summary refs log tree commit diff
path: root/synapse/api/auth (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Do not auto-provision missing users & devices when delegating auth to MAS ↵Quentin Gliech2025-05-021-28/+11
| | | | | | | | | | (#18181) Since MAS 0.13.0, the provisionning of devices and users is done synchronously and reliably enough that we don't need to auto-provision on the Synapse side anymore. It's important to remove this behaviour if we want to start caching token introspection results.
* Don't cache introspection failures (#18339)Quentin Gliech2025-04-151-3/+9
|
* Fix `force_tracing_for_users` config when using MAS (#18334)Erik Johnston2025-04-151-0/+51
| | | | | | | This is a copy of what we do for internal auth, and we should figure out a way to deduplicate some of this stuff: https://github.com/element-hq/synapse/blob/dd05cc55eedbf086ae224a13c9ae9f0332d96b1f/synapse/api/auth/internal.py#L62-L110
* Fix the token introspection cache logging access tokens when MAS integration ↵reivilibre2025-04-151-0/+2
| | | | | | | | | | | is in use. (#18335) The `ResponseCache` logs keys by default. Let's not do that for access tokens. --------- Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
* Add an access token introspection cache to make Matrix Authentication ↵reivilibre2025-04-011-17/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Service integration (MSC3861) more efficient. (#18231) Evolution of https://github.com/element-hq/synapse/commit/cd78f3d2ee15ccf3e8229a1f529e0e2c16e15c45 This cache does not have any explicit invalidation, but this is deemed acceptable (see code comment). We may still prefer to add it eventually, letting us bump up the Time-To-Live (TTL) on the cache as we currently set a 2 minute expiry to balance the fact that we have no explicit invalidation. This cache makes several things more efficient: - reduces number of outbound requests from Synapse, reducing CPU utilisation + network I/O - reduces request handling time in Synapse, which improves client-visible latency - reduces load on MAS and its database --- Other than that, this PR also introduces support for `expires_in` (seconds) on the introspection response. This lets the cached responses expire at the proper expiry time of the access token, whilst avoiding clock skew issues. Corresponds to: https://github.com/element-hq/matrix-authentication-service/pull/4241 --------- Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
* Support getting the device ID explicitly from MAS (#18174)Quentin Gliech2025-03-041-17/+32
| | | | | | | | | | | | | | | | | | | | | | | The context for this is that the Matrix spec allows basically anything in the device ID. With MSC3861, we're restricting this to strings that can be represented as scopes. Whilst this works well for next-gen auth sessions, compatibility/legacy sessions still can have characters that can't be encoded (mainly spaces) in them. To work around that, we added in MAS a behaviour where the device_id is given as an explicit property of the token introspection response, and remove it from the scope. Because we don't expect users to rollout new Synapse and MAS versions in sync, we needed a way to 'advertise' support for this behaviour: the easiest way to do that was through an extra header in the introspection response. On the longer term, I expect MAS and Synapse to move away from the introspection endpoint, and instead define a specific API for Synapse -> MAS communication. PR on the MAS side: https://github.com/element-hq/matrix-authentication-service/pull/4067
* Cleanup Python 3.8 leftovers (#17967)V024602025-02-101-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some small cleanups after Python3.8 became EOL. - Move some type imports from `typing_extensions` to `typing` - Remove the `abi3-py38` feature from pyo3 ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --------- Co-authored-by: Quentin Gliech <quenting@element.io>
* Add MSC3861 config options admin_token_path and client_secret_path (#18004)V024602025-02-041-6/+8
| | | | | | | | | | | | | | Another PR on my quest to a `*_path` variant for every secret. Adds two config options `admin_token_path` and `client_secret_path` to the experimental config under `experimental_features.msc3861`. Also includes tests. I tried to be a good citizen here by following `attrs` conventions and not rewriting the corresponding non-path variants in the class, but instead adding methods to retrieve the value. Reading secrets from files has the security advantage of separating the secrets from the config. It also simplifies secrets management in Kubernetes. Also useful to NixOS users.
* Support the new `/auth_metadata` endpoint defined in MSC2965. (#18093)Quentin Gliech2025-01-211-0/+6
| | | | | | | See the updated MSC2965 --------- Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
* Reduce overhead of sliding sync E2EE loops (#17771)Erik Johnston2024-09-301-1/+1
| | | | Mainly toning down logging and only calling `get_membership_from_event_ids` if something has changed.
