summary refs log tree commit diff
path: root/synapse/handlers/auth.py (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Support CAS in UI Auth flows. (#7186)Patrick Cloke2020-04-031-2/+2
|
* Support SAML in the user interactive authentication workflow. (#7102)Patrick Cloke2020-04-011-4/+112
|
* Validate that the session is not modified during UI-Auth (#7068)Patrick Cloke2020-03-261-4/+33
|
* Add type annotations and comments to auth handler (#7063)Patrick Cloke2020-03-121-89/+104
|
* Factor out complete_sso_login and expose it to the Module APIBrendan Abolivier2020-03-031-0/+74
|
* Admin api to add an email address (#6789)Dirk Klimpel2020-02-071-0/+8
|
* Merge pull request #6335 from matrix-org/erikj/rc_login_cleanupsBrendan Abolivier2019-11-201-53/+31
|\ | | | | Only do `rc_login` ratelimiting on succesful login.
| * Apply suggestions from code reviewErik Johnston2019-11-181-2/+2
| | | | | | | | Co-Authored-By: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-Authored-By: Brendan Abolivier <babolivier@matrix.org>
| * Add failed auth ratelimiting to UIAErik Johnston2019-11-061-1/+32
| |
| * Only do `rc_login` ratelimiting on succesful login.Erik Johnston2019-11-061-54/+1
| | | | | | | | | | | | | | | | | | | | | | | | We were doing this in a number of places which meant that some login code paths incremented the counter multiple times. It was also applying ratelimiting to UIA endpoints, which was probably not intentional. In particular, some custom auth modules were calling `check_user_exists`, which incremented the counters, meaning that people would fail to login sometimes.
* | Replace instance variations of homeserver with correct case/spacingAndrew Morgan2019-11-121-2/+2
|/
* Remove usage of deprecated logger.warn method from codebase (#6271)Andrew Morgan2019-10-311-3/+3
| | | Replace every instance of `logger.warn` with `logger.warning` as the former is deprecated.
* Stop advertising unsupported flows for registration (#6107)Richard van der Hoff2019-09-251-1/+10
| | | | | | | If email or msisdn verification aren't supported, let's stop advertising them for registration. Fixes #6100.
* Refactor the user-interactive auth handling (#6105)Richard van der Hoff2019-09-251-131/+10
| | | | | | | Pull the checkers out to their own classes, rather than having them lost in a massive 1000-line class which does everything. This is also preparation for some more intelligent advertising of flows, as per #6100
* Use account_threepid_delegate for 3pid validationAndrew Morgan2019-09-101-1/+10
|
* Allow Synapse to send registration emails + choose Synapse or an external ↵Andrew Morgan2019-09-061-26/+8
| | | | | | | | | | | | | | | | server to handle 3pid validation (#5987) This is a combination of a few different PRs, finally all being merged into `develop`: * #5875 * #5876 * #5868 (This one added the `/versions` flag but the flag itself was actually [backed out](https://github.com/matrix-org/synapse/commit/891afb57cbdf9867f2848341b29c75d6f35eef5a#diff-e591d42d30690ffb79f63bb726200891) in #5969. What's left is just giving /versions access to the config file, which could be useful in the future) * #5835 * #5969 * #5940 Clients should not actually use the new registration functionality until https://github.com/matrix-org/synapse/pull/5972 is merged. UPGRADE.rst, changelog entries and config file changes should all be reviewed closely before this PR is merged.
* Remove unnecessary parentheses around return statements (#5931)Andrew Morgan2019-08-301-4/+4
| | | | | Python will return a tuple whether there are parentheses around the returned values or not. I'm just sick of my editor complaining about this all over the place :)
* Remove non-functional 'expire_access_token' setting (#5782)Richard van der Hoff2019-07-301-1/+1
| | | | | | | | The `expire_access_token` didn't do what it sounded like it should do. What it actually did was make Synapse enforce the 'time' caveat on macaroons used as access tokens, but since our access token macaroons never contained such a caveat, it was always a no-op. (The code to add 'time' caveats was removed back in v0.18.5, in #1656)
* Replace returnValue with return (#5736)Amber Brown2019-07-231-22/+22
|
* Return a different error from Invalid Password when a user is deactivated ↵Andrew Morgan2019-07-151-0/+9
| | | | | (#5674) Return `This account has been deactivated` instead of `Invalid password` when a user is deactivated.
