43 Commits (45f45404de2d0c4d68954eddc2dc905e50dfafe9)

Author	SHA1	Message	Date
Patrick Cloke	10a88ba91c	Use auto_attribs/native type hints for attrs classes. (#11692)	3 years ago
Olivier Wilkinson (reivilibre)	4dd9ea8f4f	Revert "Revert accidental fast-forward merge from v1.49.0rc1" ... This reverts commit 158d73ebdd.	3 years ago
Sean Quah	158d73ebdd	Revert accidental fast-forward merge from v1.49.0rc1 ... Revert "Sort internal changes in changelog" Revert "Update CHANGES.md" Revert "1.49.0rc1" Revert "Revert "Move `glob_to_regex` and `re_word_boundary` to `matrix-python-common` (#11505) (#11527)" Revert "Refactors in `_generate_sync_entry_for_rooms` (#11515)" Revert "Correctly register shutdown handler for presence workers (#11518)" Revert "Fix `ModuleApi.looping_background_call` for non-async functions (#11524)" Revert "Fix 'delete room' admin api to work on incomplete rooms (#11523)" Revert "Correctly ignore invites from ignored users (#11511)" Revert "Fix the test breakage introduced by #11435 as a result of concurrent PRs (#11522)" Revert "Stabilise support for MSC2918 refresh tokens as they have now been merged into the Matrix specification. (#11435)" Revert "Save the OIDC session ID (sid) with the device on login (#11482)" Revert "Add admin API to get some information about federation status (#11407)" Revert "Include bundled aggregations in /sync and related fixes (#11478)" Revert "Move `glob_to_regex` and `re_word_boundary` to `matrix-python-common` (#11505)" Revert "Update backward extremity docs to make it clear that it does not indicate whether we have fetched an events' `prev_events` (#11469)" Revert "Support configuring the lifetime of non-refreshable access tokens separately to refreshable access tokens. (#11445)" Revert "Add type hints to `synapse/tests/rest/admin` (#11501)" Revert "Revert accidental commits to develop." Revert "Newsfile" Revert "Give `tests.server.setup_test_homeserver` (nominally!) the same behaviour" Revert "Move `tests.utils.setup_test_homeserver` to `tests.server`" Revert "Convert one of the `setup_test_homeserver`s to `make_test_homeserver_synchronous`" Revert "Disambiguate queries on `state_key` (#11497)" Revert "Comments on the /sync tentacles (#11494)" Revert "Clean up tests.storage.test_appservice (#11492)" Revert "Clean up `tests.storage.test_main` to remove use of legacy code. (#11493)" Revert "Clean up `tests.test_visibility` to remove legacy code. (#11495)" Revert "Minor cleanup on recently ported doc pages (#11466)" Revert "Add most of the missing type hints to `synapse.federation`. (#11483)" Revert "Avoid waiting for zombie processes in `synctl stop` (#11490)" Revert "Fix media repository failing when media store path contains symlinks (#11446)" Revert "Add type annotations to `tests.storage.test_appservice`. (#11488)" Revert "`scripts-dev/sign_json`: support for signing events (#11486)" Revert "Add MSC3030 experimental client and federation API endpoints to get the closest event to a given timestamp (#9445)" Revert "Port wiki pages to documentation website (#11402)" Revert "Add a license header and comment. (#11479)" Revert "Clean-up get_version_string (#11468)" Revert "Link background update controller docs to summary (#11475)" Revert "Additional type hints for config module. (#11465)" Revert "Register the login redirect endpoint for v3. (#11451)" Revert "Update openid.md" Revert "Remove mention of OIDC certification from Dex (#11470)" Revert "Add a note about huge pages to our Postgres doc (#11467)" Revert "Don't start Synapse master process if `worker_app` is set (#11416)" Revert "Expose worker & homeserver as entrypoints in `setup.py` (#11449)" Revert "Bundle relations of relations into the `/relations` result. (#11284)" Revert "Fix `LruCache` corruption bug with a `size_callback` that can return 0 (#11454)" Revert "Eliminate a few `Any`s in `LruCache` type hints (#11453)" Revert "Remove unnecessary `json.dumps` from `tests.rest.admin` (#11461)" Revert "Merge branch 'master' into develop" This reverts commit 26b5d2320f. This reverts commit bce4220f38. This reverts commit 966b5d0fa0. This reverts commit 088d748f2c. This reverts commit 14d593f72d. This reverts commit 2a3ec6facf. This reverts commit