diff options
| author | Patrick Cloke <clokep@users.noreply.github.com> | 2020-07-14 07:16:43 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-07-14 07:16:43 -0400 |
| commit | 77d2c054100f4b0ebe8a027d510a42ff5af09667 (patch) | |
| tree | 8761149a62809580df445180b327db8445081569 /docs/jwt.md | |
| parent | Improve the type hints of synapse.api.errors. (#7820) (diff) | |
| download | synapse-77d2c054100f4b0ebe8a027d510a42ff5af09667.tar.xz | |
Add the option to validate the `iss` and `aud` claims for JWT logins. (#7827)
Diffstat (limited to 'docs/jwt.md')
| -rw-r--r-- | docs/jwt.md | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/docs/jwt.md b/docs/jwt.md index 289d66b365..93b8d05236 100644 --- a/docs/jwt.md +++ b/docs/jwt.md @@ -20,8 +20,17 @@ follows: Note that the login type of `m.login.jwt` is supported, but is deprecated. This will be removed in a future version of Synapse. -The `jwt` should encode the local part of the user ID as the standard `sub` -claim. In the case that the token is not valid, the homeserver must respond with +The `token` field should include the JSON web token with the following claims: + +* The `sub` (subject) claim is required and should encode the local part of the + user ID. +* The expiration time (`exp`), not before time (`nbf`), and issued at (`iat`) + claims are optional, but validated if present. +* The issuer (`iss`) claim is optional, but required and validated if configured. +* The audience (`aud`) claim is optional, but required and validated if configured. + Providing the audience claim when not configured will cause validation to fail. + +In the case that the token is not valid, the homeserver must respond with `401 Unauthorized` and an error code of `M_UNAUTHORIZED`. (Note that this differs from the token based logins which return a @@ -55,7 +64,8 @@ sample settings. Although JSON Web Tokens are typically generated from an external server, the examples below use [PyJWT](https://pyjwt.readthedocs.io/en/latest/) directly. -1. Configure Synapse with JWT logins: +1. Configure Synapse with JWT logins, note that this example uses a pre-shared + secret and an algorithm of HS256: ```yaml jwt_config: |