* Implement access token expiry (#5660)Richard van der Hoff2019-07-121-3/+14
| | | | Record how long an access token is valid for, and raise a soft-logout once it expires.
* Inline issue_access_token (#5659)Richard van der Hoff2019-07-111-7/+3
| | | | | | | | this is only used in one place, so it's clearer if we inline it and reduce the API surface. Also, fixes a buglet where we would create an access token even if we were about to block the user (we would never return the AT, so the user could never use it, but it was still created and added to the db.)
* Move logging utilities out of the side drawer of util/ and into logging/ (#5606)Amber Brown2019-07-041-3/+3
|
* Added possibilty to disable local password authentication (#5092)Daniel Hoffend2019-06-271-1/+1
| | | | | Signed-off-by: Daniel Hoffend <dh@dotlan.net>
* Run Black. (#5482)Amber Brown2019-06-201-145/+121
|
* Fix defaults on checking threepidsErik Johnston2019-06-101-0/+1
|
* Add ability to perform password reset via email without trusting the ↵Andrew Morgan2019-06-061-12/+52
| | | | | | | | | | | | identity server (#5377) Sends password reset emails from the homeserver instead of proxying to the identity server. This is now the default behaviour for security reasons. If you wish to continue proxying password reset requests to the identity server you must now enable the email.trust_identity_server_for_password_resets option. This PR is a culmination of 3 smaller PRs which have each been separately reviewed: * #5308 * #5345 * #5368
* Allowing specifying IS to use in unbind API.Erik Johnston2019-04-011-1/+6
| | | | | | | | | | By default the homeserver will use the identity server used during the binding of the 3PID to unbind the 3PID. However, we need to allow clients to explicitly ask the homeserver to unbind via a particular identity server, for the case where the 3PID was bound out of band from the homeserver. Implements MSC915.
* Support 3PID login in password providers (#4931)Andrew Morgan2019-03-261-1/+38
| | | | | Adds a new method, check_3pid_auth, which gives password providers the chance to allow authentication with third-party identifiers such as email or msisdn.
* Add ratelimiting on failed login attempts (#4865)Brendan Abolivier2019-03-181-5/+23
|
* Add ratelimiting on login (#4821)Brendan Abolivier2019-03-151-0/+36
| | | Add two ratelimiters on login (per-IP address and per-userID).
* Factor SSO success handling out of CAS login (#4264)Richard van der Hoff2018-12-071-2/+11
| | | | This is mostly factoring out the post-CAS-login code to somewhere we can reuse it for other SSO flows, but it also fixes the userid mapping while we're at it.
* Remove duplicate slashes in generated consent URLsTravis Ralston2018-11-151-1/+1
|
* Add config variables for enabling terms auth and the policy name (#4142)Travis Ralston2018-11-061-1/+1
| | | | So people can still collect consent the old way if they want to.
* Include a version query string arg for the consent routeTravis Ralston2018-10-311-1/+4
|
* Merge branch 'develop' into travis/login-termsTravis Ralston2018-10-241-14/+4
|\
| * Correctly account for cpu usage by background threads (#4074)Richard van der Hoff2018-10-231-14/+4
| | | | | | | | | | | | | | | | | | | | Wrap calls to deferToThread() in a thing which uses a child logcontext to attribute CPU usage to the right request. While we're in the area, remove the logcontext_tracer stuff, which is never used, and afaik doesn't work. Fixes #4064
* | pep8Travis Ralston2018-10-151-1/+1
| |
* | Ensure the terms params are actually providedTravis Ralston2018-10-151-0/+1
| |
* | Python is hardTravis Ralston2018-10-151-5/+6
| |
* | Update login terms structure for the proposed language supportTravis Ralston2018-10-121-4/+7
| |
* | Use a flag rather than a new route for the public policyTravis Ralston2018-10-031-1/+1
| | | | | | This also means that the template now has optional parameters, which will need to be documented somehow.