eccc49d755. This reverts commit b1ecd19c5d. This reverts commit 9c55dedc8c. This reverts commit 2d42e586a8. This reverts commit 2f053f3f82. This reverts commit a15a893df8. This reverts commit 8b4b153c9e. This reverts commit 494ebd7347. This reverts commit a77c369897. This reverts commit 4eb77965cd. This reverts commit 637df95de6. This reverts commit e5f426cd54. This reverts commit 8cd68b8102. This reverts commit 6cae125e20. This reverts commit 7be88fbf48. This reverts commit b3fd99b74a. This reverts commit f7ec6e7d9e. This reverts commit 5640992d17. This reverts commit d26808dd85. This reverts commit f91624a595. This reverts commit 16d39a5490. This reverts commit 8a4c296987. This reverts commit 49e1356ee3. This reverts commit d2279f471b. This reverts commit b50e39df57. This reverts commit 858d80bf0f. This reverts commit 435f044807. This reverts commit f61462e1be. This reverts commit a6f1a3abec. This reverts commit 84dc50e160. This reverts commit ed635d3285. This reverts commit 7b62791e00. This reverts commit 153194c771. This reverts commit f44d729d4c. This reverts commit a265fbd397. This reverts commit b9fef1a7cd. This reverts commit b0eb64ff7b. This reverts commit f1795463bf. This reverts commit 70cbb1a5e3. This reverts commit 42bf020463. This reverts commit 379f2650cf. This reverts commit 7ff22d6da4. This reverts commit 5a0b652d36. This reverts commit 432a174bc1. This reverts commit b14f8a1baf, reversing changes made to e713855dca.	3 years ago
Quentin Gliech	a15a893df8	Save the OIDC session ID (sid) with the device on login (#11482) ... As a step towards allowing back-channel logout for OIDC.	3 years ago
Patrick Cloke	bb7fdd821b	Use direct references for configuration variables (part 5). (#10897)	3 years ago
Patrick Cloke	b3590614da	Require type hints in the handlers module. (#10831) ... Adds missing type hints to methods in the synapse.handlers module and requires all methods to have type hints there. This also removes the unused construct_auth_difference method from the FederationHandler.	3 years ago
AndrewFerr	0c0da36a68	Ask consent on SSO registration with default mxid (#10733) ... Fixes #10732: consent flow skipped during SSO user registration if username is left at default Signed-off-by: Andrew Ferrazzutti fair@miscworks.net	3 years ago
Sean	273b6861f2	Remove unstable MSC2858 API, including `experimental.msc2858_enabled` config option (#10693) ... Signed-off-by: Sean Quah <seanq@element.io>	3 years ago
Richard van der Hoff	15db8b7c7f	Correctly initialise the `synapse_user_logins` metric. (#10677) ... Fix a bug where the prometheus metrics for SSO logins wouldn't be initialised until the first user logged in with a given auth provider.	3 years ago
Jonathan de Jong	98aec1cc9d	Use inline type hints in `handlers/` and `rest/`. (#10382)	3 years ago
jkanefendt	756fd513df	Implement config option `sso.update_profile_information` (#10108) ... Implemented config option sso.update_profile_information to keep user's display name in sync with the SSO displayname. Signed-off-by: Johannes Kanefendt <johannes.kanefendt@krzn.de>	3 years ago
Richard van der Hoff	294c675033	Remove `synapse.types.Collection` (#9856) ... This is no longer required, since we have dropped support for Python 3.5.	4 years ago
Jonathan de Jong	4b965c862d	Remove redundant "coding: utf-8" lines (#9786) ... Part of #9744 Removes all redundant `# -*- coding: utf-8 -*-` lines from files, as python 3 automatically reads source code as utf-8 now. `Signed-off-by: Jonathan de Jong <jonathan@automatia.nl>`	4 years ago
Richard van der Hoff	dd69110d95	Add support for stable MSC2858 API (#9617) ... The stable format uses different brand identifiers, so we need to support two identifiers for each IdP.	4 years ago
Richard van der Hoff	df425c2c63	Prometheus metrics for logins and registrations (#9511) ... Add prom metrics for number of users successfully registering and logging in, by SSO provider.	4 years ago
Richard van der Hoff	7eb6e39a8f	Record the SSO Auth Provider in the login token (#9510) ... This great big stack of commits is a a whole load of hoop-jumping to make it easier to store additional values in login tokens, and then to actually store the SSO Identity Provider in the login token. (Making use of that data will follow in a subsequent PR.)	4 years ago
