Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2024-12-27 00:59:24 -05:00
Code Issues Packages Projects Releases Wiki Activity
e0d6244beb
anonymousland-synapse/synapse/rest/client/v2_alpha/auth.py

269 lines
9.1 KiB
Python
Raw Normal View History

Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
# -*- coding: utf-8 -*-
copyrights
2016-01-06 23:26:29 -05:00
# Copyright 2015, 2016 OpenMarket Ltd
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
run isort
2018-07-09 02:09:20 -04:00
import logging
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
from synapse.api.constants import LoginType
from synapse.api.errors import SynapseError
Drop support for v2_alpha API prefix (#5190)
2019-05-15 12:37:46 -04:00
from synapse.api.urls import CLIENT_API_PREFIX
Ensure that HTML pages served from Synapse include headers to avoid embedding.
2020-07-01 09:10:23 -04:00
from synapse.http.server import respond_with_html
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
from synapse.http.servlet import RestServlet, parse_string
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Unify v1 and v2 REST client APIs (#5226)
2019-06-03 07:28:59 -04:00
from ._base import client_patterns
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
logger = logging.getLogger(__name__)
RECAPTCHA_TEMPLATE = """
<html>
<head>
<title>Authentication</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
switch from google.com to recaptcha.net for reCAPTCHA (#4731) * add trivial clarification about jemalloc * switch from google.com to recaptcha.net because https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally
2019-02-25 14:15:36 -05:00
<script src="https://www.recaptcha.net/recaptcha/api.js"
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
async defer></script>
<script src="//code.jquery.com/jquery-1.11.2.min.js"></script>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
<script>
function captchaDone() {
$('#registrationForm').submit();
}
</script>
</head>
<body>
<form id="registrationForm" method="post" action="%(myurl)s">
<div>
<p>
Hello! We need to prevent computer programs and other automated
things from creating accounts on this server.
</p>
<p>
Please verify that you're not a robot.
</p>
<input type="hidden" name="session" value="%(session)s" />
<div class="g-recaptcha"
data-sitekey="%(sitekey)s"
data-callback="captchaDone">
</div>
<noscript>
<input type="submit" value="All Done" />
</noscript>
</div>
</div>
</form>
</body>
</html>
"""
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
TERMS_TEMPLATE = """
<html>
<head>
<title>Authentication</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
</head>
<body>
<form id="registrationForm" method="post" action="%(myurl)s">
<div>
<p>
Please click the button below if you agree to the
<a href="%(terms_url)s">privacy policy of this homeserver.</a>
</p>
<input type="hidden" name="session" value="%(session)s" />
<input type="submit" value="Agree" />
</div>
</form>
</body>
</html>
"""
Use a template for the SSO success page to allow for customization. (#7279)
2020-04-17 13:34:55 -04:00
SUCCESS_TEMPLATE = """
<html>
<head>
<title>Success!</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
<script>
if (window.onAuthDone) {
window.onAuthDone();
} else if (window.opener && window.opener.postMessage) {
window.opener.postMessage("authDone", "*");
}
</script>
</head>
<body>
<div>
<p>Thank you</p>
<p>You may now close this window and return to the application</p>
</div>
</body>
</html>
"""
pep8
2015-04-02 12:06:17 -04:00
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
class AuthRestServlet(RestServlet):
"""
Handles Client / Server API authentication in any situations where it
cannot be handled in the normal flow (with requests to the same endpoint).
Current use is for web fallback auth.
"""
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
Unify v1 and v2 REST client APIs (#5226)
2019-06-03 07:28:59 -04:00
PATTERNS = client_patterns(r"/auth/(?P<stagetype>[\w\.]*)/fallback/web")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
def __init__(self, hs):
super(AuthRestServlet, self).__init__()
self.hs = hs
self.auth = hs.get_auth()
Split out the auth handler
2016-06-02 08:31:45 -04:00
self.auth_handler = hs.get_auth_handler()
Fix registration on workers (#4682) * Move RegistrationHandler init to HomeServer * Move post registration actions to RegistrationHandler * Add post regisration replication endpoint * Newsfile
2019-02-20 02:47:31 -05:00
self.registration_handler = hs.get_registration_handler()
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Support SAML in the user interactive authentication workflow. (#7102)
2020-04-01 08:48:00 -04:00
# SSO configuration.
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
self._cas_enabled = hs.config.cas_enabled
if self._cas_enabled:
self._cas_handler = hs.get_cas_handler()
self._cas_server_url = hs.config.cas_server_url
self._cas_service_url = hs.config.cas_service_url
Support UI Authentication for OpenID Connect accounts (#7457)
2020-05-15 12:26:02 -04:00
self._saml_enabled = hs.config.saml2_enabled
if self._saml_enabled:
self._saml_handler = hs.get_saml_handler()
self._oidc_enabled = hs.config.oidc_enabled
if self._oidc_enabled:
self._oidc_handler = hs.get_oidc_handler()
self._cas_server_url = hs.config.cas_server_url
self._cas_service_url = hs.config.cas_service_url
Support SAML in the user interactive authentication workflow. (#7102)
2020-04-01 08:48:00 -04:00
Persist user interactive authentication sessions (#7302) By persisting the user interactive authentication sessions to the database, this fixes situations where a user hits different works throughout their auth session and also allows sessions to persist through restarts of Synapse.