* | Supply params for terms auth stageTravis Ralston2018-10-031-0/+9
| | | | | | As per https://github.com/matrix-org/matrix-doc/pull/1692
* | Incorporate Dave's work for GDPR login flowsTravis Ralston2018-10-031-0/+4
|/ | | As per https://github.com/vector-im/riot-web/issues/7168#issuecomment-419996117
* Port handlers/ to Python 3 (#3803)Amber Brown2018-09-071-3/+5
|
* Merge branch 'develop' of github.com:matrix-org/synapse into ↵Neil Johnson2018-08-151-3/+17
|\ | | | | | | neilj/fix_off_by_1+maus
| * Merge pull request #3667 from matrix-org/erikj/fixup_unbindErik Johnston2018-08-151-3/+17
| |\ | | | | | | Don't fail requests to unbind 3pids for non supporting ID servers
| | * Don't fail requests to unbind 3pids for non supporting ID serversErik Johnston2018-08-081-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Older identity servers may not support the unbind 3pid request, so we shouldn't fail the requests if we received one of 400/404/501. The request still fails if we receive e.g. 500 responses, allowing clients to retry requests on transient identity server errors that otherwise do support the API. Fixes #3661
* | | fix off by 1s on mauNeil Johnson2018-08-141-2/+2
|/ /
* | bug fixesNeil Johnson2018-08-031-13/+2
| |
* | do mau checks based on monthly_active_users tableNeil Johnson2018-08-021-6/+4
|/
* Merge pull request #3630 from matrix-org/neilj/mau_sign_in_log_in_limitsNeil Johnson2018-08-011-1/+18
|\ | | | | Initial impl of capping MAU
| * count_monthly_users() asyncNeil Johnson2018-08-011-4/+7
| |
| * coding styleNeil Johnson2018-07-311-1/+2
| |
| * limit register and sign in on number of monthly usersNeil Johnson2018-07-301-0/+13
| |
* | Python 3: Convert some unicode/bytes uses (#3569)Amber Brown2018-08-021-9/+20
|/
* run isortAmber Brown2018-07-091-12/+14
|
* Attempt to be more performant on PyPy (#3462)Amber Brown2018-06-281-2/+3
|
* Pass around the reactor explicitly (#3385)Amber Brown2018-06-221-10/+20
|
* Remove run_on_reactor (#3395)Amber Brown2018-06-141-6/+2
|
* Merge pull request #3276 from matrix-org/dbkr/unbindDavid Baker2018-06-111-0/+9
|\ | | | | Remove email addresses / phone numbers from ID servers when they're removed from synapse
| * Missing yieldDavid Baker2018-06-041-1/+1
| |
| * pep8David Baker2018-05-241-1/+2
| |
| * Unbind 3pids when they're deleted tooDavid Baker2018-05-241-0/+8
| |
* | Consistently use six's iteritems and wrap lazy keys/values in list() if ↵Amber Brown2018-05-311-3/+3
|/ | | | they're not meant to be lazy (#3307)
* use bcrypt.checkpwKrombel2018-03-051-2/+4
| | | | | | | | in bcrypt 3.1.0 checkpw got introduced (already 2 years ago) This makes use of that with enhancements which might get introduced by that Signed-Off-by: Matthias Kesler <krombel@krombel.de>
* Merge pull request #2773 from matrix-org/erikj/hash_bgErik Johnston2018-01-101-8/+16
|\ | | | | Do bcrypt hashing in a background thread
| * Do bcrypt hashing in a background threadErik Johnston2018-01-101-8/+16
| |
* | support custom login types for validating usersRichard van der Hoff2017-12-051-24/+57
| | | | | | | | | | Wire the custom login type support from password providers into the UI-auth user-validation flows.
* | Factor out a validate_user_via_ui_auth methodRichard van der Hoff2017-12-051-0/+43
| | | | | | | | Collect together all the places that validate a logged-in user via UI auth.
* | Refactor UI auth implementationRichard van der Hoff2017-12-051-17/+29
|/ | | | | Instead of returning False when auth is incomplete, throw an exception which can be caught with a wrapper.
* Move set_password into its own handlerRichard van der Hoff2017-11-291-16/+0
| | | | | | Non-functional refactoring to move set_password. This means that we'll be able to properly deactivate devices and access tokens without introducing a dependency loop.
* Move deactivate_account into its own handlerRichard van der Hoff2017-11-291-16/+0
| | | | | | Non-functional refactoring to move deactivate_account. This means that we'll be able to properly deactivate devices and access tokens without introducing a dependency loop.
* Remove pushers when deleting access tokensRichard van der Hoff2017-11-291-4/+12
| | | | | Whenever an access token is invalidated, we should remove the associated pushers.
* Fix auth handler #2678Jurek2017-11-161-1/+1
|
* Factor _AccountHandler proxy out to ModuleApiRichard van der Hoff2017-11-021-69/+3
| | | | | We're going to need to use this from places that aren't password auth, so let's move it to a proper class.
