How to fully integrate XMPP on a web site with registered users

We (superfeedr) have a similar web app where XMPP is part of the application.

The choice we made is to not replicate the user data accross both the web app storage and the XMPP server. You can build your own authentication mechanism using the web app's data store with ejabberd, it's pretty easy. This way, you only have 1 single place where user data is stored and don't have to create ejabberd users.

By doing this, you can also login your users on the web app without knowing their password or even storing it in clear :) . The easy way is to do the session authentication (via Bosh) on the server and pass on the session id to the HTML response, as described here, by @metajack.

The 3rd part might be the trickiest, but i'm actually quite sure you can bypass this and not use the built-in "rosters"... however it may involve creating your very own component (internal or external).

Alright, here's what we did:

1) Instead of custom authentication/external authentication, we create user accounts on XMPP after a user registers.

2) The answer to this one is session attachment as Julien pointed out. We created a PHP script that would create the session and return the session ID and RID. Called through AJAX on login of user (after the document is ready).

3) As I said on a comment on Julien's post, we used mod_admin_extra. We coupled with mod_rest (w/c allows you to send stanzas/run commands REST style) to create the rosters. There is an *add_rosteritem* command on mod_admin_extra that gets called every time users create contacts on our web site.