From 2a48d0838b46963b134b4351d4da0dd352cbd8bf Mon Sep 17 00:00:00 2001 From: erikjohnston Date: Tue, 26 Sep 2023 16:01:35 +0000 Subject: deploy: 88ba67eb91215a708f321e16559fe3c2c0d0a407 --- .../usage/configuration/config_documentation.html | 75 ++++++++++++++++------ 1 file changed, 54 insertions(+), 21 deletions(-) (limited to 'latest/usage/configuration/config_documentation.html') diff --git a/latest/usage/configuration/config_documentation.html b/latest/usage/configuration/config_documentation.html index 414593c55e..270fc2ef93 100644 --- a/latest/usage/configuration/config_documentation.html +++ b/latest/usage/configuration/config_documentation.html @@ -169,8 +169,10 @@ followed by a letter. Letters have the following meanings:

messages from the database after 5 minutes, rather than 5 months.

In addition, configuration options referring to size use the following suffixes:

For example, setting max_avatar_size: 10M means that Synapse will not accept files larger than 10,485,760 bytes for a user avatar.

@@ -592,7 +594,7 @@ for workers and containers without listener e.g

Example configuration #2:

listeners:
-  # Unsecure HTTP listener: for when matrix traffic passes through a reverse proxy
+  # Insecure HTTP listener: for when matrix traffic passes through a reverse proxy
   # that unwraps TLS.
   #
   # If you plan to use a reverse proxy, please see
@@ -963,6 +965,13 @@ still take up to 5 minutes to purge redacted events from the database.

 
redaction_retention_period: 28d
 

 

+
forgotten_room_retention_period

+
How long to keep locally forgotten rooms before purging them from the DB.

+
Defaults to null, meaning it's disabled.

+
Example configuration:

+
forgotten_room_retention_period: 28d
+

+

 
user_ips_max_age

 
How long to track users' last seen time and IPs in the database.

 
Defaults to 28d. Set to null to disable clearing out of old rows.

@@ -1113,12 +1122,12 @@ any intermediate certificates (for instance, if using certbot, use
 

 
federation_client_minimum_tls_version

 
The minimum TLS version that will be used for outbound federation requests.

-
Defaults to 1. Configurable to 1, 1.1, 1.2, or 1.3. Note
-that setting this value higher than 1.2 will prevent federation to most
-of the public Matrix network: only configure it to 1.3 if you have an
+
Defaults to "1". Configurable to "1", "1.1", "1.2", or "1.3". Note
+that setting this value higher than "1.2" will prevent federation to most
+of the public Matrix network: only configure it to "1.3" if you have an
 entirely private federation setup and you can ensure TLS 1.3 support.

 
Example configuration:

-
federation_client_minimum_tls_version: 1.2
+
federation_client_minimum_tls_version: "1.2"
 

 

 
federation_certificate_verification_whitelist

@@ -2572,7 +2581,7 @@ are still valid. Defaults to 1d.

 
Normally, the connection to the key server is validated via TLS certificates.
 Additional security can be provided by configuring a verify key, which
 will make synapse check that the response is signed by that key.

-
This setting supercedes an older setting named perspectives. The old format
+
This setting supersedes an older setting named perspectives. The old format
 is still supported for backwards-compatibility, but it is deprecated.

 
trusted_key_servers defaults to matrix.org, but using it will generate a
 warning on start-up. To suppress this warning, set
@@ -3058,27 +3067,50 @@ claim MUST contain "admin".

 
Enable Central Authentication Service (CAS) for registration and login.
 Has the following sub-options:

 
    
-
  • enabled: Set this to true to enable authorization against a CAS server.
-Defaults to false.
    • 
-
  • idp_name: A user-facing name for this identity provider, which is used to
-offer the user a choice of login mechanisms.
    • 
-
  • idp_icon: An optional icon for this identity provider, which is presented
+
  • 
+
    enabled: Set this to true to enable authorization against a CAS server.
+Defaults to false.
    
+
    • 
+
  • 
+
    idp_name: A user-facing name for this identity provider, which is used to
+offer the user a choice of login mechanisms.
    
+
    • 
+
  • 
+
    idp_icon: An optional icon for this identity provider, which is presented
 by clients and Synapse's own IdP picker page. If given, must be an
 MXC URI of the format mxc://<server-name>/<media-id>. (An easy way to
 obtain such an MXC URI is to upload an image to an (unencrypted) room
-and then copy the "url" from the source of the event.)
    • 
-
  • idp_brand: An optional brand for this identity provider, allowing clients
+and then copy the "url" from the source of the event.)
    
+
    • 
+
  • 
+
    idp_brand: An optional brand for this identity provider, allowing clients
 to style the login flow according to the identity provider in question.
-See the spec for possible options here.
    • 
-
  • server_url: The URL of the CAS authorization endpoint.
    • 
-
  • protocol_version: The CAS protocol version, defaults to none (version 3 is required if you want to use "required_attributes").
    • 
-
  • displayname_attribute: The attribute of the CAS response to use as the display name.
-If no name is given here, no displayname will be set.
    • 
-
  • required_attributes:  It is possible to configure Synapse to only allow logins if CAS attributes
+See the spec for possible options here.
    
+
    • 
+
  • 
+
    server_url: The URL of the CAS authorization endpoint.
    
+
    • 
+
  • 
+
    protocol_version: The CAS protocol version, defaults to none (version 3 is required if you want to use "required_attributes").
    
+
    • 
+
  • 
+
    displayname_attribute: The attribute of the CAS response to use as the display name.
+If no name is given here, no displayname will be set.
    
+
    • 
+
  • 
+
    required_attributes:  It is possible to configure Synapse to only allow logins if CAS attributes
 match particular values. All of the keys given below must exist
 and the values must match the given value. Alternately if the given value
 is None then any value is allowed (the attribute just must exist).
-All of the listed attributes must match for the login to be permitted.
    • 
+All of the listed attributes must match for the login to be permitted.
    
+
+
  • 
+
    enable_registration: set to 'false' to disable automatic registration of new
+users. This allows the CAS SSO flow to be limited to sign in only, rather than
+automatically registering users that have a valid SSO login but do not have
+a pre-registered account. Defaults to true.
    
+
    Added in Synapse 1.93.0.
    
+
    • 
 

 
Example configuration:

 
cas_config:
@@ -3089,6 +3121,7 @@ All of the listed attributes must match for the login to be permitted.
   required_attributes:
     userGroup: "staff"
     department: None
+  enable_registration: true
 

 

 
sso

-- 
cgit 1.5.1