Patrick Cloke	a0bc9d387e	Use the proper Request in type hints. (#9515) ... This also pins the Twisted version in the mypy job for CI until proper type hints are fixed throughout Synapse.	4 years ago
Eric Eastwood	0a00b7ff14	Update black, and run auto formatting over the codebase (#9381) ... - Update black version to the latest - Run black auto formatting over the codebase - Run autoformatting according to [`docs/code_style.md `](80d6dc9783/docs/code_style.md) - Update `code_style.md` docs around installing black to use the correct version	4 years ago
Patrick Cloke	6dade80048	Combine the CAS & SAML implementations for required attributes. (#9326)	4 years ago
Richard van der Hoff	f20dadb649	Fix formatting for "bad session" error during sso registration flow (#9296)	4 years ago
Richard van der Hoff	c543bf87ec	Collect terms consent from the user during SSO registration (#9276)	4 years ago
Richard van der Hoff	85c56b5a67	Make importing display name and email optional (#9277)	4 years ago
Richard van der Hoff	4167494c90	Replace username picker with a template (#9275) ... There's some prelimiary work here to pull out the construction of a jinja environment to a separate function. I wanted to load the template at display time rather than load time, so that it's easy to update on the fly. Honestly, I think we should do this with all our templates: the risk of ending up with malformed templates is far outweighed by the improved turnaround time for an admin trying to update them.	4 years ago
Richard van der Hoff	8aed29dc61	Improve styling and wording of SSO redirect confirm template (#9272)	4 years ago
Richard van der Hoff	f78d07bf00	Split out a separate endpoint to complete SSO registration (#9262) ... There are going to be a couple of paths to get to the final step of SSO reg, and I want the URL in the browser to consistent. So, let's move the final step onto a separate path, which we redirect to.	4 years ago
Richard van der Hoff	a083aea396	Add 'brand' field to MSC2858 response (#9242) ... We've decided to add a 'brand' field to help clients decide how to style the buttons. Also, fix up the allowed characters for idp_id, while I'm in the area.	4 years ago
Richard van der Hoff	a737cc2713	Implement MSC2858 support (#9183) ... Fixes #8928.	4 years ago
Richard van der Hoff	0cd2938bc8	Support icons for Identity Providers (#9154)	4 years ago
Richard van der Hoff	420031906a	Move `complete_sso_ui_auth` into SSOHandler ... since we're hacking on this code anyway, may as well move it out of the cluttered AuthHandler.	4 years ago
Richard van der Hoff	5310808d3b	Give the user a better error when they present bad SSO creds ... If a user tries to do UI Auth via SSO, but uses the wrong account on the SSO IdP, try to give them a better error. Previously, the UIA would claim to be successful, but then the operation in question would simply fail with "auth fail". Instead, serve up an error page which explains the failure.	4 years ago
Richard van der Hoff	789d9ebad3	UI Auth via SSO: redirect the user to an appropriate SSO. (#9081) ... If we have integrations with multiple identity providers, when the user does a UI Auth, we need to redirect them to the right one. There are a few steps to this. First of all we actually need to store the userid of the user we are trying to validate in the UIA session, since the /auth/sso/fallback/web request is unauthenticated. Then, once we get the /auth/sso/fallback/web request, we can fish the user id out of the session, and use it to look up the external id mappings, and hence pick an SSO provider for them.	4 years ago
Richard van der Hoff	2ec8ca5e60	Remove SynapseRequest.get_user_agent (#9069) ... SynapseRequest is in danger of becoming a bit of a dumping-ground for "useful stuff relating to Requests", which isn't really its intention (its purpose is to override render, finished and connectionLost to set up the LoggingContext and write the right entries to the request log). Putting utility functions inside SynapseRequest means that lots of our code ends up requiring a SynapseRequest when there is nothing synapse-specific about the Request at all, and any old twisted.web.iweb.IRequest will do. This increases code coupling and makes testing more difficult. In short: move get_user_agent out to a utility function.	4 years ago
