1109 Commits (b64b6d12d47c012a9996a2585a969d3b962d25fa)

Author	SHA1	Message	Date
Richard van der Hoff	8f75bf1df7	Put SAML callback URI under /_synapse/client. (#9289)	4 years ago
Richard van der Hoff	846b9d3df0	Put OIDC callback URI under /_synapse/client. (#9288)	4 years ago
Oliver Hanikel	d1f13c7485	Add an OpenID example config for Gitea. (#9134)	4 years ago
Richard van der Hoff	c543bf87ec	Collect terms consent from the user during SSO registration (#9276)	4 years ago
Richard van der Hoff	e5d70c8a82	Improve styling and wording of SSO UIA templates (#9286) ... fixes #9171	4 years ago
Richard van der Hoff	4167494c90	Replace username picker with a template (#9275) ... There's some prelimiary work here to pull out the construction of a jinja environment to a separate function. I wanted to load the template at display time rather than load time, so that it's easy to update on the fly. Honestly, I think we should do this with all our templates: the risk of ending up with malformed templates is far outweighed by the improved turnaround time for an admin trying to update them.	4 years ago
Richard van der Hoff	8aed29dc61	Improve styling and wording of SSO redirect confirm template (#9272)	4 years ago
Richard van der Hoff	9c715a5f19	Fix SSO on workers (#9271) ... Fixes #8966. * Factor out build_synapse_client_resource_tree Start a function which will mount resources common to all workers. * Move sso init into build_synapse_client_resource_tree ... so that we don't have to do it for each worker * Fix SSO-login-via-a-worker Expose the SSO login endpoints on workers, like the documentation says. * Update workers config for new endpoints Add documentation for endpoints recently added (#8942, #9017, #9262) * remove submit_token from workers endpoints list this *doesn't* work on workers (yet). * changelog * Add a comment about the odd path for SAML2Resource	4 years ago
Erik Johnston	f2c1560eca	Ratelimit invites by room and target user (#9258)	4 years ago
Erik Johnston	4b73488e81	Ratelimit 3PID /requestToken API (#9238)	4 years ago
David Teller	fe52dae6bd	FIXUP: Documenting /_synapse/admin/v1/rooms/<room_id>/context/<event_id>	4 years ago
Richard van der Hoff	34efb4c604	Add notes on integrating with Facebook for SSO login. (#9244)	4 years ago
Richard van der Hoff	a083aea396	Add 'brand' field to MSC2858 response (#9242) ... We've decided to add a 'brand' field to help clients decide how to style the buttons. Also, fix up the allowed characters for idp_id, while I'm in the area.	4 years ago
Richard van der Hoff	869667760f	Support for scraping email addresses from OIDC providers (#9245)	4 years ago
Erik Johnston	93b61589b0	Add a note to changelog about redis usage (#9227)	4 years ago
Patrick Cloke	26837d5dbe	Do not require the CAS service URL setting (use public_baseurl instead). (#9199) ... The current configuration is handled for backwards compatibility, but is considered deprecated.	4 years ago
Patrick Cloke	4a55d267ee	Add an admin API for shadow-banning users. (#9209) ... This expands the current shadow-banning feature to be usable via the admin API and adds documentation for it. A shadow-banned users receives successful responses to their client-server API requests, but the events are not propagated into rooms. Shadow-banning a user should be used as a tool of last resort and may lead to confusing or broken behaviour for the client.	4 years ago
Jason Robinson	930ba00971	Add depth and received_ts to forward_extremities admin API response ... Also add a warning on the admin API documentation. Signed-off-by: Jason Robinson <jasonr@matrix.org>	4 years ago
Richard van der Hoff	7447f19702	Prefix idp_id with "oidc-" (#9189) ... ... to avoid clashes with other SSO mechanisms	4 years ago
Richard van der Hoff	0cd2938bc8	Support icons for Identity Providers (#9154)	4 years ago
rht	a5b9c87ac6	docs: Add link to Matrix VoIP tester for turn-howto (#9135) ... Signed-off-by: rht <rhtbot@protonmail.com>	4 years ago
Richard van der Hoff	fa50e4bf4d	Give `public_baseurl` a default value (#9159)	4 years ago
Patrick Cloke	de45bf5b5b	Quote pip install with brackets to avoid shell interpretation. (#9151)	4 years ago
Matthew Hodgson	883d4e6f2b	link to the scalability blog post from workers.md	4 years ago
Richard van der Hoff	9de6b94117	Land support for multiple OIDC providers (#9110) ... This is the final step for supporting multiple OIDC providers concurrently. First of all, we reorganise the config so that you can specify a list of OIDC providers, instead of a single one. Before: oidc_config: enabled: true issuer: "https://oidc_provider" # etc After: oidc_providers: - idp_id: prov1 issuer: "https://oidc_provider" - idp_id: prov2 issuer: "https://another_oidc_provider" The old format is still grandfathered in. With that done, it's then simply a matter of having OidcHandler instantiate a new OidcProvider for each configured provider.	4 years ago
Patrick Cloke	3e4cdfe5d9	Add an admin API endpoint to protect media. (#9086) ... Protecting media stops it from being quarantined when e.g. all media in a room is quarantined. This is useful for sticker packs and other media that is uploaded by server administrators, but used by many people.	4 years ago