* MSC3861: load the issuer and account management URLs from OIDC discovery ↵Quentin Gliech2024-08-301-2/+31
| | | | | | | | | | | | | | (#17407) This will help mitigating any discrepancies between the issuer configured and the one returned by the OIDC provider. This also removes the need for configuring the `account_management_url` explicitely, as it will now be loaded from the OIDC discovery, as per MSC2965. Because we may now fetch stuff for the .well-known/matrix/client endpoint, this also transforms the client well-known resource to be asynchronous.
* MSC3861: allow overriding the introspection endpoint (#17406)Quentin Gliech2024-07-081-2/+13
| | | | This makes it easier to go through an internal endpoint instead of the public facing URL when introspecting tokens, reducing latency.
* Allow enabling sliding sync per-user (#17393)Erik Johnston2024-07-053-1/+74
| | | Based on #17392
* Correctly mention previous copyright (#16820)Erik Johnston2024-01-234-0/+4
| | | | | During the migration the automated script to update the copyright headers accidentally got rid of some of the existing copyright lines. Reinstate them.
* Merge remote-tracking branch 'gitlab/clokep/license-license' into new_developErik Johnston2023-12-134-40/+64
|\
| * Update license headersPatrick Cloke2023-11-214-40/+64
| |
* | Keep track of `user_ips` and `monthly_active_users` when delegating auth ↵David Robertson2023-11-233-38/+53
|/ | | | | | | | | | | | | (#16672) * Describe `insert_client_ip` * Pull out client_ips and MAU tracking to BaseAuth * Define HAS_AUTHLIB once in tests sick of copypasting * Track ips and token usage when delegating auth * Test that we track MAU and user_ips * Don't track `__oidc_admin`
* Fix possible AttributeError when account-api is called over unix socket (#16404)Christoph2023-10-091-1/+1
| | | Fixes #16396
* Refactor `get_user_by_id` (#16316)Erik Johnston2023-09-142-2/+2
|
* Revert MSC3861 introspection cache, admin impersonation and account lock ↵Quentin Gliech2023-09-061-85/+6
| | | | (#16258)
* Add an admin endpoint to allow authorizing server to signal token ↵Shay2023-08-221-0/+13
| | | | revocations (#16125)
* MSC3861: allow impersonation by an admin using a query param (#16132)Mathieu Velten2023-08-181-3/+22
|
* Add response time metrics for introspection requests (#16131)Erik Johnston2023-08-181-7/+27
| | | See #16119
* Cache token introspection response from OIDC provider (#16117)Shay2023-08-171-2/+38
|
* Implements admin API to lock an user (MSC3939) (#15870)Mathieu Velten2023-08-103-1/+28
|
* Add stricter mypy options (#15694)Patrick Cloke2023-05-311-1/+1
| | | | Enable warn_unused_configs, strict_concatenate, disallow_subclassing_any, and disallow_incomplete_defs.
* Enforce that an admin token also has the basic Matrix API scopeQuentin Gliech2023-05-301-5/+2
|
* Reject tokens with multiple device scopesQuentin Gliech2023-05-301-6/+24
|
* Make OIDC scope constantsQuentin Gliech2023-05-301-10/+15
|
* Handle errors when introspecting tokensQuentin Gliech2023-05-301-5/+37
| | | | | This returns a proper 503 when the introspection endpoint is not working for some reason, which should avoid logging out clients in those cases.
* Make AS tokens work & allow ASes to /registerQuentin Gliech2023-05-303-83/+88
|
* Add an admin token for MAS -> Synapse callsQuentin Gliech2023-05-301-0/+15
|
* Refactor config to be an experimental featureHugh Nimmo-Smith2023-05-301-25/+28
| | | | Also enforce you can't combine it with incompatible config options
* Actually enforce guest + return www-authenticate headerHugh Nimmo-Smith2023-05-301-2/+16
|
* MSC2967: Check access token scope for use as user and add guest supportHugh Nimmo-Smith2023-05-301-10/+20
|
* Use `name` claim as display name when registering users on the fly.Hugh Nimmo-Smith2023-05-301-1/+8
| | | | | This makes is so that the `name` claim got when introspecting the token is used as the display name when registering a user on the fly.
* Record the `sub` claims as an external_idQuentin Gliech2023-05-301-22/+37
|
* Handle the Synapse admin scopeQuentin Gliech2023-05-301-0/+3
|
* Save the scopes in the requesterQuentin Gliech2023-05-301-0/+1
|
* Initial MSC3964 support: delegation of auth to OIDC serverQuentin Gliech2023-05-301-0/+227
|
* Make the api.auth.Auth a ProtocolQuentin Gliech2023-05-303-0/+817
generated by cgit-magenta 1.5.1 (git 2.48.1) at 2025-08-11 14:15:31 +0000