* Merge pull request #2624 from matrix-org/rav/password_provider_notify_logoutDavid Baker2017-11-021-2/+24
|\ | | | | Notify auth providers on logout
| * Notify auth providers on logoutRichard van der Hoff2017-11-011-2/+24
| | | | | | | | Provide a hook by which auth providers can be notified of logouts.
* | Merge pull request #2623 from matrix-org/rav/callbacks_for_auth_providersDavid Baker2017-11-021-6/+11
|\ \ | | | | | | Allow password_auth_providers to return a callback
| * | Fix user-interactive password authRichard van der Hoff2017-11-011-1/+3
| | | | | | | | | | | | this got broken in the previous commit
| * | Allow password_auth_providers to return a callbackRichard van der Hoff2017-11-011-5/+8
| |/ | | | | | | ... so that they have a way to record access tokens.
* | Merge pull request #2622 from matrix-org/rav/db_access_for_auth_providersDavid Baker2017-11-021-0/+16
|\ \ | |/ |/| Let auth providers get to the database
| * Let auth providers get to the databaseRichard van der Hoff2017-10-311-0/+16
| | | | | | | | Somewhat open to abuse, but also somewhat unavoidable :/
* | Merge pull request #2620 from matrix-org/rav/auth_non_passwordRichard van der Hoff2017-11-011-22/+96
|\ \ | | | | | | Let password auth providers handle arbitrary login types
| * | Let password auth providers handle arbitrary login typesRichard van der Hoff2017-11-011-22/+96
| |/ | | | | | | | | Provide a hook where password auth providers can say they know about other login types, and get passed the relevant parameters
* | Merge remote-tracking branch 'origin/develop' into ↵David Baker2017-11-011-9/+6
|\ \ | | | | | | | | | rav/refactor_accesstoken_delete
| * | Break dependency of auth_handler on device_handlerRichard van der Hoff2017-11-011-9/+6
| |/ | | | | | | | | | | | | | | | | I'm going to need to make the device_handler depend on the auth_handler, so I need to break this dependency to avoid a cycle. It turns out that the auth_handler was only using the device_handler in one place which was an edge case which we can more elegantly handle by throwing an error rather than fixing it up.
* / Move access token deletion into auth handlerRichard van der Hoff2017-11-011-2/+47
|/ | | | | | | Also move duplicated deactivation code into the auth handler. I want to add some hooks when we deactivate an access token, so let's bring it all in here so that there's somewhere to put it.
* Refactor some logic from LoginRestServlet into AuthHandlerRichard van der Hoff2017-10-311-28/+52
| | | | | | | | | | | | | | I'm going to need some more flexibility in handling login types in password auth providers, so as a first step, move some stuff from LoginRestServlet into AuthHandler. In particular, we pass everything other than SAML, JWT and token logins down to the AuthHandler, which now has responsibility for checking the login type and fishing the password out of the login dictionary, as well as qualifying the user_id if need be. Ideally SAML, JWT and token would go that way too, but there's no real need for it right now and I'm trying to minimise impact. This commit *should* be non-functional.
* Allow ASes to deactivate their own usersRichard van der Hoff2017-10-271-1/+1
|
* Remove pointless create() methodRichard van der Hoff2017-10-201-1/+1
| | | | | It just calls the constructor, so we may as well kill it rather than having random codepaths.
* Use an ExpiringCache for storing registration sessionsErik Johnston2017-06-291-11/+10
| | | | | This is because pruning them was a significant performance drain on matrix.org
* Support registration / login with phone numberDavid Baker2017-03-131-7/+25
| | | | Changes from https://github.com/matrix-org/synapse/pull/1971
* Revert "Support registration & login with phone number"Erik Johnston2017-03-131-25/+7
|
* Fix log lineDavid Baker2017-03-081-1/+1
|
* Factor out msisdn canonicalisationDavid Baker2017-03-081-1/+1
| | | | Plus a couple of other minor fixes
* Fix pep8David Baker2017-03-081-1/+1
|
* Just return the deferred straight offDavid Baker2017-03-011-4/+2
| | | | | defer.returnValue doth not maketh a generator: it would need a yield to be a generator, and this doesn't need a yield.
