diff --git a/docs/source/02-01-required-configuration.md b/docs/source/02-01-required-configuration.md index be1e1d0b2..a4a26b73d 100644 --- a/docs/source/02-01-required-configuration.md +++ b/docs/source/02-01-required-configuration.md @@ -81,4 +81,4 @@ TALK_JWT_SECRET=jX9y8G2ApcVLwyL{$6s3 Be default, we sign our tokens with HMAC using a SHA-256 hash algorithm. If you want to change the signing algorithm, or use multiple signing/verifying keys, -refer to our [Advanced Configuration](/talk/advanced-configuration/) documentation. +refer to our [Advanced Configuration](/talk/advanced-configuration/#talk-jwt-secret) documentation. diff --git a/docs/source/integrating/authentication.md b/docs/source/integrating/authentication.md index 5b19768fe..77315a9d8 100644 --- a/docs/source/integrating/authentication.md +++ b/docs/source/integrating/authentication.md @@ -25,9 +25,10 @@ state (you don't use the auth anywhere else now). A great example of this is our You can integrate Talk with any authentication service to enable single sign-on for users. The steps to do that are: -1. Create a service that generates [JWT tokens](https://jwt.io). +1. Create a service that generates [JWT tokens](https://jwt.io/introduction/). 2. Push the token into the embed. -3. Implement the `tokenUserNotFound` hook to process the token. +3. Implement the [`tokenUserNotFound`](#implement-tokenusernotfound) hook to + process the token. ### Create JWT Token @@ -39,7 +40,20 @@ Using that demo application, you'll see how you can: 1. Create a node application that can issue JWT's that are compatible with Talk. 2. Provide a validation endpoint that can be used by Talk to validate the token - and get the user via the `tokenUserNotFound` hook. + and get the user via the [`tokenUserNotFound`](#implement-tokenusernotfound) + hook. + +It's also important to note a few requirements for proper integration with Talk. +The generated JWT must contain the following claims: + +- [`jti`](https://tools.ietf.org/html/rfc7519#section-4.1.7): a unique identifier for the token (like a uuid/v4) +- [`exp`](https://tools.ietf.org/html/rfc7519#section-4.1.4): the expiry date of the token as a unix timestamp +- [`sub`](https://tools.ietf.org/html/rfc7519#section-4.1.2): the user identifier that can be used to lookup the user in the mongo + database + - The user may not yet exist in the database, but that's the responsibility + of the [`tokenUserNotFound`](#implement-tokenusernotfound) hook. +- [`iss`](https://tools.ietf.org/html/rfc7519#section-4.1.1): the issuer for the token must match the value of `TALK_JWT_ISSUER` +- [`aud`](https://tools.ietf.org/html/rfc7519#section-4.1.3): the audience for the token must match the value of `TALK_JWT_AUDIENCE` ### Push token into embed @@ -47,7 +61,8 @@ We're assuming that your CMS is capable of authenticating a user account, or at least having the user's details available to send off to the token creation service we created/used in the previous step. -Using the token that was created for the user, you simply have to ammend the template where Talk is rendering to read as the following: +Using the token that was created for the user, you simply have to amend the +template where Talk is rendering to read as the following: ```js Coral.Talk.render(document.getElementById('coralStreamEmbed'), { @@ -72,12 +87,12 @@ example issuer and Talk must match: | Talk | Token Issuer Example | |------|----------------------| -|`JWT_ISSUER`|`JWT_ISSUER`| -|`JWT_AUDIENCE`|`JWT_AUDIENCE`| -|`SECRET`|`JWT_SECRET`*| +|[`TALK_JWT_ISSUER`](/talk/advanced-configuration/#talk-jwt-issuer)|`JWT_ISSUER`| +|[`TALK_JWT_AUDIENCE`](/talk/advanced-configuration/#talk-jwt-audience)|`JWT_AUDIENCE`| +|[`TALK_JWT_SECRET`](/talk/advanced-configuration/#talk-jwt-secret)|`JWT_SECRET`*| \* Note that secrets is a pretty complex topic, refer to the -[TALK-JWT-SECRET](/talk/advanced-configuration/#TALK-JWT-SECRET) configuration +[TALK_JWT_SECRET](/talk/advanced-configuration/#talk-jwt-secret) configuration reference, the basic takeaway is that the secret used to sign the tokens issued by the issuer must be able to be verified by Talk. diff --git a/docs/themes/coral/source/css/talk.scss b/docs/themes/coral/source/css/talk.scss index afbd6f3af..f3b0c24e8 100644 --- a/docs/themes/coral/source/css/talk.scss +++ b/docs/themes/coral/source/css/talk.scss @@ -291,11 +291,10 @@ pre { .content { article { - p a:not(.plain-link) { - @extend .coral-link; - } + p a:not(.plain-link), ul:not(.toc__menu) li a, ol li a, + td a, dd > a { @extend .coral-link; } diff --git a/locales/en.yml b/locales/en.yml index 534593679..950f4bbd2 100644 --- a/locales/en.yml +++ b/locales/en.yml @@ -227,6 +227,7 @@ en: embedlink: copy: "Copy to Clipboard" error: + AUTHENTICATION: "An error occurred trying to authenticate your account." PASSWORD_INCORRECT: "Your current password was entered incorrectly" COMMENT_PARENT_NOT_VISIBLE: "The comment that you're replying to has been removed or doesn't exist." EMAIL_VERIFICATION_TOKEN_INVALID: "Email verification token is invalid." diff --git a/plugins/talk-plugin-ignore-user/client/translations.yml b/plugins/talk-plugin-ignore-user/client/translations.yml index 84a4ca11c..fdf2b1daf 100644 --- a/plugins/talk-plugin-ignore-user/client/translations.yml +++ b/plugins/talk-plugin-ignore-user/client/translations.yml @@ -39,6 +39,7 @@ en: confirmation_title: Ignore {0}? de: talk-plugin-ignore-user: + blank_info: Sie ignorieren derzeit keine Nutzer section_title: Ignorierte Nutzer section_info: Weil Sie die folgenden Nutzer ignorieren, sind deren Kommentare versteckt. stop_ignoring: Ignorieren beenden diff --git a/plugins/talk-plugin-local-auth/client/components/ChangePassword.js b/plugins/talk-plugin-local-auth/client/components/ChangePassword.js index 010df0826..cae112203 100644 --- a/plugins/talk-plugin-local-auth/client/components/ChangePassword.js +++ b/plugins/talk-plugin-local-auth/client/components/ChangePassword.js @@ -185,7 +185,7 @@ class ChangePassword extends React.Component { > . <%= t('email.password_reset.if_you_did') %> <%= t('email.password_reset.please_click') %>: +<%= t('email.password_reset.we_received_a_request') %> <%= t('email.password_reset.if_you_did') %> <%= t('email.password_reset.please_click') %>: <%= BASE_URL %>account/password/reset#<%= token %>