mirror of
https://git.anonymousland.org/anonymousland/synapse.git
synced 2024-09-07 04:21:54 +00:00
Rip out half-implemented m.login.saml2 support (#4265)
* Rip out half-implemented m.login.saml2 support This was implemented in an odd way that left most of the work to the client, in a way that I really didn't understand. It's going to be a pain to maintain, so let's start by ripping it out. * drop undocumented dependency on dateutil It turns out we were relying on dateutil being pulled in transitively by pysaml2. There's no need for that bloat.
This commit is contained in:
parent
9a3e24a13d
commit
b0c24a66ec
1
changelog.d/4265.feature
Normal file
1
changelog.d/4265.feature
Normal file
@ -0,0 +1 @@
|
|||||||
|
Rework SAML2 authentication
|
@ -32,7 +32,6 @@ from .ratelimiting import RatelimitConfig
|
|||||||
from .registration import RegistrationConfig
|
from .registration import RegistrationConfig
|
||||||
from .repository import ContentRepositoryConfig
|
from .repository import ContentRepositoryConfig
|
||||||
from .room_directory import RoomDirectoryConfig
|
from .room_directory import RoomDirectoryConfig
|
||||||
from .saml2 import SAML2Config
|
|
||||||
from .server import ServerConfig
|
from .server import ServerConfig
|
||||||
from .server_notices_config import ServerNoticesConfig
|
from .server_notices_config import ServerNoticesConfig
|
||||||
from .spam_checker import SpamCheckerConfig
|
from .spam_checker import SpamCheckerConfig
|
||||||
@ -45,7 +44,7 @@ from .workers import WorkerConfig
|
|||||||
class HomeServerConfig(TlsConfig, ServerConfig, DatabaseConfig, LoggingConfig,
|
class HomeServerConfig(TlsConfig, ServerConfig, DatabaseConfig, LoggingConfig,
|
||||||
RatelimitConfig, ContentRepositoryConfig, CaptchaConfig,
|
RatelimitConfig, ContentRepositoryConfig, CaptchaConfig,
|
||||||
VoipConfig, RegistrationConfig, MetricsConfig, ApiConfig,
|
VoipConfig, RegistrationConfig, MetricsConfig, ApiConfig,
|
||||||
AppServiceConfig, KeyConfig, SAML2Config, CasConfig,
|
AppServiceConfig, KeyConfig, CasConfig,
|
||||||
JWTConfig, PasswordConfig, EmailConfig,
|
JWTConfig, PasswordConfig, EmailConfig,
|
||||||
WorkerConfig, PasswordAuthProviderConfig, PushConfig,
|
WorkerConfig, PasswordAuthProviderConfig, PushConfig,
|
||||||
SpamCheckerConfig, GroupsConfig, UserDirectoryConfig,
|
SpamCheckerConfig, GroupsConfig, UserDirectoryConfig,
|
||||||
|
@ -1,55 +0,0 @@
|
|||||||
# -*- coding: utf-8 -*-
|
|
||||||
# Copyright 2015 Ericsson
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
|
|
||||||
from ._base import Config
|
|
||||||
|
|
||||||
|
|
||||||
class SAML2Config(Config):
|
|
||||||
"""SAML2 Configuration
|
|
||||||
Synapse uses pysaml2 libraries for providing SAML2 support
|
|
||||||
|
|
||||||
config_path: Path to the sp_conf.py configuration file
|
|
||||||
idp_redirect_url: Identity provider URL which will redirect
|
|
||||||
the user back to /login/saml2 with proper info.
|
|
||||||
|
|
||||||
sp_conf.py file is something like:
|
|
||||||
https://github.com/rohe/pysaml2/blob/master/example/sp-repoze/sp_conf.py.example
|
|
||||||
|
|
||||||
More information: https://pythonhosted.org/pysaml2/howto/config.html
|
|
||||||
"""
|
|
||||||
|
|
||||||
def read_config(self, config):
|
|
||||||
saml2_config = config.get("saml2_config", None)
|
|
||||||
if saml2_config:
|
|
||||||
self.saml2_enabled = saml2_config.get("enabled", True)
|
|
||||||
self.saml2_config_path = saml2_config["config_path"]
|
|
||||||
self.saml2_idp_redirect_url = saml2_config["idp_redirect_url"]
|
|
||||||
else:
|
|
||||||
self.saml2_enabled = False
|
|
||||||
self.saml2_config_path = None
|
|
||||||
self.saml2_idp_redirect_url = None
|
|
||||||
|
|
||||||
def default_config(self, config_dir_path, server_name, **kwargs):
|
|
||||||
return """
