summary refs log tree commit diff
path: root/synapse/api/auth (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Correctly mention previous copyright (#16820)Erik Johnston2024-01-234-0/+4
| | | | | During the migration the automated script to update the copyright headers accidentally got rid of some of the existing copyright lines. Reinstate them.
* Merge remote-tracking branch 'gitlab/clokep/license-license' into new_developErik Johnston2023-12-134-40/+64
|\
| * Update license headersPatrick Cloke2023-11-214-40/+64
| |
* | Keep track of `user_ips` and `monthly_active_users` when delegating auth ↵David Robertson2023-11-233-38/+53
|/ | | | | | | | | | | | | (#16672) * Describe `insert_client_ip` * Pull out client_ips and MAU tracking to BaseAuth * Define HAS_AUTHLIB once in tests sick of copypasting * Track ips and token usage when delegating auth * Test that we track MAU and user_ips * Don't track `__oidc_admin`
* Fix possible AttributeError when account-api is called over unix socket (#16404)Christoph2023-10-091-1/+1
| | | Fixes #16396
* Refactor `get_user_by_id` (#16316)Erik Johnston2023-09-142-2/+2
|
* Revert MSC3861 introspection cache, admin impersonation and account lock ↵Quentin Gliech2023-09-061-85/+6
| | | | (#16258)
* Add an admin endpoint to allow authorizing server to signal token ↵Shay2023-08-221-0/+13
| | | | revocations (#16125)
* MSC3861: allow impersonation by an admin using a query param (#16132)Mathieu Velten2023-08-181-3/+22
|
* Add response time metrics for introspection requests (#16131)Erik Johnston2023-08-181-7/+27
| | | See #16119
* Cache token introspection response from OIDC provider (#16117)Shay2023-08-171-2/+38
|
* Implements admin API to lock an user (MSC3939) (#15870)Mathieu Velten2023-08-103-1/+28
|
* Add stricter mypy options (#15694)Patrick Cloke2023-05-311-1/+1
| | | | Enable warn_unused_configs, strict_concatenate, disallow_subclassing_any, and disallow_incomplete_defs.
* Enforce that an admin token also has the basic Matrix API scopeQuentin Gliech2023-05-301-5/+2
|
* Reject tokens with multiple device scopesQuentin Gliech2023-05-301-6/+24
|
* Make OIDC scope constantsQuentin Gliech2023-05-301-10/+15
|
* Handle errors when introspecting tokensQuentin Gliech2023-05-301-5/+37
| | | | | This returns a proper 503 when the introspection endpoint is not working for some reason, which should avoid logging out clients in those cases.
* Make AS tokens work & allow ASes to /registerQuentin Gliech2023-05-303-83/+88
|
* Add an admin token for MAS -> Synapse callsQuentin Gliech2023-05-301-0/+15
|
* Refactor config to be an experimental featureHugh Nimmo-Smith2023-05-301-25/+28
| | | | Also enforce you can't combine it with incompatible config options
* Actually enforce guest + return www-authenticate headerHugh Nimmo-Smith2023-05-301-2/+16
|
* MSC2967: Check access token scope for use as user and add guest supportHugh Nimmo-Smith2023-05-301-10/+20
|
* Use `name` claim as display name when registering users on the fly.Hugh Nimmo-Smith2023-05-301-1/+8
| | | | | This makes is so that the `name` claim got when introspecting the token is used as the display name when registering a user on the fly.
* Record the `sub` claims as an external_idQuentin Gliech2023-05-301-22/+37
|
* Handle the Synapse admin scopeQuentin Gliech2023-05-301-0/+3
|
* Save the scopes in the requesterQuentin Gliech2023-05-301-0/+1
|
* Initial MSC3964 support: delegation of auth to OIDC serverQuentin Gliech2023-05-301-0/+227
|
* Make the api.auth.Auth a ProtocolQuentin Gliech2023-05-303-0/+817