* WIP support for msisdn 3pid proxy methodsDavid Baker2017-02-141-5/+25
|
* Fix email push in pusher workerErik Johnston2017-02-021-36/+44
| | | | | | This was broken when device list updates were implemented, as Mailer could no longer instantiate an AuthHandler due to a dependency on federation sending.
* Fix another comment typoDavid Baker2016-12-211-1/+1
|
* Add /account/3pid/delete endpointDavid Baker2016-12-201-0/+11
| | | | Also fix a typo in a comment
* fix ability to change password to a non-ascii oneMatthew Hodgson2016-12-181-2/+2
| | | | https://github.com/vector-im/riot-web/issues/2658
* Merge pull request #1649 from matrix-org/dbkr/log_ui_auth_argsErik Johnston2016-12-051-1/+9
|\ | | | | Log the args that we have on UI auth completion
| * Clarify that creds doesn not contain passwords.David Baker2016-11-241-1/+3
| |
| * Log the args that we have on UI auth completionDavid Baker2016-11-241-1/+7
| | | | | | | | | | This will be super helpful for debugging if we have more registration woes.
* | Rip out more refresh_token codeRichard van der Hoff2016-11-301-10/+0
| | | | | | | | | | | | | | | | We might as well treat all refresh_tokens as invalid. Just return a 403 from /tokenrefresh, so that we don't have a load of dead, untestable code hanging around. Still TODO: removing the table from the schema.
* | Merge branch 'develop' into rav/no_more_refresh_tokensRichard van der Hoff2016-11-301-5/+6
|\ \
| * | Stop putting a time caveat on access tokensRichard van der Hoff2016-11-291-5/+6
| |/ | | | | | | | | | | | | | | The 'time' caveat on the access tokens was something of a lie, since we weren't enforcing it; more pertinently its presence stops us ever adding useful time caveats. Let's move in the right direction by not lying in our caveats.
* / Stop generating refresh tokensRichard van der Hoff2016-11-281-16/+4
|/ | | | | | | Since we're not doing refresh tokens any more, we should start killing off the dead code paths. /tokenrefresh itself is a bit of a thornier subject, since there might be apps out there using it, but we can at least not generate refresh tokens on new logins.
* Use external ldap auth pacakgeErik Johnston2016-11-151-0/+2
|
* Don't error on non-ascii passwordsDavid Baker2016-11-031-1/+1
|
* Convert emails to lowercase when storingDavid Baker2016-10-191-0/+12
| | | | And db migration sql to convert existing addresses.
* Merge pull request #1155 from matrix-org/erikj/pluggable_pwd_authErik Johnston2016-10-121-295/+39
|\ | | | | Implement pluggable password auth
| * Implement pluggable password authErik Johnston2016-10-031-295/+39
| | | | | | | | | | | | Allows delegating the password auth to an external module. This also moves the LDAP auth to using this system, allowing it to be removed from the synapse tree entirely in the future.
* | Work around email-spamming Riot bugRichard van der Hoff2016-10-111-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 5d9546f9 introduced a change to synapse behaviour, in that failures in the interactive-auth process would return the flows and params data as well as an error code (as specced in https://github.com/matrix-org/matrix-doc/pull/397). That change exposed a bug in Riot which would make it request a new validation token (and send a new email) each time it got a 401 with a `flows` parameter (see https://github.com/vector-im/vector-web/issues/2447 and the fix at https://github.com/matrix-org/matrix-react-sdk/pull/510). To preserve compatibility with broken versions of Riot, grandfather in the old behaviour for the email validation stage.
* | Merge pull request #1160 from matrix-org/rav/401_on_password_failRichard van der Hoff2016-10-071-32/+52
|\ \ | |/ |/| Interactive Auth: Return 401 from for incorrect password
| * Interactive Auth: Return 401 from for incorrect passwordRichard van der Hoff2016-10-071-32/+52
| | | | | | | | | | | | | | | | | | This requires a bit of fettling, because I want to return a helpful error message too but we don't want to distinguish between unknown user and invalid password. To avoid hardcoding the error message into 15 places in the code, I've had to refactor a few methods to return None instead of throwing. Fixes https://matrix.org/jira/browse/SYN-744
* | Restructure ldap authenticationMartin Weinelt2016-09-291-87/+192
|/ | | | | | | | - properly parse return values of ldap bind() calls - externalize authentication methods - change control flow to be more error-resilient - unbind ldap connections in many places - improve log messages and loglevels
* Refactor user_delete_access_tokens. Invalidate get_user_by_access_token to ↵Erik Johnston2016-08-151-3/+3
| | | | slaves.
