Web Admin add roster item does not work

Open
#4,610 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Quiet
Tech stack
erlang
Domain
authorization, backend

Research direction

Start with the Web Admin roster-item add/modify flow and the access_rules_unauthorized response, then inspect the logged ejabberd_web_admin:process2/2 path. Reproduce the roster operation through the stated nginx setup and verify that an authorized admin can complete it without the bad-password or authorization error.

Written by the indexing model from the issue text.

Description

Environment

  • ejabberd version: 26.7.18
  • Erlang version: erl +V Erlang (SMP,ASYNC_THREADS) (BEAM) emulator version 16.4.0.4
  • OS: Linux (Debian) CentOS 7
  • Installed from: official binary installer

Configuration (only if needed): grep -Ev '^$|^\s*#' ejabberd.yml

listen:
  - ip: "::"
    port: 36781
    module: ejabberd_http
    request_handlers:
      "/.well-known/xmpp-provider-v2.json": mod_providers
      "/xmpp/ws": ejabberd_http_ws
      "/xmpp/chat": mod_conversejs
      "/xmpp/admin": ejabberd_web_admin
      "/xmpp/invites": mod_invites
      "/xmpp/share": mod_http_fileserver
api_permissions:
  "webadmin commands":
    from:
      - ejabberd_web_admin
    who:
      - access:
        - allow:
          - acl: admin
    what: 
      - "*"
      - "!stop"
      - "!start"
acl:
  admin:
    user:
      - "admin@xmpp.domain"

Errors from error.log/crash.log

2026-08-21 10:29:28.032003+02:00 [warning] <0.1058.0>@ejabberd_web_admin:process2/2:195 Access of <<"admin@xmpp.domain">> from <<"92.209.159.244">> failed with error: <<"bad-password">>

No errors

Bug description

I'm using an nginx Proxy ( Uberspace Backend ) to access the port 36781
The Basic Auth login with the admin account works fine and I can navigate in the Web Admin. But when I try to add/modify a Roster Item for a user I see the error:
Error: access_rules_unauthorized in the Web admin page and the corresponding log entry mentioned above.

It has worked in the past. What could be wrong here?

Dominant language
Erlang
Stars
6.7k
Forks
1.6k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from processone/ejabberd

All issues in processone/ejabberd

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.