aSmack muc.getMembers() Forbidden (403) OPENFIRE

Question

I would like to allow any chat room member to get a list of all of the members. Currently, only users who are moderators may do so. I cannot seem to find where I need to set / change the user privileges to allow for this.

If logged in as a moderator the following code works:

 try {
                Collection<Affiliate> members = muc.getMembers();
                System.out.println(members.size());
            } catch(XMPPException e) {
                e.printStackTrace();
            }

If logged in as a normal member, the above code throws a Forbidden 403 error.

 06-25 19:53:51.198: W/System.err(12943): forbidden(403)
 06-25 19:53:51.208: W/System.err(12943):   at org.jivesoftware.smackx.muc.MultiUserChat.getAffiliatesByAdmin(MultiUserChat.java:1743)
 06-25 19:53:51.208: W/System.err(12943):   at org.jivesoftware.smackx.muc.MultiUserChat.getMembers(MultiUserChat.java:1657)

Any advice would be much appreciated.

Answer 1

Two suggestions:

1) Make sure the user associated with the session used to instantiate the MulitUserChat instance (muc) has sufficient room privileges to get the members list (I think, but am not sure, that the user needs admin privileges for the room)

2) If 1 is sufficiently handled make sure you are calling SmackAndroid.init(Context context)

hope this helps!

-- with regard to your last comment --

I apologize from losing sight of the original question. You are correct, both functions can only be called by an admin user. There is no way (that I am aware of) to have a member gain admin privileges without the consent of an admin user. After a bit more consideration, I concluded that this is a poor solution anyway as granting admin privileges to all users compromises the security of your chat room. Fortunately, there is a better solution(it is a bit more involved):

You can create a plugin (http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/plugin-dev-guide.html) that uses the botz library (http://community.igniterealtime.org/docs/DOC-1130#comment-5601). Upon creation of a muc room grant the bot admin privileges to the room. When a user needs to pull down the members list, the user should send the query to the bot, the bot should query the room and relay the results to the user. This design preserves the security of your room and, aside from being fun, botz can be useful beyond this purpose. -- I hope this helps