|
|
||||||
# Enable SAML2 for registration and login. Uses pysaml2
|
|
||||||
# config_path: Path to the sp_conf.py configuration file
|
|
||||||
# idp_redirect_url: Identity provider URL which will redirect
|
|
||||||
# the user back to /login/saml2 with proper info.
|
|
||||||
# See pysaml2 docs for format of config.
|
|
||||||
#saml2_config:
|
|
||||||
# enabled: true
|
|
||||||
# config_path: "%s/sp_conf.py"
|
|
||||||
# idp_redirect_url: "http://%s/idp"
|
|
||||||
""" % (config_dir_path, server_name)
|
|
@ -327,35 +327,6 @@ class RegistrationHandler(BaseHandler):
|
|||||||
else:
|
else:
|
||||||
logger.info("Valid captcha entered from %s", ip)
|
logger.info("Valid captcha entered from %s", ip)
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
|
||||||
def register_saml2(self, localpart):
|
|
||||||
"""
|
|
||||||
Registers email_id as SAML2 Based Auth.
|
|
||||||
"""
|
|
||||||
if types.contains_invalid_mxid_characters(localpart):
|
|
||||||
raise SynapseError(
|
|
||||||
400,
|
|
||||||
"User ID can only contain characters a-z, 0-9, or '=_-./'",
|
|
||||||
)
|
|
||||||
yield self.auth.check_auth_blocking()
|
|
||||||
user = UserID(localpart, self.hs.hostname)
|
|
||||||
user_id = user.to_string()
|
|
||||||
|
|
||||||
yield self.check_user_id_not_appservice_exclusive(user_id)
|
|
||||||
token = self.macaroon_gen.generate_access_token(user_id)
|
|
||||||
try:
|
|
||||||
yield self.store.register(
|
|
||||||
user_id=user_id,
|
|
||||||
token=token,
|
|
||||||
password_hash=None,
|
|
||||||
create_profile_with_localpart=user.localpart,
|
|
||||||
)
|
|
||||||
except Exception as e:
|
|
||||||
yield self.store.add_access_token_to_user(user_id, token)
|
|
||||||
# Ignore Registration errors
|
|
||||||
logger.exception(e)
|
|
||||||
defer.returnValue((user_id, token))
|
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
@defer.inlineCallbacks
|
||||||
def register_email(self, threepidCreds):
|
def register_email(self, threepidCreds):
|
||||||
"""
|
"""
|
||||||
|
@ -53,7 +53,6 @@ REQUIREMENTS = {
|
|||||||
"pillow>=3.1.2": ["PIL"],
|
"pillow>=3.1.2": ["PIL"],
|
||||||
"sortedcontainers>=1.4.4": ["sortedcontainers"],
|
"sortedcontainers>=1.4.4": ["sortedcontainers"],
|
||||||
"psutil>=2.0.0": ["psutil>=2.0.0"],
|
"psutil>=2.0.0": ["psutil>=2.0.0"],
|
||||||
"pysaml2>=3.0.0": ["saml2"],
|
|
||||||
"pymacaroons-pynacl>=0.9.3": ["pymacaroons"],
|
"pymacaroons-pynacl>=0.9.3": ["pymacaroons"],
|
||||||
"msgpack-python>=0.4.2": ["msgpack"],
|
"msgpack-python>=0.4.2": ["msgpack"],
|
||||||
"phonenumbers>=8.2.0": ["phonenumbers"],
|
"phonenumbers>=8.2.0": ["phonenumbers"],
|
||||||
|
@ -18,10 +18,6 @@ import xml.etree.ElementTree as ET
|
|||||||
|
|
||||||
from six.moves import urllib
|
from six.moves import urllib
|
||||||
|
|
||||||
from canonicaljson import json
|
|
||||||
from saml2 import BINDING_HTTP_POST, config
|
|
||||||
from saml2.client import Saml2Client
|
|
||||||
|
|
||||||
from twisted.internet import defer
|
from twisted.internet import defer
|
||||||
from twisted.web.client import PartialDownloadError
|
from twisted.web.client import PartialDownloadError
|
||||||
|
|
||||||
@ -81,7 +77,6 @@ def login_id_thirdparty_from_phone(identifier):
|
|||||||
|
|
||||||
class LoginRestServlet(ClientV1RestServlet):
|
class LoginRestServlet(ClientV1RestServlet):
|
||||||
PATTERNS = client_path_patterns("/login$")
|
PATTERNS = client_path_patterns("/login$")