2020-04-30 13:47:49 -04:00
async def on_GET(self, request, stagetype):
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
session = parse_string(request, "session")
if not session:
raise SynapseError(400, "No session supplied")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
if stagetype == LoginType.RECAPTCHA:
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
html = RECAPTCHA_TEMPLATE % {
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
"session": session,
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.RECAPTCHA),
"sitekey": self.hs.config.recaptcha_public_key,
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
}
Incorporate Dave's work for GDPR login flows As per https://github.com/vector-im/riot-web/issues/7168#issuecomment-419996117
2018-09-27 16:53:58 -04:00
elif stagetype == LoginType.TERMS:
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
html = TERMS_TEMPLATE % {
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
"session": session,
"terms_url": "%s_matrix/consent?v=%s"
% (self.hs.config.public_baseurl, self.hs.config.user_consent_version),
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.TERMS),
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
}
Support SAML in the user interactive authentication workflow. (#7102)
2020-04-01 08:48:00 -04:00
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
elif stagetype == LoginType.SSO:
Support SAML in the user interactive authentication workflow. (#7102)
2020-04-01 08:48:00 -04:00
# Display a confirmation page which prompts the user to
# re-authenticate with their SSO provider.
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
if self._cas_enabled:
# Generate a request to CAS that redirects back to an endpoint
# to verify the successful authentication.
sso_redirect_url = self._cas_handler.get_redirect_url(
{"session": session},
)
elif self._saml_enabled:
Use a non-empty RelayState for user interactive auth with SAML. (#7552)
2020-05-22 07:17:30 -04:00
# Some SAML identity providers (e.g. Google) require a
# RelayState parameter on requests. It is not necessary here, so
# pass in a dummy redirect URL (which will never get used).
client_redirect_url = b"unused"
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
sso_redirect_url = self._saml_handler.handle_redirect_request(
client_redirect_url, session
)
Support UI Authentication for OpenID Connect accounts (#7457)
2020-05-15 12:26:02 -04:00
elif self._oidc_enabled:
client_redirect_url = b""
sso_redirect_url = await self._oidc_handler.handle_redirect_request(
request, client_redirect_url, session
)
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
else:
raise SynapseError(400, "Homeserver not configured for SSO.")
Persist user interactive authentication sessions (#7302) By persisting the user interactive authentication sessions to the database, this fixes situations where a user hits different works throughout their auth session and also allows sessions to persist through restarts of Synapse.
2020-04-30 13:47:49 -04:00
html = await self.auth_handler.start_sso_ui_auth(sso_redirect_url, session)
Support CAS in UI Auth flows. (#7186)
2020-04-03 15:35:05 -04:00
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
else:
raise SynapseError(404, "Unknown auth stage type")
Clean-up some auth/login REST code (#7115)
2020-03-20 16:22:47 -04:00
# Render the HTML and return.
Ensure that HTML pages served from Synapse include headers to avoid embedding.
2020-07-01 09:10:23 -04:00
respond_with_html(request, 200, html)
Clean-up some auth/login REST code (#7115)
2020-03-20 16:22:47 -04:00
return None
Port rest.client.v2
2019-12-05 11:46:37 -05:00
async def on_POST(self, request, stagetype):
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
session = parse_string(request, "session")
if not session:
raise SynapseError(400, "No session supplied")
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
if stagetype == LoginType.RECAPTCHA:
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
response = parse_string(request, "g-recaptcha-response")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Fix fallback auth on Python 3 (#4197)
2018-11-19 13:27:33 -05:00
if not response:
raise SynapseError(400, "No captcha response supplied")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
authdict = {"response": response, "session": session}
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
Port rest.client.v2
2019-12-05 11:46:37 -05:00
success = await self.auth_handler.add_oob_auth(
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
LoginType.RECAPTCHA, authdict, self.hs.get_ip_from_request(request)
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
)
if success:
html = SUCCESS_TEMPLATE
else:
html = RECAPTCHA_TEMPLATE % {
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
"session": session,
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.RECAPTCHA),
"sitekey": self.hs.config.recaptcha_public_key,
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
}
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
elif stagetype == LoginType.TERMS:
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
authdict = {"session": session}
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
Port rest.client.v2
2019-12-05 11:46:37 -05:00
success = await self.auth_handler.add_oob_auth(
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
LoginType.TERMS, authdict, self.hs.get_ip_from_request(request)
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
)
if success:
html = SUCCESS_TEMPLATE
else:
html = TERMS_TEMPLATE % {
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
"session": session,
"terms_url": "%s_matrix/consent?v=%s"
% (
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
self.hs.config.public_baseurl,
Include a version query string arg for the consent route
2018-10-31 15:19:28 -04:00
self.hs.config.user_consent_version,
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
),
Run Black. (#5482)
2019-06-20 05:32:02 -04:00
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.TERMS),
Flesh out the fallback auth for terms
2018-10-03 17:54:19 -04:00
}
Support SAML in the user interactive authentication workflow. (#7102)
2020-04-01 08:48:00 -04:00
elif stagetype == LoginType.SSO:
# The SSO fallback workflow should not post here,
raise SynapseError(404, "Fallback SSO auth does not support POST requests.")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
else:
raise SynapseError(404, "Unknown auth stage type")
Clean-up some auth/login REST code (#7115)
2020-03-20 16:22:47 -04:00
# Render the HTML and return.
Ensure that HTML pages served from Synapse include headers to avoid embedding.
2020-07-01 09:10:23 -04:00
respond_with_html(request, 200, html)
Clean-up some auth/login REST code (#7115)
2020-03-20 16:22:47 -04:00
return None
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 10:05:30 -04:00
def on_OPTIONS(self, _):
return 200, {}
def register_servlets(hs, http_server):
AuthRestServlet(hs).register(http_server)
Reference in New Issue Copy Permalink