* Log the value which is observed in the first place.Daniel Ehlers2016-08-141-1/+1
| | | | | | | | The name 'result' is of bool type and has no len property, resulting in a TypeError. Futhermore in the flow control conn.response is observed and hence should be reported. Signed-off-by: Daniel Ehlers <sargon@toppoint.de>
* Fix AttributeError when bind_dn is not defined.Daniel Ehlers2016-08-141-1/+1
| | | | | | | | | In case one does not define bind_dn in ldap configuration, filter attribute is not declared. Since auth code only uses ldap_filter attribute when according LDAP mode is selected, it is safe to only declare the attribute in that case. Signed-off-by: Daniel Ehlers <sargon@toppoint.de>
* /login: Respond with a 403 when we get an invalid m.login.tokenRichard van der Hoff2016-08-091-3/+3
|
* Fix login with m.login.tokenRichard van der Hoff2016-08-081-13/+4
| | | | | login with token (as used by CAS auth) was broken by 067596d, such that it always returned a 401.
* Implement deleting devicesRichard van der Hoff2016-07-261-2/+20
|
* Use get to avoid KeyErrorsDavid Baker2016-07-221-1/+1
|
* Log the hostname the reCAPTCHA was completed onDavid Baker2016-07-221-2/+11
| | | | This could be useful information to have in the logs. Also comment about how & why we don't verify the hostname.
* Type annotationsRichard van der Hoff2016-07-191-0/+4
| | | | | Add some type annotations to help PyCharm (in particular) to figure out the types of a bunch of things.
* Add device_id support to /loginRichard van der Hoff2016-07-181-8/+11
| | | | | | | | | | | | | Add a 'devices' table to the storage, as well as a 'device_id' column to refresh_tokens. Allow the client to pass a device_id, and initial_device_display_name, to /login. If login is successful, then register the device in the devices table if it wasn't known already. If no device_id was supplied, make one up. Associate the device_id with the access token and refresh token, so that we can get at it again later. Ensure that the device_id is copied from the refresh token to the access_token when the token is refreshed.
* Refactor login flowRichard van der Hoff2016-07-181-47/+59
| | | | | | | | | | Make sure that we have the canonical user_id *before* calling get_login_tuple_for_user_id. Replace login_with_password with a method which just validates the password, and have the caller call get_login_tuple_for_user_id. This brings the password flow into line with the other flows, and will give us a place to register the device_id if necessary.
* Bug fix: expire invalid access tokensNegar Fazeli2016-07-131-2/+3
|
* Fix password configKent Shikama2016-07-051-2/+2
|
* Fix pep8Kent Shikama2016-07-051-1/+2
|
* Add pepper to password hashingKent Shikama2016-07-051-2/+3
| | | | Signed-off-by: Kent Shikama <kent@kentshikama.com>
* Rework ldap integration with ldap3Martin Weinelt2016-06-221-33/+170
| | | | | | | | | | | | | | | | | | | Use the pure-python ldap3 library, which eliminates the need for a system dependency. Offer both a `search` and `simple_bind` mode, for more sophisticated ldap scenarios. - `search` tries to find a matching DN within the `user_base` while employing the `user_filter`, then tries the bind when a single matching DN was found. - `simple_bind` tries the bind against a specific DN by combining the localpart and `user_base` Offer support for STARTTLS on a plain connection. The configuration was changed to reflect these new possibilities. Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
* Fix TypeError in call to bcrypt.hashpwSalvatore LaMendola2016-06-161-1/+1
| | | | | | | | - At the very least, this TypeError caused logins to fail on my own running instance of Synapse, and the simple (explicit) UTF-8 conversion resolved login errors for me. Signed-off-by: Salvatore LaMendola <salvatore.lamendola@gmail.com>
* Email unsubscribing that may in theory, workDavid Baker2016-06-021-0/+5
| | | | Were it not for that fact that you can't use the base handler in the pusher because it pulls in the world. Comitting while I fix that on a different branch.
