Matrix-Mirrors/forked-synapse
1
0
Fork 0
mirror of https://mau.dev/maunium/synapse.git synced 2024-10-01 01:36:05 -04:00
Code Issues Packages Projects Releases Wiki Activity
17,962 Commits 5 Branches 723 Tags 124 MiB
c21bdc813f
Commit Graph

34 Commits

Author SHA1 Message Date
Patrick Cloke
c21bdc813f
Add basic SAML tests for mapping users. (#8800) 2020-12-02 07:09:21 -05:00
Patrick Cloke
4fd222ad70
Support trying multiple localparts for OpenID Connect. (#8801) 
Abstracts the SAML and OpenID Connect code which attempts to regenerate
the localpart of a matrix ID if it is already in use.
 2020-11-25 10:04:22 -05:00
Patrick Cloke
6fde6aa9c0
Properly report user-agent/IP during registration of SSO users. (#8784) 
This also expands type-hints to the SSO and registration code.

Refactors the CAS code to more closely match OIDC/SAML.
 2020-11-23 13:28:03 -05:00
Andrew Morgan
59a995f38d
Improve logging of the mapping from SSO IDs to Matrix IDs. (#8773) 2020-11-23 08:45:23 -05:00
Patrick Cloke
79bfe966e0
Improve error checking for OIDC/SAML mapping providers (#8774) 
Checks that the localpart returned by mapping providers for SAML and
OIDC are valid before registering new users.

Extends the OIDC tests for existing users and invalid data.
 2020-11-19 14:25:17 -05:00
Ben Banfield-Zanin
53a6f5ddf0
SAML: Allow specifying the IdP entityid to use. (#8630) 
If the SAML metadata includes multiple IdPs it is necessary to
specify which IdP to redirect users to for authentication.
 2020-11-19 09:57:13 -05:00
Patrick Cloke
ee382025b0
Abstract shared SSO code. (#8765) 
De-duplicates code between the SAML and OIDC implementations.
 2020-11-17 09:46:23 -05:00
Erik Johnston
c850dd9a8e
Fix handling of User-Agent headers with bad utf-8. (#8632) 2020-10-23 17:12:59 +01:00
Patrick Cloke
aec294ee0d
Use slots in attrs classes where possible (#8296) 
slots use less memory (and attribute access is faster) while slightly
limiting the flexibility of the class attributes. This focuses on objects
which are instantiated "often" and for short periods of time.
 2020-09-14 12:50:06 -04:00
Patrick Cloke
6605470bfb
Improve SAML error messages (#8248) 2020-09-14 09:05:36 -04:00
Patrick Cloke
c619253db8
Stop sub-classing object (#8249) 2020-09-04 06:54:56 -04:00
Patrick Cloke
3f91638da6
Allow denying or shadow banning registrations via the spam checker (#8034) 2020-08-20 15:42:58 -04:00
Richard van der Hoff
0cb169900e
Implement login blocking based on SAML attributes (#8052) 
Hopefully this mostly speaks for itself. I also did a bit of cleaning up of the
error handling.

Fixes #8047
 2020-08-11 16:08:10 +01:00
Patrick Cloke
3a00bd1378
Add additional logging for SAML sessions. (#7971) 2020-07-29 13:54:44 -04:00
Richard van der Hoff
1bbc9e2df6
Clean up exception handling in SAML2ResponseResource (#7614) 
* Expose `return_html_error`, and allow it to take a Jinja2 template instead of a raw string

* Clean up exception handling in SAML2ResponseResource

  * use the existing code in `return_html_error` instead of re-implementing it
    (giving it a jinja2 template rather than inventing a new form of template)

  * do the exception-catching in the REST layer rather than in the handler
    layer, to make sure we catch all exceptions.
 2020-06-03 10:41:12 +01:00
Christopher Cooper
c4a820b32a
allow emails to be passed through SAML (#7385) 
Signed-off-by: Christopher Cooper <cooperc@ocf.berkeley.edu>
 2020-05-27 17:40:08 +01:00
Patrick Cloke
22246919e3
Add more type hints to SAML handler. (#7445) 2020-05-07 09:30:45 -04:00
Patrick Cloke
627b0f5f27
Persist user interactive authentication sessions (#7302) 
By persisting the user interactive authentication sessions to the database, this fixes
situations where a user hits different works throughout their auth session and also
allows sessions to persist through restarts of Synapse.
 2020-04-30 13:47:49 -04:00
Patrick Cloke
b85d7652ff
Do not allow a deactivated user to login via SSO. (#7240) 2020-04-09 13:28:13 -04:00
Patrick Cloke
b9930d24a0
Support SAML in the user interactive authentication workflow. (#7102) 2020-04-01 08:48:00 -04:00
Jason Robinson
060e7dce09 Allow RedirectResponse in SAML response handler 
Allow custom SAML handlers to redirect after processing an auth response.

Fixes #7149

Signed-off-by: Jason Robinson <jasonr@matrix.org>
 2020-03-26 19:02:35 +02:00
Brendan Abolivier
6b0efe73e2
SAML2: render a comprehensible error page if something goes wrong 
If an error happened while processing a SAML AuthN response, or a client
ends up doing a `GET` request to `/authn_response`, then render a
customisable error page rather than a confusing error.
 2020-03-10 13:59:22 +00:00
Brendan Abolivier
a0178df104 Fix wrong handler being used in SAML handler 2020-03-03 11:29:07 +00:00
Richard van der Hoff
59dc87c618
Merge pull request #6724 from matrix-org/rav/log_saml_attributes 
Log saml assertions rather than the whole response
 2020-01-17 10:33:24 +00:00
Richard van der Hoff
2b6a77fcde
Delegate remote_user_id mapping to the saml mapping provider (#6723) 
Turns out that figuring out a remote user id for the SAML user isn't quite as obvious as it seems. Factor it out to the SamlMappingProvider so that it's easy to control.
 2020-01-17 10:32:47 +00:00
Richard van der Hoff
acc7820574 Log saml assertions rather than the whole response 
... since the whole response is huge.

We even need to break up the assertions, since kibana otherwise truncates them.
 2020-01-16 22:26:34 +00:00
Richard van der Hoff
dc69a1cf43 Pass client redirect URL into SAML mapping providers 2020-01-12 21:40:49 +00:00
Richard van der Hoff
47e63cc67a Pass the module_api into the SamlMappingProvider 
... for consistency with other modules, and because we'll need it sooner or
later and it will be a pain to introduce later.
 2020-01-12 21:40:49 +00:00
Andrew Morgan
4947de5a14
Allow SAML username provider plugins (#6411) 2019-12-10 17:30:16 +00:00
Richard van der Hoff
33757bad19 More better logging 2019-09-20 11:20:02 +01:00
Richard van der Hoff
7423fade92 better logging 2019-09-19 17:16:50 +01:00
Richard van der Hoff
a8ac40445c Record mappings from saml users in an external table 
We want to assign unique mxids to saml users based on an incrementing
suffix. For that to work, we need to record the allocated mxid in a separate
table.
 2019-09-13 16:01:46 +01:00
Richard van der Hoff
3bcb13edd0 Address review comments 2019-07-01 12:13:22 +01:00
Richard van der Hoff
28db0ae537 cleanups 2019-06-27 00:37:41 +01:00