summary refs log tree commit diff
path: root/synapse/handlers/auth.py (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Attempt to be more performant on PyPy (#3462)Amber Brown2018-06-281-2/+3
|
* Pass around the reactor explicitly (#3385)Amber Brown2018-06-221-10/+20
|
* Remove run_on_reactor (#3395)Amber Brown2018-06-141-6/+2
|
* Merge pull request #3276 from matrix-org/dbkr/unbindDavid Baker2018-06-111-0/+9
|\ | | | | Remove email addresses / phone numbers from ID servers when they're removed from synapse
| * Missing yieldDavid Baker2018-06-041-1/+1
| |
| * pep8David Baker2018-05-241-1/+2
| |
| * Unbind 3pids when they're deleted tooDavid Baker2018-05-241-0/+8
| |
* | Consistently use six's iteritems and wrap lazy keys/values in list() if ↵Amber Brown2018-05-311-3/+3
|/ | | | they're not meant to be lazy (#3307)
* use bcrypt.checkpwKrombel2018-03-051-2/+4
| | | | | | | | in bcrypt 3.1.0 checkpw got introduced (already 2 years ago) This makes use of that with enhancements which might get introduced by that Signed-Off-by: Matthias Kesler <krombel@krombel.de>
* Merge pull request #2773 from matrix-org/erikj/hash_bgErik Johnston2018-01-101-8/+16
|\ | | | | Do bcrypt hashing in a background thread
| * Do bcrypt hashing in a background threadErik Johnston2018-01-101-8/+16
| |
* | support custom login types for validating usersRichard van der Hoff2017-12-051-24/+57
| | | | | | | | | | Wire the custom login type support from password providers into the UI-auth user-validation flows.
* | Factor out a validate_user_via_ui_auth methodRichard van der Hoff2017-12-051-0/+43
| | | | | | | | Collect together all the places that validate a logged-in user via UI auth.
* | Refactor UI auth implementationRichard van der Hoff2017-12-051-17/+29
|/ | | | | Instead of returning False when auth is incomplete, throw an exception which can be caught with a wrapper.
* Move set_password into its own handlerRichard van der Hoff2017-11-291-16/+0
| | | | | | Non-functional refactoring to move set_password. This means that we'll be able to properly deactivate devices and access tokens without introducing a dependency loop.
* Move deactivate_account into its own handlerRichard van der Hoff2017-11-291-16/+0
| | | | | | Non-functional refactoring to move deactivate_account. This means that we'll be able to properly deactivate devices and access tokens without introducing a dependency loop.
* Remove pushers when deleting access tokensRichard van der Hoff2017-11-291-4/+12
| | | | | Whenever an access token is invalidated, we should remove the associated pushers.
* Fix auth handler #2678Jurek2017-11-161-1/+1
|
* Factor _AccountHandler proxy out to ModuleApiRichard van der Hoff2017-11-021-69/+3
| | | | | We're going to need to use this from places that aren't password auth, so let's move it to a proper class.
* Merge pull request #2624 from matrix-org/rav/password_provider_notify_logoutDavid Baker2017-11-021-2/+24
|\ | | | | Notify auth providers on logout
| * Notify auth providers on logoutRichard van der Hoff2017-11-011-2/+24
| | | | | | | | Provide a hook by which auth providers can be notified of logouts.
* | Merge pull request #2623 from matrix-org/rav/callbacks_for_auth_providersDavid Baker2017-11-021-6/+11
|\ \ | | | | | | Allow password_auth_providers to return a callback
| * | Fix user-interactive password authRichard van der Hoff2017-11-011-1/+3
| | | | | | | | | | | | this got broken in the previous commit
| * | Allow password_auth_providers to return a callbackRichard van der Hoff2017-11-011-5/+8
| |/ | | | | | | ... so that they have a way to record access tokens.
