diff options
| author | Richard van der Hoff <richard@matrix.org> | 2021-01-12 18:19:42 +0000 |
|---|---|---|
| committer | Richard van der Hoff <richard@matrix.org> | 2021-01-13 20:22:41 +0000 |
| commit | 5310808d3bebd17275355ecd474bc013e8c7462d (patch) | |
| tree | 51df032cf79426b849ef7c06933ed7aa8a8ca108 /synapse/config | |
| parent | Add a test for UI-Auth-via-SSO (#9082) (diff) | |
| download | synapse-5310808d3bebd17275355ecd474bc013e8c7462d.tar.xz | |
Give the user a better error when they present bad SSO creds
If a user tries to do UI Auth via SSO, but uses the wrong account on the SSO IdP, try to give them a better error. Previously, the UIA would claim to be successful, but then the operation in question would simply fail with "auth fail". Instead, serve up an error page which explains the failure.
Diffstat (limited to 'synapse/config')
| -rw-r--r-- | synapse/config/sso.py | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/synapse/config/sso.py b/synapse/config/sso.py index 1aeb1c5c92..366f0d4698 100644 --- a/synapse/config/sso.py +++ b/synapse/config/sso.py @@ -37,6 +37,7 @@ class SSOConfig(Config): self.sso_error_template, sso_account_deactivated_template, sso_auth_success_template, + self.sso_auth_bad_user_template, ) = self.read_templates( [ "sso_login_idp_picker.html", @@ -45,6 +46,7 @@ class SSOConfig(Config): "sso_error.html", "sso_account_deactivated.html", "sso_auth_success.html", + "sso_auth_bad_user.html", ], template_dir, ) @@ -160,6 +162,14 @@ class SSOConfig(Config): # # This template has no additional variables. # + # * HTML page shown after a user-interactive authentication session which + # does not map correctly onto the expected user: 'sso_auth_bad_user.html'. + # + # When rendering, this template is given the following variables: + # * server_name: the homeserver's name. + # * user_id_to_verify: the MXID of the user that we are trying to + # validate. + # # * HTML page shown during single sign-on if a deactivated user (according to Synapse's database) # attempts to login: 'sso_account_deactivated.html'. # |