentication between ConverseJS and Openfire, we need
to configure Tiki and install the TikiToken plugin (https://github.com/fabiomontefuscolo/openfire-tikitoken/) in OpenFire.

1 - The Tiki Token plugin is now shipping as an optional plugin in Openfire 4.1.5 Just activate as you would for any Openfire plugin. (You may also find more recent snapshots at Download the latest tikitoken.jar at https://github.com/fabiomontefuscolo/openfire-tikitoken/releases)

2 - Go to server properties page at http://yourserver.wikisuite.org:9090/server-properties.jsp
and setup a new property with name org.tiki.tikitoken.baseUrl and property
value will be your tiki base url, let's suppose http://tiki.wikisuite.org.

3 - Configure Tiki to talk to OpenFire. Go to community page on admin panels (RTC page on Tiki 19+), select the XMPP tab,
and:

• Check the XMPP client (ConverseJS)
• On XMPP server host field, type yourserver.wikisuite.org
• On XMPP http-bind url field, type https://yourserver.wikisuite.org:7070/http-bind/
• Check XMPP Openfire Token
• Click on Apply

4 - Still on Tiki, go to "Admin Modules" panel (http://tiki.wikisuite.org/tiki-admin_modules.php);

5 - Click on "All modules" tab;

6 - On field Filter type xmpp;

7 - Drag the result to bottom of page, in the closest gray bordered box;

8 - Just save the popup will appear;

9 - Refresh the page to see the box at the bottom of the page;

Additional configuration

Configure email

Going to https://yourserver.demo.wikisuite.org/webmail to access to Roundcube, then login with your username and password.

In ClearOS

You can to set the options about to sending the emails

https://example.org:81/app/smtp

You can to set the options about to getting the emails

https://example.org:81/app/imap

In Openfire

Edit the email setting in a server manager tab like on an image:
https://example.org:9091/system-email.jsp

Edit the email listener in a Meeting tab like on an image:
https://example.org:9091/plugins/ofmeet/ofmeet-email-listener.jsp

Adding admins

1.-There is no ClearOS group for the Openfire admins. Instead: Server -> Server Manager -> System Properties -> admin.authorizedJIDs

Edit server properties (https://yourserver.wikisuite.org:9091/server-properties.jsp)

2.- Find the admin.authorizedJIDs property, edit it and add comma separated full JIDs. In our specific case user at example.org. "Click on Save Property"

3.- Openfire needs a restart, Login to your ClearOS via SSH using root and type:

service openfire restart

Configure SSL

(This section is likely mostly superceded by SSL section above)

As of Openfire 3.2 certificate management can be performed from the Admin Console. (And in 4.0, code has been revamped)

Once the setup process is completed Openfire will create self-signed certificates for the assigned Openfire's domain. Most users should either get the created certificates signed by a Certificate Authority or replace the created certificates with your own certificates. Source: http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/ssl-guide.html

• You can access the certificate store at: https://yourserver.wikisuite.org:9091/security-certificate-store-management.jsp

• Manage the existing certificates in the Openfire Identity Certificate Store

• Import Private Key and Certificate

As ClearOS also manages SSL certificates, they can co-exist independently as their storage files are different and independent. i.e. Openfire generated certificates will only be used within Openfire applications.

Avoiding non-standard ports

In some contexts, (corporate environments, captive portals in Internet cafes, etc.), some ports can be blocked. Thus, if you want to get rid of port number, you can put the following apache configuration (Apache 2.4+ so you need ClearOS 7.x):

ProxyPass /ofmeet/ http://localhost:7070/ofmeet/
ProxyPassReverse /ofmeet/ http://localhost:7070/ofmeet/
ProxyPass /ofmeetws/ wss://localhost:7070/ofmeetws/
ProxyPassReverse /ofmeetws/ wss://localhost:7070/ofmeetws/

Team room

To create a private room

Go on "Group Chat" tab.

Then going to "create new room" on left menu.

Then fill out the appropriate fields (Minimum Room ID, Room Name and Description). Finish with click on save changes button.

For use the private room

Note: This will be replaced by ConverseJS

• Web access with CandyChat

Go on https://example.org:7443/ofmeet/candy.html
then login with your account access.