* Send down correct error response if user not foundErik Johnston2016-05-271-2/+7
|
* Merge pull request #741 from negzi/create_user_with_expiryErik Johnston2016-05-131-2/+2
|\ | | | | Create user with expiry
| * Create user with expiryNegi Fazeli2016-05-131-2/+2
| | | | | | | | | | | | - Add unittests for client, api and handler Signed-off-by: Negar Fazeli <negar.fazeli@ericsson.com>
* | Correctly handle NULL password hashes from the databaseErik Johnston2016-05-111-1/+4
|/
* Simplify _check_passwordErik Johnston2016-04-151-5/+9
|
* Fix check_password rather than inverting the meaning of ↵Mark Haines2016-04-141-9/+12
| | | | _check_local_password (#730)
* Fix login to error for nonexistent usersDavid Baker2016-04-141-1/+1
| | | | Fixes SYN-680
* fix check for failed authenticationChristoph Witzany2016-04-061-2/+4
|
* remove lineChristoph Witzany2016-04-061-1/+0
|
* make tests for ldap more specific to not be fooled by MocksChristoph Witzany2016-04-061-3/+3
|
* output ldap version for info and to pacify pep8Christoph Witzany2016-04-061-0/+2
|
* conditionally import ldapChristoph Witzany2016-04-061-2/+5
|
* fix pep8Christoph Witzany2016-04-061-2/+1
|
* fix exception handlingChristoph Witzany2016-04-061-2/+2
|
* code styleChristoph Witzany2016-04-061-6/+13
|
* add tls property and twist my head around twistedChristoph Witzany2016-04-061-15/+29
|
* move LDAP authentication to AuthenticationHandlerChristoph Witzany2016-04-061-6/+48
|
* Use google style doc strings.Mark Haines2016-04-011-9/+17
| | | | | | | pycharm supports them so there is no need to use the other format. Might as well convert the existing strings to reduce the risk of people accidentally cargo culting the wrong doc string format.
* Make registration idempotent, part 2: be idempotent if the client specifies ↵David Baker2016-03-161-0/+14
| | | | a username.
* pep8David Baker2016-03-161-1/+2
|
* time_msec()David Baker2016-03-161-1/+1
|
* string with symbols is a bit too symboly.David Baker2016-03-161-1/+1
|
* Replace other time.time().David Baker2016-03-161-2/+1
|
* Use hs get_clock instead of time.time()David Baker2016-03-161-2/+2
|
* pep8 & remove debug loggingDavid Baker2016-03-161-1/+1
|
* Make registration idempotent: if you specify the same session, make it give ↵David Baker2016-03-161-12/+48
| | | | you an access token for the user that was registered on previous uses of that session. Tweak the UI auth layer to not delete sessions when their auth has completed and hence expire themn so they don't hang around until server restart. Allow server-side data to be associated with UI auth sessions.
* Make select more sensible when dseleting access tokens, rename pusher ↵David Baker2016-03-111-1/+1
| | | | deletion to match access token deletion and make exception arg optional.
* Delete old, unused methods and rename new one to just be ↵David Baker2016-03-111-1/+1
| | | | `user_delete_access_tokens` with an `except_token_ids` argument doing what it says on the tin.
* Dear PyCharm, please indent sensibly for me. Thx.David Baker2016-03-111-2/+2
|
* Fix cache invalidation so deleting access tokens (which we did when changing ↵David Baker2016-03-111-4/+9
| | | | password) actually takes effect without HS restart. Reinstate the code to avoid logging out the session that changed the password, removed in 415c2f05491ce65a4fc34326519754cd1edd9c54
* Stop using checkpw as it seems to have vanished from bcrypt. Use ↵David Baker2016-03-021-1/+1
| | | | `bcrypt.hashpw(password, hashed) == hashed` as per the bcrypt README.
* Allow guests to upgrade their accountsDaniel Wagner-Hall2016-01-051-3/+3
|
* Take a boolean not a list of lambdasDaniel Wagner-Hall2015-11-191-1/+1
|
* Minor review fixesSteven Hammerton2015-11-111-4/+4
|
* Share more code between macaroon validationSteven Hammerton2015-11-111-48/+7
|
* Allow hs to do CAS login completely and issue the client with a login token ↵Steven Hammerton2015-11-051-3/+73
| | | | that can be redeemed for the usual successful login response
* Allow guests to register and call /events?room_id=Daniel Wagner-Hall2015-11-041-1/+4
| | | | | | | This follows the same flows-based flow as regular registration, but as the only implemented flow has no requirements, it auto-succeeds. In the future, other flows (e.g. captcha) may be required, so clients should treat this like the regular registration flow choices.