* | Merge pull request #2622 from matrix-org/rav/db_access_for_auth_providersDavid Baker2017-11-021-0/+16
|\ \ | |/ |/| Let auth providers get to the database
| * Let auth providers get to the databaseRichard van der Hoff2017-10-311-0/+16
| | | | | | | | Somewhat open to abuse, but also somewhat unavoidable :/
* | Merge pull request #2620 from matrix-org/rav/auth_non_passwordRichard van der Hoff2017-11-011-22/+96
|\ \ | | | | | | Let password auth providers handle arbitrary login types
| * | Let password auth providers handle arbitrary login typesRichard van der Hoff2017-11-011-22/+96
| |/ | | | | | | | | Provide a hook where password auth providers can say they know about other login types, and get passed the relevant parameters
* | Merge remote-tracking branch 'origin/develop' into ↵David Baker2017-11-011-9/+6
|\ \ | | | | | | | | | rav/refactor_accesstoken_delete
| * | Break dependency of auth_handler on device_handlerRichard van der Hoff2017-11-011-9/+6
| |/ | | | | | | | | | | | | | | | | I'm going to need to make the device_handler depend on the auth_handler, so I need to break this dependency to avoid a cycle. It turns out that the auth_handler was only using the device_handler in one place which was an edge case which we can more elegantly handle by throwing an error rather than fixing it up.
* / Move access token deletion into auth handlerRichard van der Hoff2017-11-011-2/+47
|/ | | | | | | Also move duplicated deactivation code into the auth handler. I want to add some hooks when we deactivate an access token, so let's bring it all in here so that there's somewhere to put it.
* Refactor some logic from LoginRestServlet into AuthHandlerRichard van der Hoff2017-10-311-28/+52
| | | | | | | | | | | | | | I'm going to need some more flexibility in handling login types in password auth providers, so as a first step, move some stuff from LoginRestServlet into AuthHandler. In particular, we pass everything other than SAML, JWT and token logins down to the AuthHandler, which now has responsibility for checking the login type and fishing the password out of the login dictionary, as well as qualifying the user_id if need be. Ideally SAML, JWT and token would go that way too, but there's no real need for it right now and I'm trying to minimise impact. This commit *should* be non-functional.
* Allow ASes to deactivate their own usersRichard van der Hoff2017-10-271-1/+1
|
* Remove pointless create() methodRichard van der Hoff2017-10-201-1/+1
| | | | | It just calls the constructor, so we may as well kill it rather than having random codepaths.
* Use an ExpiringCache for storing registration sessionsErik Johnston2017-06-291-11/+10
| | | | | This is because pruning them was a significant performance drain on matrix.org
* Support registration / login with phone numberDavid Baker2017-03-131-7/+25
| | | | Changes from https://github.com/matrix-org/synapse/pull/1971
* Revert "Support registration & login with phone number"Erik Johnston2017-03-131-25/+7
|
* Fix log lineDavid Baker2017-03-081-1/+1
|
* Factor out msisdn canonicalisationDavid Baker2017-03-081-1/+1
| | | | Plus a couple of other minor fixes
* Fix pep8David Baker2017-03-081-1/+1
|
* Just return the deferred straight offDavid Baker2017-03-011-4/+2
| | | | | defer.returnValue doth not maketh a generator: it would need a yield to be a generator, and this doesn't need a yield.
* WIP support for msisdn 3pid proxy methodsDavid Baker2017-02-141-5/+25
|
* Fix email push in pusher workerErik Johnston2017-02-021-36/+44
| | | | | | This was broken when device list updates were implemented, as Mailer could no longer instantiate an AuthHandler due to a dependency on federation sending.
* Fix another comment typoDavid Baker2016-12-211-1/+1
|
* Add /account/3pid/delete endpointDavid Baker2016-12-201-0/+11
| | | | Also fix a typo in a comment
* fix ability to change password to a non-ascii oneMatthew Hodgson2016-12-181-2/+2
| | | | https://github.com/vector-im/riot-web/issues/2658
* Merge pull request #1649 from matrix-org/dbkr/log_ui_auth_argsErik Johnston2016-12-051-1/+9
|\ | | | | Log the args that we have on UI auth completion
| * Clarify that creds doesn not contain passwords.David Baker2016-11-241-1/+3
| |
| * Log the args that we have on UI auth completionDavid Baker2016-11-241-1/+7
| | | | | | | | | | This will be super helpful for debugging if we have more registration woes.