• WebRTC access

With https://example.org:7443/ofmeet/ (from which you can pick a room)

• XMPP client access

with Spark in a login session, click on "Action" tab then a "joint a chatroom" option. In a new pop up, double-click in a list on a right chatroom.
with Jitsi in a login session, click on "File" tab then a "joint a chatroom" option. In a new pop up, select a right account and write a chatroom name.

Remote Control of Keyboard and Mouse

Note: This is not yet functional
This requires users install an app on their desktop (Windows / GNU/Linux / MacOSX) and to have the Openfire plugin for Chrome plugin.

How to use

• You as the person who is actively sharing a screen can select the panel of a participant on the film strip. If video is NOT working, you will not get any video panels. If you do, then you can select any and then click on remote control icon. The person on the other end will be notified that they have control of your desktop
• You as a participant can request for remote control of an active screenshare from the desktop owner by clicking on the remote control icon. The owner will receive a popup windows requesting an accept or decline. If request is accepted, then remote control will be given

STUN / TURN server

• Todo later Marc: discuss with Dele (What / How to install and what ports to open)

Advanced configuration

• If your XMPP server is not on the same server as your website, and you want to support (typically older) XMPP clients which don't support SRV records, you will need something like http://sourceforge.net/p/penloadbalancer/wiki/penctl.1/

Linking workaround

Specially when using any RedHat 7 based distribution, Java shiped in RPM has not all the required symbols. You must do this workaround.

yum install java-1.7.0-openjdk java-1.7.0-openjdk-devel
cd /opt/openfire
mv jre jre.1
ln -s /usr/lib/jvm/java/jre/ jre

Pade

https://github.com/igniterealtime/Pade

Server: example.org:7443
Domain: example.org

Todo: Make sure these installation instructions provide great security

• Secure by default. Remove all http and force https
• Ref: http://wiki.xmpp.org/web/Securing_XMPP#Openfire
• Not like this:
• Verify that documenting leads to respecting Public Statement Regarding Ubiquitous Encryption on the XMPP Network

Related links

• http://igniterealtime.org/projects/openfire/documentation.jsp
• https://www.clearos.com/clearfoundation/social/community/how-to-install-openfire-3-7-1-on-cos-6-3-64bit-manual-install
• http://rtcquickstart.org/guide/RTCQuickStartGuide.pdf
• How to install Spark

Souce code

Troubleshooting

Changing Openfire configuration when you can't login to the system database

Openfire stores its configuration in the database. On ClearOS, that is the system database.

Getting into the ClearOS system database can be a little confusing the first time. ClearOS typically runs two database servers. You will need the system database root password, and to connect to a non-default socket. Here is how:

cat /var/clearos/system_database/reports
mysql -u root openfire -p --socket /var/lib/system-mysql/mysql.sock

You can then edit the Openfire configuration, which is stored in the ofProperty table. (SELECT * FROM `ofProperty`)

One change you are likely to want to make during debugging is to enable ldap debugging

INSERT INTO `openfire`.`ofProperty` (`name`, `propValue`, `encrypted`) VALUES ('log.debug.enabled', 'true', NULL);
exit
service openfire restart
tail -f /var/log/openfire/debug.log

Useful references:
* Openfire LDAP guide
* ClearOS: Re-initialize your LDAP directory

It used to work, but just lost access when I installed the Directory app.

The problem is most likely that your base domain changed.

OpenLdap on base ClearOs creates domains of the form:

dc=system,dc=lan

Unfortunately, if you install the clear os directory app AFTER Openfire, your base domain is likely to change. It's going to be:
If "Base Domain" is your.domain.name,
your base DN will be:
dc=your,dc=domain,dc=name

Openfire will not update its configuration automatically. You'll have to update the following ofProperty in Openfire's database
* ldap.baseDN (as is)
* ldap.searchFilter (modify the value in the parenthesis as appropriate)

Testing OpenLDAP from the command line

This should work:

ldapsearch -x -h localhost -b 'dc=your,dc=domain,dc=name' 'uid=your_openfire_admin_user'

If the above does not return your user, logging into the Openfire admin console will NOT work.

This may help diagnose:

ldapsearch -x -h localhost

Should list all users. If you don't see yours, something is really wrong with your ldap configuration.

• How to install and Configure Openfire Meetings on ClearOS