942 Commits (6633a4015a7b4ba60f87c5e6f979a9c9d8f9d8fe)

Author	SHA1	Message	Date
Erik Johnston	6633a4015a	Allow moving account data and receipts streams off master (#9104)	4 years ago
Richard van der Hoff	9de6b94117	Land support for multiple OIDC providers (#9110) ... This is the final step for supporting multiple OIDC providers concurrently. First of all, we reorganise the config so that you can specify a list of OIDC providers, instead of a single one. Before: oidc_config: enabled: true issuer: "https://oidc_provider" # etc After: oidc_providers: - idp_id: prov1 issuer: "https://oidc_provider" - idp_id: prov2 issuer: "https://another_oidc_provider" The old format is still grandfathered in. With that done, it's then simply a matter of having OidcHandler instantiate a new OidcProvider for each configured provider.	4 years ago
Richard van der Hoff	9ffac2bef1	Remote dependency on distutils (#9125) ... `distutils` is pretty much deprecated these days, and replaced with `setuptools`. It's also annoying because it's you can't `pip install` it, and it's hard to figure out which debian package we should depend on to make sure it's there. Since we only use it for a tiny function anyway, let's just vendor said function into our codebase.	4 years ago
Richard van der Hoff	4575ad0b1e	Store an IdP ID in the OIDC session (#9109) ... Again in preparation for handling more than one OIDC provider, add a new caveat to the macaroon used as an OIDC session cookie, which remembers which OIDC provider we are talking to. In future, when we get a callback, we'll need it to make sure we talk to the right IdP. As part of this, I'm adding an idp_id and idp_name field to the OIDC configuration object. They aren't yet documented, and we'll just use the old values by default.	4 years ago
Richard van der Hoff	5310808d3b	Give the user a better error when they present bad SSO creds ... If a user tries to do UI Auth via SSO, but uses the wrong account on the SSO IdP, try to give them a better error. Previously, the UIA would claim to be successful, but then the operation in question would simply fail with "auth fail". Instead, serve up an error page which explains the failure.	4 years ago
Richard van der Hoff	dc3c83a933	Add jsonschema verification for the oidc provider config	4 years ago
Richard van der Hoff	7cc9509eca	Extract OIDCProviderConfig object ... Collect all the config options which related to an OIDC provider into a single object.	4 years ago
Richard van der Hoff	d32870ffa5	Fix validate_config on nested objects (#9054)	4 years ago
Erik Johnston	b530eaa262	Allow running sendToDevice on workers (#9044)	4 years ago
Richard van der Hoff	111b673fc1	Add initial support for a "pick your IdP" page (#9017) ... During login, if there are multiple IdPs enabled, offer the user a choice of IdPs.	4 years ago
Jerin J Titus	cfcf5541b4	Update the value of group_creation_prefix in sample config. (#8992) ... Removes the trailing slash with causes issues with matrix.to/Element.	4 years ago
Patrick Cloke	56e00ca85e	Send the location of the web client to the IS when inviting via 3PIDs. (#8930) ... Adds a new setting `email.invite_client_location` which, if defined, is passed to the identity server during invites.	4 years ago
Richard van der Hoff	28877fade9	Implement a username picker for synapse (#8942) ... The final part (for now) of my work to implement a username picker in synapse itself. The idea is that we allow `UsernameMappingProvider`s to return `localpart=None`, in which case, rather than redirecting the browser back to the client, we redirect to a username-picker resource, which allows the user to enter a username. We *then* complete the SSO flow (including doing the client permission checks). The static resources for the username picker itself (in https://github.com/matrix-org/synapse/tree/rav/username_picker/synapse/res/username_picker) are essentially lifted wholesale from https://github.com/matrix-org/matrix-synapse-saml-mozilla/tree/master/matrix_synapse_saml_mozilla/res. As the comment says, we might want to think about making them customisable, but that can be a follow-up. Fixes #8876.	4 years ago
Patrick Cloke	5d4c330ed9	Allow re-using a UI auth validation for a period of time (#8970)	4 years ago