* | Rip out more refresh_token codeRichard van der Hoff2016-11-301-10/+0
| | | | | | | | | | | | | | | | We might as well treat all refresh_tokens as invalid. Just return a 403 from /tokenrefresh, so that we don't have a load of dead, untestable code hanging around. Still TODO: removing the table from the schema.
* | Merge branch 'develop' into rav/no_more_refresh_tokensRichard van der Hoff2016-11-301-5/+6
|\ \
| * | Stop putting a time caveat on access tokensRichard van der Hoff2016-11-291-5/+6
| |/ | | | | | | | | | | | | | | The 'time' caveat on the access tokens was something of a lie, since we weren't enforcing it; more pertinently its presence stops us ever adding useful time caveats. Let's move in the right direction by not lying in our caveats.
* / Stop generating refresh tokensRichard van der Hoff2016-11-281-16/+4
|/ | | | | | | Since we're not doing refresh tokens any more, we should start killing off the dead code paths. /tokenrefresh itself is a bit of a thornier subject, since there might be apps out there using it, but we can at least not generate refresh tokens on new logins.
* Use external ldap auth pacakgeErik Johnston2016-11-151-0/+2
|
* Don't error on non-ascii passwordsDavid Baker2016-11-031-1/+1
|
* Convert emails to lowercase when storingDavid Baker2016-10-191-0/+12
| | | | And db migration sql to convert existing addresses.
* Merge pull request #1155 from matrix-org/erikj/pluggable_pwd_authErik Johnston2016-10-121-295/+39
|\ | | | | Implement pluggable password auth
| * Implement pluggable password authErik Johnston2016-10-031-295/+39
| | | | | | | | | | | | Allows delegating the password auth to an external module. This also moves the LDAP auth to using this system, allowing it to be removed from the synapse tree entirely in the future.
* | Work around email-spamming Riot bugRichard van der Hoff2016-10-111-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 5d9546f9 introduced a change to synapse behaviour, in that failures in the interactive-auth process would return the flows and params data as well as an error code (as specced in https://github.com/matrix-org/matrix-doc/pull/397). That change exposed a bug in Riot which would make it request a new validation token (and send a new email) each time it got a 401 with a `flows` parameter (see https://github.com/vector-im/vector-web/issues/2447 and the fix at https://github.com/matrix-org/matrix-react-sdk/pull/510). To preserve compatibility with broken versions of Riot, grandfather in the old behaviour for the email validation stage.
* | Merge pull request #1160 from matrix-org/rav/401_on_password_failRichard van der Hoff2016-10-071-32/+52
|\ \ | |/ |/| Interactive Auth: Return 401 from for incorrect password
| * Interactive Auth: Return 401 from for incorrect passwordRichard van der Hoff2016-10-071-32/+52
| | | | | | | | | | | | | | | | | | This requires a bit of fettling, because I want to return a helpful error message too but we don't want to distinguish between unknown user and invalid password. To avoid hardcoding the error message into 15 places in the code, I've had to refactor a few methods to return None instead of throwing. Fixes https://matrix.org/jira/browse/SYN-744
* | Restructure ldap authenticationMartin Weinelt2016-09-291-87/+192
|/ | | | | | | | - properly parse return values of ldap bind() calls - externalize authentication methods - change control flow to be more error-resilient - unbind ldap connections in many places - improve log messages and loglevels
* Refactor user_delete_access_tokens. Invalidate get_user_by_access_token to ↵Erik Johnston2016-08-151-3/+3
| | | | slaves.
* Log the value which is observed in the first place.Daniel Ehlers2016-08-141-1/+1
| | | | | | | | The name 'result' is of bool type and has no len property, resulting in a TypeError. Futhermore in the flow control conn.response is observed and hence should be reported. Signed-off-by: Daniel Ehlers <sargon@toppoint.de>
* Fix AttributeError when bind_dn is not defined.Daniel Ehlers2016-08-141-1/+1
| | | | | | | | | In case one does not define bind_dn in ldap configuration, filter attribute is not declared. Since auth code only uses ldap_filter attribute when according LDAP mode is selected, it is safe to only declare the attribute in that case. Signed-off-by: Daniel Ehlers <sargon@toppoint.de>
* /login: Respond with a 403 when we get an invalid m.login.tokenRichard van der Hoff2016-08-091-3/+3
|
* Fix login with m.login.tokenRichard van der Hoff2016-08-081-13/+4
| | | | | login with token (as used by CAS auth) was broken by 067596d, such that it always returned a 401.