|
||||||
SAML2_TYPE = "m.login.saml2"
|
|
||||||
CAS_TYPE = "m.login.cas"
|
CAS_TYPE = "m.login.cas"
|
||||||
SSO_TYPE = "m.login.sso"
|
SSO_TYPE = "m.login.sso"
|
||||||
TOKEN_TYPE = "m.login.token"
|
TOKEN_TYPE = "m.login.token"
|
||||||
@ -89,8 +84,6 @@ class LoginRestServlet(ClientV1RestServlet):
|
|||||||
|
|
||||||
def __init__(self, hs):
|
def __init__(self, hs):
|
||||||
super(LoginRestServlet, self).__init__(hs)
|
super(LoginRestServlet, self).__init__(hs)
|
||||||
self.idp_redirect_url = hs.config.saml2_idp_redirect_url
|
|
||||||
self.saml2_enabled = hs.config.saml2_enabled
|
|
||||||
self.jwt_enabled = hs.config.jwt_enabled
|
self.jwt_enabled = hs.config.jwt_enabled
|
||||||
self.jwt_secret = hs.config.jwt_secret
|
self.jwt_secret = hs.config.jwt_secret
|
||||||
self.jwt_algorithm = hs.config.jwt_algorithm
|
self.jwt_algorithm = hs.config.jwt_algorithm
|
||||||
@ -103,8 +96,6 @@ class LoginRestServlet(ClientV1RestServlet):
|
|||||||
flows = []
|
flows = []
|
||||||
if self.jwt_enabled:
|
if self.jwt_enabled:
|
||||||
flows.append({"type": LoginRestServlet.JWT_TYPE})
|
flows.append({"type": LoginRestServlet.JWT_TYPE})
|
||||||
if self.saml2_enabled:
|
|
||||||
flows.append({"type": LoginRestServlet.SAML2_TYPE})
|
|
||||||
if self.cas_enabled:
|
if self.cas_enabled:
|
||||||
flows.append({"type": LoginRestServlet.SSO_TYPE})
|
flows.append({"type": LoginRestServlet.SSO_TYPE})
|
||||||
|
|
||||||
@ -134,18 +125,8 @@ class LoginRestServlet(ClientV1RestServlet):
|
|||||||
def on_POST(self, request):
|
def on_POST(self, request):
|
||||||
login_submission = parse_json_object_from_request(request)
|
login_submission = parse_json_object_from_request(request)
|
||||||
try:
|
try:
|
||||||
if self.saml2_enabled and (login_submission["type"] ==
|
if self.jwt_enabled and (login_submission["type"] ==
|
||||||
LoginRestServlet.SAML2_TYPE):
|
LoginRestServlet.JWT_TYPE):
|
||||||
relay_state = ""
|
|
||||||
if "relay_state" in login_submission:
|
|
||||||
relay_state = "&RelayState=" + urllib.parse.quote(
|
|
||||||
login_submission["relay_state"])
|
|
||||||
result = {
|
|
||||||
"uri": "%s%s" % (self.idp_redirect_url, relay_state)
|
|
||||||
}
|
|
||||||
defer.returnValue((200, result))
|
|
||||||
elif self.jwt_enabled and (login_submission["type"] ==
|
|
||||||
LoginRestServlet.JWT_TYPE):
|
|
||||||
result = yield self.do_jwt_login(login_submission)
|
result = yield self.do_jwt_login(login_submission)
|
||||||
defer.returnValue(result)
|
defer.returnValue(result)
|
||||||
elif login_submission["type"] == LoginRestServlet.TOKEN_TYPE:
|
elif login_submission["type"] == LoginRestServlet.TOKEN_TYPE:
|
||||||
@ -345,50 +326,6 @@ class LoginRestServlet(ClientV1RestServlet):
|
|||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
class SAML2RestServlet(ClientV1RestServlet):
|
|
||||||
PATTERNS = client_path_patterns("/login/saml2", releases=())
|
|
||||||
|
|
||||||
def __init__(self, hs):
|
|
||||||
super(SAML2RestServlet, self).__init__(hs)
|
|
||||||
self.sp_config = hs.config.saml2_config_path
|
|
||||||
self.handlers = hs.get_handlers()
|
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
|
||||||
def on_POST(self, request):
|
|
||||||
saml2_auth = None
|
|
||||||
try:
|
|
||||||
conf = config.SPConfig()
|
|
||||||
conf.load_file(self.sp_config)
|
|
||||||
SP = Saml2Client(conf)
|
|
||||||
saml2_auth = SP.parse_authn_request_response(
|
|
||||||