* Add config for how many bcrypt rounds to use for password hashesMark Haines2015-10-161-1/+2
| | | | | By default we leave it at the default value of 12. But now we can reduce it for preparing users for loadtests or running integration tests.
* Formatting changesSteven Hammerton2015-10-101-1/+2
|
* Provide ability to login using CASSteven Hammerton2015-10-101-0/+31
|
* Allow configuration to ignore invalid SSL certsDaniel Wagner-Hall2015-09-091-2/+1
| | | | | This will be useful for sytest, and sytest only, hence the aggressive config key name.
* Swap out bcrypt for md5 in testsDaniel Wagner-Hall2015-08-261-2/+25
| | | | This reduces our ~8 second sequential test time down to ~7 seconds
* Merge erikj/user_dedup to developDaniel Wagner-Hall2015-08-261-8/+31
|
* Fix bad mergeDaniel Wagner-Hall2015-08-201-8/+1
|
* Fix indentationDaniel Wagner-Hall2015-08-201-1/+2
|
* Fix flake8 warningsDaniel Wagner-Hall2015-08-201-4/+6
|
* Merge branch 'auth' into refreshDaniel Wagner-Hall2015-08-201-3/+3
|\ | | | | | | | | Conflicts: synapse/handlers/register.py
* | Merge branch 'develop' into refreshDaniel Wagner-Hall2015-08-201-1/+1
|\| | | | | | | | | Conflicts: synapse/rest/client/v1/login.py
| * Another use of check_password that got missed in the yield fixDavid Baker2015-08-201-1/+1
| |
* | /tokenrefresh POST endpointDaniel Wagner-Hall2015-08-201-5/+30
| | | | | | | | | | | | | | | | This allows refresh tokens to be exchanged for (access_token, refresh_token). It also starts issuing them on login, though no clients currently interpret them.
* | Move token generation to auth handlerDaniel Wagner-Hall2015-08-201-5/+24
|/ | | | | I prefer the auth handler to worry about all auth, and register to call into it as needed, than to smatter auth logic between the two.
* Remove an access token log lineErik Johnston2015-08-191-1/+1
|
* Fix regression where we incorrectly responded with a 200 to /loginErik Johnston2015-08-191-1/+2
|
* Merge password checking implementationsDaniel Wagner-Hall2015-08-121-20/+15
|
* Simplify LoginHander and AuthHandlerDaniel Wagner-Hall2015-08-121-18/+72
| | | | | | | | | * Merge LoginHandler -> AuthHandler * Add a bunch of documentation * Improve some naming * Remove unused branches I will start merging the actual logic of the two handlers shortly
* Add back in support for remembering parameters submitted to a ↵David Baker2015-07-151-2/+4
| | | | user-interactive auth call.
* Merge branch 'develop' into markjh/SYT-8-recaptchaMark Haines2015-05-291-0/+1
|\ | | | | | | | | Conflicts: synapse/handlers/auth.py
| * SYN-395: Fix CAPTCHA, don't double decode jsonErik Johnston2015-05-281-2/+3
| |
* | Add config for setting the recaptcha verify api endpoint, so we can test it ↵Mark Haines2015-05-291-3/+3
|/ | | | in sytest
* This api now no longer returns an arrayDavid Baker2015-05-011-1/+1
|
* Add commentage.David Baker2015-04-271-0/+4
|
* Use underscores instead of camelcase for id server stuffDavid Baker2015-04-241-6/+6
|
* pep8David Baker2015-04-241-2/+2
|
* Remove ultimately unused feature of saving params from the first call in the ↵David Baker2015-04-231-2/+10
| | | | session: it's probably too open to abuse.
* Password reset, finally.David Baker2015-04-171-1/+7
|
* Return user ID in use error straight awayDavid Baker2015-04-161-0/+2
|
* Dummy login so we can do the first POST request to get login flows without ↵David Baker2015-04-151-0/+6
| | | | it just succeeding
* Regstration with email in v2David Baker2015-04-151-21/+43
|
* Completely replace fallback auth for C/S V2:David Baker2015-04-011-21/+77
| | | | | | | * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
* pep8David Baker2015-03-311-1/+1
|
* New registration for C/S API v2. Only ReCAPTCHA working currently.David Baker2015-03-301-13/+77
|
* Implement password changing (finally) along with a start on making ↵David Baker2015-03-231-0/+109
client/server auth more general.