* Implement deleting devicesRichard van der Hoff2016-07-261-2/+20
|
* Use get to avoid KeyErrorsDavid Baker2016-07-221-1/+1
|
* Log the hostname the reCAPTCHA was completed onDavid Baker2016-07-221-2/+11
| | | | This could be useful information to have in the logs. Also comment about how & why we don't verify the hostname.
* Type annotationsRichard van der Hoff2016-07-191-0/+4
| | | | | Add some type annotations to help PyCharm (in particular) to figure out the types of a bunch of things.
* Add device_id support to /loginRichard van der Hoff2016-07-181-8/+11
| | | | | | | | | | | | | Add a 'devices' table to the storage, as well as a 'device_id' column to refresh_tokens. Allow the client to pass a device_id, and initial_device_display_name, to /login. If login is successful, then register the device in the devices table if it wasn't known already. If no device_id was supplied, make one up. Associate the device_id with the access token and refresh token, so that we can get at it again later. Ensure that the device_id is copied from the refresh token to the access_token when the token is refreshed.
* Refactor login flowRichard van der Hoff2016-07-181-47/+59
| | | | | | | | | | Make sure that we have the canonical user_id *before* calling get_login_tuple_for_user_id. Replace login_with_password with a method which just validates the password, and have the caller call get_login_tuple_for_user_id. This brings the password flow into line with the other flows, and will give us a place to register the device_id if necessary.
* Bug fix: expire invalid access tokensNegar Fazeli2016-07-131-2/+3
|
* Fix password configKent Shikama2016-07-051-2/+2
|
* Fix pep8Kent Shikama2016-07-051-1/+2
|
* Add pepper to password hashingKent Shikama2016-07-051-2/+3
| | | | Signed-off-by: Kent Shikama <kent@kentshikama.com>
* Rework ldap integration with ldap3Martin Weinelt2016-06-221-33/+170
| | | | | | | | | | | | | | | | | | | Use the pure-python ldap3 library, which eliminates the need for a system dependency. Offer both a `search` and `simple_bind` mode, for more sophisticated ldap scenarios. - `search` tries to find a matching DN within the `user_base` while employing the `user_filter`, then tries the bind when a single matching DN was found. - `simple_bind` tries the bind against a specific DN by combining the localpart and `user_base` Offer support for STARTTLS on a plain connection. The configuration was changed to reflect these new possibilities. Signed-off-by: Martin Weinelt <hexa@darmstadt.ccc.de>
* Fix TypeError in call to bcrypt.hashpwSalvatore LaMendola2016-06-161-1/+1
| | | | | | | | - At the very least, this TypeError caused logins to fail on my own running instance of Synapse, and the simple (explicit) UTF-8 conversion resolved login errors for me. Signed-off-by: Salvatore LaMendola <salvatore.lamendola@gmail.com>
* Email unsubscribing that may in theory, workDavid Baker2016-06-021-0/+5
| | | | Were it not for that fact that you can't use the base handler in the pusher because it pulls in the world. Comitting while I fix that on a different branch.
