Jitsi Meet controls who can start a meeting through a small set of authentication methods rather than a single built-in login system. Which one fits your deployment depends on whether you already run a directory service, want a lightweight token-based gate, or need to plug into an existing SSO provider.
What Is Jitsi Authentication?
Jitsi authentication restricts room creation, not room access. In every method below, only an authenticated user can open a new conference; once the room exists, guests can still join anonymously from a separate domain unless you lock that down separately. Jitsi Meet's core supports three methods out of the box - Secure Domain, JWT (token), and LDAP - and SSO/OIDC is added on top by combining JWT with an external identity provider.
Secure Domain Authentication (Deprecated)
No longer recommended
The official Jitsi Meet handbook explicitly marks Secure Domain as deprecated: "This method of authentication is deprecated and should not be used in new installations. It is recommended to use JWT authentication instead."
Secure Domain was the original approach: Prosody is configured with hashed-password authentication, Jicofo restricts room creation to that authenticated domain, and an anonymous guest domain handles everyone else. Users are registered directly with prosodyctl. It still works on existing installs, but new deployments should use JWT instead.
JWT (JSON Web Token) Authentication
JWT is the method the Jitsi project now recommends. Prosody's virtual host config sets authentication = "token" and is given an app_id and app_secret, installed via the jitsi-meet-tokens package, with the token_verification module enabled on the conference component. config.js points anonymous users to a separate anonymousdomain. Jicofo itself needs no configuration changes - authentication stays disabled there when token auth is active. Only a request carrying a valid, signed token can create a room; everyone else can join an existing one from the anonymous domain.
For a full setup walkthrough, see our guides on integrating JWT with Jitsi Meet and generating a JWT token.
LDAP Authentication
Jitsi Meet can also authenticate against an existing directory service, though the official documentation still labels this a first draft that might not work on every system. It's been verified on Debian 11 (Prosody 0.11) against OpenLDAP, and on Ubuntu 24.04 (Prosody 0.12) against Active Directory. Setup involves installing Cyrus SASL and Prosody's mod_auth_cyrus module, pointing /etc/saslauthd.conf at your LDAP server, and adding the prosody user to the sasl group so it can reach the SASL socket. If you're authenticating against Samba or Microsoft AD, expect to adjust the LDAP filter to match your schema.
SSO and OIDC Through an Identity Provider
Jitsi Meet has no native OIDC or SAML module. Single sign-on is achieved by pairing JWT authentication with an external identity provider: the IdP handles the actual OIDC/SAML login, then issues the signed JWT that Prosody verifies. Keycloak and Auth0 are the two most common choices for this. We cover a full Keycloak-based setup in adding SSO to Jitsi Meet with Keycloak, and compare identity providers in Keycloak vs Auth0 if you're still choosing one. Authentik is another self-hosted option worth a look - see our Authentik on AWS guide.
Which Method Should You Use?
| Method | Status | Best for |
|---|---|---|
| JWT (Token) | Recommended | New deployments, app-controlled room creation |
| Secure Domain | Deprecated | Existing installs only - migrate to JWT |
| LDAP | First draft | Organizations with an existing OpenLDAP/AD directory |
| SSO / OIDC | Via JWT + IdP | Teams already on Keycloak, Auth0, or Authentik |
Frequently Asked Questions
What is Jitsi authentication?
Jitsi authentication controls who can create a conference room on your Jitsi Meet instance. Jitsi Meet ships with three built-in methods: Secure Domain, JWT (token), and LDAP, plus SSO/OIDC when paired with an external identity provider.
Is Secure Domain authentication still recommended for Jitsi Meet?
No. The official Jitsi Meet handbook marks Secure Domain as deprecated and recommends JWT authentication for all new installations instead.
How does JWT authentication work in Jitsi Meet?
Prosody is set to authentication = "token" with an app_id and app_secret from the jitsi-meet-tokens package. Only requests carrying a valid signed token can create a room; Jicofo needs no changes.
Does Jitsi Meet support LDAP authentication?
Yes, though the official docs describe it as a first draft. It has been tested on Debian 11 with OpenLDAP and Ubuntu 24.04 with Active Directory, using Cyrus SASL and Prosody's mod_auth_cyrus module.
Can I set up SSO or OIDC login for Jitsi Meet?
There's no built-in OIDC module. SSO is implemented by pairing JWT authentication with an identity provider such as Keycloak or Auth0, which issues the token after the user logs in via SAML or OIDC.