request.args['SAMLResponse'][0], BINDING_HTTP_POST)
|
|
||||||
except Exception as e: # Not authenticated
|
|
||||||
logger.exception(e)
|
|
||||||
if saml2_auth and saml2_auth.status_ok() and not saml2_auth.not_signed:
|
|
||||||
username = saml2_auth.name_id.text
|
|
||||||
handler = self.handlers.registration_handler
|
|
||||||
(user_id, token) = yield handler.register_saml2(username)
|
|
||||||
# Forward to the RelayState callback along with ava
|
|
||||||
if 'RelayState' in request.args:
|
|
||||||
request.redirect(urllib.parse.unquote(
|
|
||||||
request.args['RelayState'][0]) +
|
|
||||||
'?status=authenticated&access_token=' +
|
|
||||||
token + '&user_id=' + user_id + '&ava=' +
|
|
||||||
urllib.quote(json.dumps(saml2_auth.ava)))
|
|
||||||
finish_request(request)
|
|
||||||
defer.returnValue(None)
|
|
||||||
defer.returnValue((200, {"status": "authenticated",
|
|
||||||
"user_id": user_id, "token": token,
|
|
||||||
"ava": saml2_auth.ava}))
|
|
||||||
elif 'RelayState' in request.args:
|
|
||||||
request.redirect(urllib.parse.unquote(
|
|
||||||
request.args['RelayState'][0]) +
|
|
||||||
'?status=not_authenticated')
|
|
||||||
finish_request(request)
|
|
||||||
defer.returnValue(None)
|
|
||||||
defer.returnValue((200, {"status": "not_authenticated"}))
|
|
||||||
|
|
||||||
|
|
||||||
class CasRedirectServlet(RestServlet):
|
class CasRedirectServlet(RestServlet):
|
||||||
PATTERNS = client_path_patterns("/login/(cas|sso)/redirect")
|
PATTERNS = client_path_patterns("/login/(cas|sso)/redirect")
|
||||||
|
|
||||||
@ -517,8 +454,6 @@ class CasTicketServlet(ClientV1RestServlet):
|
|||||||
|
|
||||||
def register_servlets(hs, http_server):
|
def register_servlets(hs, http_server):
|
||||||
LoginRestServlet(hs).register(http_server)
|
LoginRestServlet(hs).register(http_server)
|
||||||
if hs.config.saml2_enabled:
|
|
||||||
SAML2RestServlet(hs).register(http_server)
|
|
||||||
if hs.config.cas_enabled:
|
if hs.config.cas_enabled:
|
||||||
CasRedirectServlet(hs).register(http_server)
|
CasRedirectServlet(hs).register(http_server)
|
||||||
CasTicketServlet(hs).register(http_server)
|
CasTicketServlet(hs).register(http_server)
|
||||||
|
@ -129,21 +129,6 @@ class RegistrationTestCase(unittest.TestCase):
|
|||||||
with self.assertRaises(ResourceLimitError):
|
with self.assertRaises(ResourceLimitError):
|
||||||
yield self.handler.register(localpart="local_part")
|
yield self.handler.register(localpart="local_part")
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
|
||||||
def test_register_saml2_mau_blocked(self):
|
|
||||||
self.hs.config.limit_usage_by_mau = True
|
|
||||||
self.store.get_monthly_active_count = Mock(
|
|
||||||
return_value=defer.succeed(self.lots_of_users)
|
|
||||||
)
|
|
||||||
with self.assertRaises(ResourceLimitError):
|
|
||||||
yield self.handler.register_saml2(localpart="local_part")
|
|
||||||
|
|
||||||
self.store.get_monthly_active_count = Mock(
|
|
||||||
return_value=defer.succeed(self.hs.config.max_mau_value)
|
|
||||||
)
|
|
||||||
with self.assertRaises(ResourceLimitError):
|
|
||||||
yield self.handler.register_saml2(localpart="local_part")
|
|
||||||
|
|
||||||
@defer.inlineCallbacks
|
@defer.inlineCallbacks
|
||||||
def test_auto_create_auto_join_rooms(self):
|
def test_auto_create_auto_join_rooms(self):
|
||||||
room_alias_str = "#room:test"
|
room_alias_str = "#room:test"
|
||||||
|
Loading…
Reference in New Issue
Block a user