Richard van der Hoff	5310808d3b	Give the user a better error when they present bad SSO creds ... If a user tries to do UI Auth via SSO, but uses the wrong account on the SSO IdP, try to give them a better error. Previously, the UIA would claim to be successful, but then the operation in question would simply fail with "auth fail". Instead, serve up an error page which explains the failure.	4 years ago
Patrick Cloke	d1eb1b96e8	Register the /devices endpoint on workers. (#9092)	4 years ago
Dirk Klimpel	7a2e9b549d	Remove user's avatar URL and displayname when deactivated. (#8932) ... This only applies if the user's data is to be erased.	4 years ago
Jason Robinson	da16d06301	Address pr feedback ... * docs updates * prettify SQL * add missing copyright * cursor_to_dict * update touched files copyright years Signed-off-by: Jason Robinson <jasonr@matrix.org>	4 years ago
Jason Robinson	0b77329fe2	Clarify rooms.md ... Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>	4 years ago
David Teller	b161528fcc	Also support remote users on the joined_rooms admin API. (#8948) ... For remote users, only the rooms which the server knows about are returned. Local users have all of their joined rooms returned.	4 years ago
Erik Johnston	1315a2e8be	Use a chain cover index to efficiently calculate auth chain difference (#8868)	4 years ago
Jason Robinson	e2c16edc78	Add changelog and admin API docs ... Signed-off-by: Jason Robinson <jasonr@matrix.org>	4 years ago
Christopher Rücker	bce0c91d9a	Keycloak mapping_provider example (#9037) (#9057) ... This PR adds the missing user_mapping_provider section in oidc.md Signed-off-by: Christopher Rücker chris-ruecker@protonmail.com	4 years ago
Emelie	9066c2fd7f	Fix typo in docs/systemd-with-workers/README.md (#9035) ... Signed-off-by: Emelie em@nao.sh	4 years ago
Richard van der Hoff	111b673fc1	Add initial support for a "pick your IdP" page (#9017) ... During login, if there are multiple IdPs enabled, offer the user a choice of IdPs.	4 years ago
Jerin J Titus	cfcf5541b4	Update the value of group_creation_prefix in sample config. (#8992) ... Removes the trailing slash with causes issues with matrix.to/Element.	4 years ago
Patrick Cloke	68bb26da69	Allow redacting events on workers (#8994) ... Adds the redacts endpoint to workers that have the client listener.	4 years ago
Patrick Cloke	4218473f9e	Refactor the CAS handler in prep for using the abstracted SSO code. (#8958) ... This makes the CAS handler look more like the SAML/OIDC handlers: * Render errors to users instead of throwing JSON errors. * Internal reorganization.	4 years ago
Patrick Cloke	56e00ca85e	Send the location of the web client to the IS when inviting via 3PIDs. (#8930) ... Adds a new setting `email.invite_client_location` which, if defined, is passed to the identity server during invites.	4 years ago
Erik Johnston	d781a81e69	Allow server admin to get admin bit in rooms where local user is an admin (#8756) ... This adds an admin API that allows a server admin to get power in a room if a local user has power in a room. Will also invite the user if they're not in the room and its a private room. Can specify another user (rather than the admin user) to be granted power. Co-authored-by: Matthew Hodgson <matthew@matrix.org>	4 years ago
Richard van der Hoff	28877fade9	Implement a username picker for synapse (#8942) ... The final part (for now) of my work to implement a username picker in synapse itself. The idea is that we allow `UsernameMappingProvider`s to return `localpart=None`, in which case, rather than redirecting the browser back to the client, we redirect to a username-picker resource, which allows the user to enter a username. We *then* complete the SSO flow (including doing the client permission checks). The static resources for the username picker itself (in https://github.com/matrix-org/synapse/tree/rav/username_picker/synapse/res/username_picker) are essentially lifted wholesale from https://github.com/matrix-org/matrix-synapse-saml-mozilla/tree/master/matrix_synapse_saml_mozilla/res. As the comment says, we might want to think about making them customisable, but that can be a follow-up. Fixes #8876.	4 years ago
Patrick Cloke	5d4c330ed9	Allow re-using a UI auth validation for a period of time (#8970)	4 years ago
Dirk Klimpel	06006058d7	Make search statement in List Room and User Admin API case-insensitive (#8931)	4 years ago
Patrick Cloke	44b7d4c6d6	Fix the sample config location for the ip_range_whitelist setting. (#8954) ... Move it from the federation section to the server section to match ip_range_blacklist.	4 years ago
David Teller	f14428b25c	Allow spam-checker modules to be provide async methods. (#8890) ... Spam checker modules can now provide async methods. This is implemented in a backwards-compatible manner.	4 years ago
Dirk Klimpel	0a34cdfc66	Add number of local devices to Room Details Admin API (#8886)	4 years ago
Dirk Klimpel	a5f7aff5e5	Deprecate Shutdown Room and Purge Room Admin API (#8829) ... Deprecate both APIs in favour of the Delete Room API. Related: #8663 and #8810	4 years ago
Patrick Cloke	344ab0b53a	Default to blacklisting reserved IP ranges and add a whitelist. (#8870) ... This defaults `ip_range_blacklist` to reserved IP ranges and also adds an `ip_range_whitelist` setting to override it.	4 years ago