Patrick Cloke	44b7d4c6d6	Fix the sample config location for the ip_range_whitelist setting. (#8954) ... Move it from the federation section to the server section to match ip_range_blacklist.	4 years ago
Patrick Cloke	1619802228	Various clean-ups to the logging context code (#8935)	4 years ago
Patrick Cloke	344ab0b53a	Default to blacklisting reserved IP ranges and add a whitelist. (#8870) ... This defaults `ip_range_blacklist` to reserved IP ranges and also adds an `ip_range_whitelist` setting to override it.	4 years ago
Richard van der Hoff	ab7a24cc6b	Better formatting for config errors from modules (#8874) ... The idea is that the parse_config method of extension modules can raise either a ConfigError or a JsonValidationError, and it will be magically turned into a legible error message. There's a few components to it: * Separating the "path" and the "message" parts of a ConfigError, so that we can fiddle with the path bit to turn it into an absolute path. * Generally improving the way ConfigErrors get printed. * Passing in the config path to load_module so that it can wrap any exceptions that get caught appropriately.	4 years ago
Richard van der Hoff	025fa06fc7	Clarify config template comments (#8891)	4 years ago
Patrick Cloke	96358cb424	Add authentication to replication endpoints. (#8853) ... Authentication is done by checking a shared secret provided in the Synapse configuration file.	4 years ago
Patrick Cloke	30fba62108	Apply an IP range blacklist to push and key revocation requests. (#8821) ... Replaces the `federation_ip_range_blacklist` configuration setting with an `ip_range_blacklist` setting with wider scope. It now applies to: * Federation * Identity servers * Push notifications * Checking key validitity for third-party invite events The old `federation_ip_range_blacklist` setting is still honored if present, but with reduced scope (it only applies to federation and identity servers).	4 years ago
Andrew Morgan	17fa58bdd1	Add a config option to change whether unread push notification counts are per-message or per-room (#8820) ... This PR adds a new config option to the `push` section of the homeserver config, `group_unread_count_by_room`. By default Synapse will group push notifications by room (so if you have 1000 unread messages, if they lie in 55 rooms, you'll see an unread count on your phone of 55). However, it is also useful to be able to send out the true count of unread messages if desired. If `group_unread_count_by_room` is set to `false`, then with the above example, one would see an unread count of 1000 (email anyone?).	4 years ago
Andrew Morgan	2b110dda2a	Fix the formatting of push config section (#8818) ... This PR updates the push config's formatting to better align with our [code style guidelines](https://github.com/matrix-org/synapse/blob/develop/docs/code_style.md#configuration-file-format).	4 years ago
Ben Banfield-Zanin	53a6f5ddf0	SAML: Allow specifying the IdP entityid to use. (#8630) ... If the SAML metadata includes multiple IdPs it is necessary to specify which IdP to redirect users to for authentication.	4 years ago
Marcus Schopen	d356588339	SAML: Document allowing a clock/time difference from IdP (#8731) ... Updates the sample configuration with the pysaml2 configuration for accepting clock skew/drift between the homeserver and IdP.	4 years ago
Adrian Wannenmacher	f1de4bb58b	Clarify the usecase for an msisdn delegate (#8734) ... Signed-off-by: Adrian Wannenmacher <tfld@tfld.dev>	4 years ago
Marcus Schopen	68fc0dcb5a	SAML: add <mdui:UIInfo> element examples (#8718) ... add some mdui:UIInfo element examples for saml2_config in homeserver.yaml	4 years ago
Patrick Cloke	8f1aefa694	Improve the sample config for SSO (OIDC, SAML, and CAS). (#8635)	4 years ago
Patrick Cloke	00b24aa545	Support generating structured logs in addition to standard logs. (#8607) ... This modifies the configuration of structured logging to be usable from the standard Python logging configuration. This also separates the formatting of logs from the transport allowing JSON logs to files or standard logs to sockets.	4 years ago
Patrick Cloke	34a5696f93	Fix typos and spelling errors. (#8639)	4 years ago
Will Hunt	c276bd9969	Send some ephemeral events to appservices (#8437) ... Optionally sends typing, presence, and read receipt information to appservices.	4 years ago
