diff options
| author | Erik Johnston <erikj@element.io> | 2024-01-10 17:16:49 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-01-10 17:16:49 +0000 |
| commit | a986f86c827879f26abd574da6c7d12ac9578dd8 (patch) | |
| tree | e678a8e07f88d0e684c2407987b69b5c13e0f98f | |
| parent | Faster load recents for sync (#16783) (diff) | |
| download | synapse-a986f86c827879f26abd574da6c7d12ac9578dd8.tar.xz | |
Correctly handle OIDC config with no `client_secret` set (#16806)
In previous versions of authlib using `client_secret_basic` without a `client_secret` would result in an invalid auth header. Since authlib 1.3 it throws an exception. The configuration may be accepted in by very lax servers, so we don't want to deny it outright. Instead, let's default the `client_auth_method` to `none`, which does the right thing. If the config specifies `client_auth_method` and no `client_secret` then that is going to be bogus and we should reject it
| -rw-r--r-- | changelog.d/16806.misc | 1 | ||||
| -rw-r--r-- | synapse/config/oidc.py | 15 |
2 files changed, 15 insertions, 1 deletions
diff --git a/changelog.d/16806.misc b/changelog.d/16806.misc new file mode 100644 index 0000000000..623338268b --- /dev/null +++ b/changelog.d/16806.misc @@ -0,0 +1 @@ +Reject OIDC config when `client_secret` isn't specified, but the auth method requires one. diff --git a/synapse/config/oidc.py b/synapse/config/oidc.py index 07ca16c94c..8f9cdbddbb 100644 --- a/synapse/config/oidc.py +++ b/synapse/config/oidc.py @@ -299,6 +299,19 @@ def _parse_oidc_config_dict( config_path + ("client_secret",), ) + # If no client secret is specified then the auth method must be None + client_auth_method = oidc_config.get("client_auth_method") + if client_secret is None and client_secret_jwt_key is None: + if client_auth_method is None: + client_auth_method = "none" + elif client_auth_method != "none": + raise ConfigError( + "No 'client_secret' is set in OIDC config, and 'client_auth_method' is not set to 'none'" + ) + + if client_auth_method is None: + client_auth_method = "client_secret_basic" + return OidcProviderConfig( idp_id=idp_id, idp_name=oidc_config.get("idp_name", "OIDC"), @@ -309,7 +322,7 @@ def _parse_oidc_config_dict( client_id=oidc_config["client_id"], client_secret=client_secret, client_secret_jwt_key=client_secret_jwt_key, - client_auth_method=oidc_config.get("client_auth_method", "client_secret_basic"), + client_auth_method=client_auth_method, pkce_method=oidc_config.get("pkce_method", "auto"), scopes=oidc_config.get("scopes", ["openid"]), authorization_endpoint=oidc_config.get("authorization_endpoint"), |