* Send down correct error response if user not foundErik Johnston2016-05-271-2/+7
|
* Merge pull request #741 from negzi/create_user_with_expiryErik Johnston2016-05-131-2/+2
|\ | | | | Create user with expiry
| * Create user with expiryNegi Fazeli2016-05-131-2/+2
| | | | | | | | | | | | - Add unittests for client, api and handler Signed-off-by: Negar Fazeli <negar.fazeli@ericsson.com>
* | Correctly handle NULL password hashes from the databaseErik Johnston2016-05-111-1/+4
|/
* Simplify _check_passwordErik Johnston2016-04-151-5/+9
|
* Fix check_password rather than inverting the meaning of ↵Mark Haines2016-04-141-9/+12
| | | | _check_local_password (#730)
* Fix login to error for nonexistent usersDavid Baker2016-04-141-1/+1
| | | | Fixes SYN-680
* fix check for failed authenticationChristoph Witzany2016-04-061-2/+4
|
* remove lineChristoph Witzany2016-04-061-1/+0
|
* make tests for ldap more specific to not be fooled by MocksChristoph Witzany2016-04-061-3/+3
|
* output ldap version for info and to pacify pep8Christoph Witzany2016-04-061-0/+2
|
* conditionally import ldapChristoph Witzany2016-04-061-2/+5
|
* fix pep8Christoph Witzany2016-04-061-2/+1
|
* fix exception handlingChristoph Witzany2016-04-061-2/+2
|
* code styleChristoph Witzany2016-04-061-6/+13
|
* add tls property and twist my head around twistedChristoph Witzany2016-04-061-15/+29
|
* move LDAP authentication to AuthenticationHandlerChristoph Witzany2016-04-061-6/+48
|
* Use google style doc strings.Mark Haines2016-04-011-9/+17
| | | | | | | pycharm supports them so there is no need to use the other format. Might as well convert the existing strings to reduce the risk of people accidentally cargo culting the wrong doc string format.
* Make registration idempotent, part 2: be idempotent if the client specifies ↵David Baker2016-03-161-0/+14
| | | | a username.
* pep8David Baker2016-03-161-1/+2
|
* time_msec()David Baker2016-03-161-1/+1
|
* string with symbols is a bit too symboly.David Baker2016-03-161-1/+1
|
* Replace other time.time().David Baker2016-03-161-2/+1
|
* Use hs get_clock instead of time.time()David Baker2016-03-161-2/+2
|
* pep8 & remove debug loggingDavid Baker2016-03-161-1/+1
|
* Make registration idempotent: if you specify the same session, make it give ↵David Baker2016-03-161-12/+48
| | | | you an access token for the user that was registered on previous uses of that session. Tweak the UI auth layer to not delete sessions when their auth has completed and hence expire themn so they don't hang around until server restart. Allow server-side data to be associated with UI auth sessions.
* Make select more sensible when dseleting access tokens, rename pusher ↵David Baker2016-03-111-1/+1
| | | | deletion to match access token deletion and make exception arg optional.
* Delete old, unused methods and rename new one to just be ↵David Baker2016-03-111-1/+1
| | | | `user_delete_access_tokens` with an `except_token_ids` argument doing what it says on the tin.
* Dear PyCharm, please indent sensibly for me. Thx.David Baker2016-03-111-2/+2
|
* Fix cache invalidation so deleting access tokens (which we did when changing ↵David Baker2016-03-111-4/+9
| | | | password) actually takes effect without HS restart. Reinstate the code to avoid logging out the session that changed the password, removed in 415c2f05491ce65a4fc34326519754cd1edd9c54
* Stop using checkpw as it seems to have vanished from bcrypt. Use ↵David Baker2016-03-021-1/+1
| | | | `bcrypt.hashpw(password, hashed) == hashed` as per the bcrypt README.
* Allow guests to upgrade their accountsDaniel Wagner-Hall2016-01-051-3/+3
|
* Take a boolean not a list of lambdasDaniel Wagner-Hall2015-11-191-1/+1
|
* Minor review fixesSteven Hammerton2015-11-111-4/+4
|
* Share more code between macaroon validationSteven Hammerton2015-11-111-48/+7
|
* Allow hs to do CAS login completely and issue the client with a login token ↵Steven Hammerton2015-11-051-3/+73
| | | | that can be redeemed for the usual successful login response
* Allow guests to register and call /events?room_id=Daniel Wagner-Hall2015-11-041-1/+4
| | | | | | | This follows the same flows-based flow as regular registration, but as the only implemented flow has no requirements, it auto-succeeds. In the future, other flows (e.g. captcha) may be required, so clients should treat this like the regular registration flow choices.
* Add config for how many bcrypt rounds to use for password hashesMark Haines2015-10-161-1/+2
| | | | | By default we leave it at the default value of 12. But now we can reduce it for preparing users for loadtests or running integration tests.