Mateusz Przybyłowicz	ca2db5dd0c	Increase default max_upload_size from 10M to 50M (#8502) ... Signed-off-by: Mateusz Przybyłowicz <uamfhq@gmail.com>	4 years ago
Richard van der Hoff	785437dc0d	Update default room version to 6 (#8461) ... Per https://github.com/matrix-org/matrix-doc/pull/2788	4 years ago
Patrick Cloke	62894673e6	Allow background tasks to be run on a separate worker. (#8369)	4 years ago
Patrick Cloke	34ff8da83b	Convert additional templates to Jinja (#8444) ... This converts a few more of our inline HTML templates to Jinja. This is somewhat part of #7280 and should make it a bit easier to customize these in the future.	4 years ago
BBBSnowball	05ee048f2c	Add config option for always using "userinfo endpoint" for OIDC (#7658) ... This allows for connecting to certain IdPs, e.g. GitLab.	4 years ago
Patrick Cloke	4ff0201e62	Enable mypy checking for unreachable code and fix instances. (#8432)	4 years ago
Richard van der Hoff	c1ef579b63	Add prometheus metrics to track federation delays (#8430) ... Add a pair of federation metrics to track the delays in sending PDUs to/from particular servers.	4 years ago
Patrick Cloke	8b40843392	Allow additional SSO properties to be passed to the client (#8413)	4 years ago
Aaron Raimist	8238b55e08	Update description of server_name config option (#8415)	4 years ago
Tdxdxoz	abd04b6af0	Allow existing users to login via OpenID Connect. (#8345) ... Co-authored-by: Benjamin Koch <bbbsnowball@gmail.com> This adds configuration flags that will match a user to pre-existing users when logging in via OpenID Connect. This is useful when switching to an existing SSO system.	4 years ago
Andrew Morgan	3f4a2a7064	Hotfix: disable autoescape by default when rendering Jinja2 templates (#8394) ... #8037 changed the default `autoescape` option when rendering Jinja2 templates from `False` to `True`. This caused some bugs, noticeably around redirect URLs being escaped in SAML2 auth confirmation templates, causing those URLs to break for users. This change returns the previous behaviour as it stood. We may want to look at each template individually and see whether autoescaping is a good idea at some point, but for now lets just fix the breakage.	4 years ago
Patrick Cloke	8a4a4186de	Simplify super() calls to Python 3 syntax. (#8344) ... This converts calls like super(Foo, self) -> super(). Generated with: sed -i "" -Ee 's/super\([^\(]+\)/super()/g' **/*.py	4 years ago
Jonathan de Jong	837293c314	Remove obsolete __future__ imports (#8337)	4 years ago
Patrick Cloke	6605470bfb	Improve SAML error messages (#8248)	4 years ago
Erik Johnston	04cc249b43	Add experimental support for sharding event persister. Again. (#8294) ... This is *not* ready for production yet. Caveats: 1. We should write some tests... 2. The stream token that we use for events can get stalled at the minimum position of all writers. This means that new events may not be processed and e.g. sent down sync streams if a writer isn't writing or is slow.	4 years ago
Andrew Morgan	a3a90ee031	Show a confirmation page during user password reset (#8004) ... This PR adds a confirmation step to resetting your user password between clicking the link in your email and your password actually being reset. This is to better align our password reset flow with the industry standard of requiring a confirmation from the user after email validation.	4 years ago
Andrew Morgan	094896a69d	Add a config option for validating 'next_link' parameters against a domain whitelist (#8275) ... This is a config option ported over from DINUM's Sydent: https://github.com/matrix-org/sydent/pull/285 They've switched to validating 3PIDs via Synapse rather than Sydent, and would like to retain this functionality. This original purpose for this change is phishing prevention. This solution could also potentially be replaced by a similar one to https://github.com/matrix-org/synapse/pull/8004, but across all `*/submit_token` endpoint. This option may still be useful to enterprise even with that safeguard in place though, if they want to be absolutely sure that their employees don't follow links to other domains.	4 years ago
Richard van der Hoff	77794ebc77	Fix stack overflow when logging system encounters an error (#8268)	4 years ago
Patrick Cloke	db7de4d182	Fix a regression from calling read_templates. (#8252) ... Regressed in #8037.	4 years ago