From 88f603f8452aada71c4ed1f43487f56c574a4519 Mon Sep 17 00:00:00 2001 From: David Robertson Date: Sat, 21 May 2022 21:42:08 +0100 Subject: ensure idp_id gets a prefix --- synapse/config/oidc2.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'synapse') diff --git a/synapse/config/oidc2.py b/synapse/config/oidc2.py index 1e2f434867..e48b635e09 100644 --- a/synapse/config/oidc2.py +++ b/synapse/config/oidc2.py @@ -59,6 +59,20 @@ class OIDCProviderModel(BaseModel): # table, as well as the query/path parameter used in the login protocol. idp_id: IDP_ID_TYPE + @validator("idp_id") + def ensure_idp_id_prefix(cls: Type[BaseModel], idp_id: str) -> str: + """Prefix the given IDP with a prefix specific to the SSO mechanism, to avoid + clashes with other mechs (such as SAML, CAS). + + We allow "oidc" as an exception so that people migrating from old-style + "oidc_config" format (which has long used "oidc" as its idp_id) can migrate to + a new-style "oidc_providers" entry without changing the idp_id for their provider + (and thereby invalidating their user_external_ids data). + """ + if idp_id != "oidc": + return "oidc-" + idp_id + return idp_id + # user-facing name for this identity provider. idp_name: StrictStr -- cgit 1.5.1