* Formatting changesSteven Hammerton2015-10-101-1/+2
|
* Provide ability to login using CASSteven Hammerton2015-10-101-0/+31
|
* Allow configuration to ignore invalid SSL certsDaniel Wagner-Hall2015-09-091-2/+1
| | | | | This will be useful for sytest, and sytest only, hence the aggressive config key name.
* Swap out bcrypt for md5 in testsDaniel Wagner-Hall2015-08-261-2/+25
| | | | This reduces our ~8 second sequential test time down to ~7 seconds
* Merge erikj/user_dedup to developDaniel Wagner-Hall2015-08-261-8/+31
|
* Fix bad mergeDaniel Wagner-Hall2015-08-201-8/+1
|
* Fix indentationDaniel Wagner-Hall2015-08-201-1/+2
|
* Fix flake8 warningsDaniel Wagner-Hall2015-08-201-4/+6
|
* Merge branch 'auth' into refreshDaniel Wagner-Hall2015-08-201-3/+3
|\ | | | | | | | | Conflicts: synapse/handlers/register.py
* | Merge branch 'develop' into refreshDaniel Wagner-Hall2015-08-201-1/+1
|\| | | | | | | | | Conflicts: synapse/rest/client/v1/login.py
| * Another use of check_password that got missed in the yield fixDavid Baker2015-08-201-1/+1
| |
* | /tokenrefresh POST endpointDaniel Wagner-Hall2015-08-201-5/+30
| | | | | | | | | | | | | | | | This allows refresh tokens to be exchanged for (access_token, refresh_token). It also starts issuing them on login, though no clients currently interpret them.
* | Move token generation to auth handlerDaniel Wagner-Hall2015-08-201-5/+24
|/ | | | | I prefer the auth handler to worry about all auth, and register to call into it as needed, than to smatter auth logic between the two.
* Remove an access token log lineErik Johnston2015-08-191-1/+1
|
* Fix regression where we incorrectly responded with a 200 to /loginErik Johnston2015-08-191-1/+2
|
* Merge password checking implementationsDaniel Wagner-Hall2015-08-121-20/+15
|
* Simplify LoginHander and AuthHandlerDaniel Wagner-Hall2015-08-121-18/+72
| | | | | | | | | * Merge LoginHandler -> AuthHandler * Add a bunch of documentation * Improve some naming * Remove unused branches I will start merging the actual logic of the two handlers shortly
* Add back in support for remembering parameters submitted to a ↵David Baker2015-07-151-2/+4
| | | | user-interactive auth call.
* Merge branch 'develop' into markjh/SYT-8-recaptchaMark Haines2015-05-291-0/+1
|\ | | | | | | | | Conflicts: synapse/handlers/auth.py
| * SYN-395: Fix CAPTCHA, don't double decode jsonErik Johnston2015-05-281-2/+3
| |
* | Add config for setting the recaptcha verify api endpoint, so we can test it ↵Mark Haines2015-05-291-3/+3
|/ | | | in sytest
* This api now no longer returns an arrayDavid Baker2015-05-011-1/+1
|
* Add commentage.David Baker2015-04-271-0/+4
|
* Use underscores instead of camelcase for id server stuffDavid Baker2015-04-241-6/+6
|
* pep8David Baker2015-04-241-2/+2
|
* Remove ultimately unused feature of saving params from the first call in the ↵David Baker2015-04-231-2/+10
| | | | session: it's probably too open to abuse.
* Password reset, finally.David Baker2015-04-171-1/+7
|
* Return user ID in use error straight awayDavid Baker2015-04-161-0/+2
|
* Dummy login so we can do the first POST request to get login flows without ↵David Baker2015-04-151-0/+6
| | | | it just succeeding
* Regstration with email in v2David Baker2015-04-151-21/+43
|
* Completely replace fallback auth for C/S V2:David Baker2015-04-011-21/+77
| | | | | | | * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
* pep8David Baker2015-03-311-1/+1
|
* New registration for C/S API v2. Only ReCAPTCHA working currently.David Baker2015-03-301-13/+77
|
* Implement password changing (finally) along with a start on making ↵David Baker2015-03-231-0/+109
client/server auth more general.