aSmack muc.getMembers() Forbidden (403) OPENFIRE

Question

I would like to allow any chat room member to get a list of all of the members. Currently, only users who are moderators may do so. I cannot seem to find where I need to set / change the user privileges to allow for this.

If logged in as a moderator the following code works:

 try {
                Collection<Affiliate> members = muc.getMembers();
                System.out.println(members.size());
            } catch(XMPPException e) {
                e.printStackTrace();
            }

If logged in as a normal member, the above code throws a Forbidden 403 error.

 06-25 19:53:51.198: W/System.err(12943): forbidden(403)
 06-25 19:53:51.208: W/System.err(12943):   at org.jivesoftware.smackx.muc.MultiUserChat.getAffiliatesByAdmin(MultiUserChat.java:1743)
 06-25 19:53:51.208: W/System.err(12943):   at org.jivesoftware.smackx.muc.MultiUserChat.getMembers(MultiUserChat.java:1657)

Any advice would be much appreciated.

Note that a MUC Member is not the same of an entity that joined the room. I guess you want a list of all entities currently in the MUC, correct? — Flow
Hi @Flow, no I would like a list of all MUC members, or a list of all entities to ever be in the MUC. I thought I could achieve the later by registering each new participant as a member when they join, although the above problem ensued. — Michael Rickert

Scott Scott · Accepted Answer · 2013-06-27T23:59:13

Two suggestions:

1) Make sure the user associated with the session used to instantiate the MulitUserChat instance (muc) has sufficient room privileges to get the members list (I think, but am not sure, that the user needs admin privileges for the room)

2) If 1 is sufficiently handled make sure you are calling SmackAndroid.init(Context context)

hope this helps!

-- with regard to your last comment --

I apologize from losing sight of the original question. You are correct, both functions can only be called by an admin user. There is no way (that I am aware of) to have a member gain admin privileges without the consent of an admin user. After a bit more consideration, I concluded that this is a poor solution anyway as granting admin privileges to all users compromises the security of your chat room. Fortunately, there is a better solution(it is a bit more involved):

You can create a plugin (http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/plugin-dev-guide.html) that uses the botz library (http://community.igniterealtime.org/docs/DOC-1130#comment-5601). Upon creation of a muc room grant the bot admin privileges to the room. When a user needs to pull down the members list, the user should send the query to the bot, the bot should query the room and relay the results to the user. This design preserves the security of your room and, aside from being fun, botz can be useful beyond this purpose. -- I hope this helps

aSmack muc.getMembers() Forbidden (403) OPENFIRE

1 Answers