Richard van der Hoff	111b673fc1	Add initial support for a "pick your IdP" page (#9017) ... During login, if there are multiple IdPs enabled, offer the user a choice of IdPs.	4 years ago
Richard van der Hoff	d2c616a413	Combine the SSO Redirect Servlets (#9015) ... * Implement CasHandler.handle_redirect_request ... to make it match OidcHandler and SamlHandler * Clean up interface for OidcHandler.handle_redirect_request Make it accept `client_redirect_url=None`. * Clean up interface for `SamlHandler.handle_redirect_request` ... bring it into line with CAS and OIDC by making it take a Request parameter, move the magic for `client_redirect_url` for UIA into the handler, and fix the return type to be a `str` rather than a `bytes`. * Define a common protocol for SSO auth provider impls * Give SsoIdentityProvider an ID and register them * Combine the SSO Redirect servlets Now that the SsoHandler knows about the identity providers, we can combine the various *RedirectServlets into a single implementation which delegates to the right IdP. * changelog	4 years ago
Patrick Cloke	0eccf53146	Use the SSO handler helpers for CAS registration/login. (#8856)	4 years ago
Patrick Cloke	4218473f9e	Refactor the CAS handler in prep for using the abstracted SSO code. (#8958) ... This makes the CAS handler look more like the SAML/OIDC handlers: * Render errors to users instead of throwing JSON errors. * Internal reorganization.	4 years ago
Richard van der Hoff	28877fade9	Implement a username picker for synapse (#8942) ... The final part (for now) of my work to implement a username picker in synapse itself. The idea is that we allow `UsernameMappingProvider`s to return `localpart=None`, in which case, rather than redirecting the browser back to the client, we redirect to a username-picker resource, which allows the user to enter a username. We *then* complete the SSO flow (including doing the client permission checks). The static resources for the username picker itself (in https://github.com/matrix-org/synapse/tree/rav/username_picker/synapse/res/username_picker) are essentially lifted wholesale from https://github.com/matrix-org/matrix-synapse-saml-mozilla/tree/master/matrix_synapse_saml_mozilla/res. As the comment says, we might want to think about making them customisable, but that can be a follow-up. Fixes #8876.	4 years ago
Richard van der Hoff	e1b8e37f93	Push login completion down into SsoHandler (#8941) ... This is another part of my work towards fixing #8876. It moves some of the logic currently in the SAML and OIDC handlers - in particular the call to `AuthHandler.complete_sso_login` down into the `SsoHandler`.	4 years ago
Richard van der Hoff	c64002e1c1	Refactor `SsoHandler.get_mxid_from_sso` (#8900) ... * Factor out _call_attribute_mapper and _register_mapped_user This is mostly an attempt to simplify `get_mxid_from_sso`. * Move mapping_lock down into SsoHandler.	4 years ago
Richard van der Hoff	36ba73f53d	Simplify the flow for SSO UIA (#8881) ... * SsoHandler: remove inheritance from BaseHandler * Simplify the flow for SSO UIA We don't need to do all the magic for mapping users when we are doing UIA, so let's factor that out.	4 years ago
Patrick Cloke	22c6c19f91	Fix a regression that mapping providers should be able to redirect users. (#8878) ... This was broken in #8801.	4 years ago
Patrick Cloke	8388384a64	Fix a regression when grandfathering SAML users. (#8855) ... This was broken in #8801 when abstracting code shared with OIDC. After this change both SAML and OIDC have a concept of grandfathering users, but with different implementations.	4 years ago
Patrick Cloke	4fd222ad70	Support trying multiple localparts for OpenID Connect. (#8801) ... Abstracts the SAML and OpenID Connect code which attempts to regenerate the localpart of a matrix ID if it is already in use.	4 years ago
Andrew Morgan	59a995f38d	Improve logging of the mapping from SSO IDs to Matrix IDs. (#8773)	4 years ago
Patrick Cloke	ee382025b0	Abstract shared SSO code. (#8765) ... De-duplicates code between the SAML and OIDC implementations.	4 years ago