Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Remove unstable/unspecced login types. #12597

Merged
merged 5 commits into from
May 4, 2022
Merged

Remove unstable/unspecced login types. #12597

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f73cbeb
Remove unspecced m.login.jwt login type.
clokep Apr 29, 2022
b771f52
Remove unstable MSC2778 login type.
clokep Apr 29, 2022
c8aa95c
Newsfragment
clokep Apr 29, 2022
ecebc28
Merge remote-tracking branch 'origin/develop' into clokep/stable-login
clokep May 4, 2022
1addabf
Add upgrade notes.
clokep May 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
Synapse 1.59.0
==============

The non-standard `m.login.jwt` login type has been removed from Synapse. It can be replaced with `org.matrix.login.jwt` for identical behaviour. This is only used if `jwt_config.enabled` is set to `true` in the configuration.


Synapse 1.58.0 (2022-05-03)
===========================

Expand Down
2 changes: 2 additions & 0 deletions changelog.d/12597.removal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Remove the unspecified `m.login.jwt` login type and the unstable `uk.half-shot.msc2778.login.application_service` from
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to shout a bit louder about the fact we're actually removing JWT support?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to shout a bit louder about the fact we're actually removing JWT support?

We're not, we're only removing the unspecced m.login.jwt type. There's still org.matrix.login.jwt type as documented at https://matrix-org.github.io/synapse/develop/jwt.html

If anyone is using this they should be able to s/m.login.jwt/org.matrix.login.jwt/g and it should work fine.

What do you think?

[MSC2778](https://github.com/matrix-org/matrix-doc/pull/2778).
3 changes: 0 additions & 3 deletions docs/jwt.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,6 @@ follows:
}
```

Note that the login type of `m.login.jwt` is supported, but is deprecated. This
will be removed in a future version of Synapse.

The `token` field should include the JSON web token with the following claims:

* A claim that encodes the local part of the user ID is required. By default,
Expand Down
15 changes: 4 additions & 11 deletions synapse/rest/client/login.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,7 @@ class LoginRestServlet(RestServlet):
SSO_TYPE = "m.login.sso"
TOKEN_TYPE = "m.login.token"
JWT_TYPE = "org.matrix.login.jwt"
JWT_TYPE_DEPRECATED = "m.login.jwt"
APPSERVICE_TYPE = "m.login.application_service"
APPSERVICE_TYPE_UNSTABLE = "uk.half-shot.msc2778.login.application_service"
REFRESH_TOKEN_PARAM = "refresh_token"

def __init__(self, hs: "HomeServer"):
Expand Down Expand Up @@ -126,7 +124,6 @@ def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
flows: List[JsonDict] = []
if self.jwt_enabled:
flows.append({"type": LoginRestServlet.JWT_TYPE})
flows.append({"type": LoginRestServlet.JWT_TYPE_DEPRECATED})

if self.cas_enabled:
# we advertise CAS for backwards compat, though MSC1721 renamed it
Expand Down Expand Up @@ -156,7 +153,6 @@ def on_GET(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
flows.extend({"type": t} for t in self.auth_handler.get_supported_login_types())

flows.append({"type": LoginRestServlet.APPSERVICE_TYPE})
flows.append({"type": LoginRestServlet.APPSERVICE_TYPE_UNSTABLE})

return 200, {"flows": flows}

Expand All @@ -175,10 +171,7 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, LoginResponse]:
)

try:
if login_submission["type"] in (
LoginRestServlet.APPSERVICE_TYPE,
LoginRestServlet.APPSERVICE_TYPE_UNSTABLE,
):
if login_submission["type"] == LoginRestServlet.APPSERVICE_TYPE:
appservice = self.auth.get_appservice_by_req(request)

if appservice.is_rate_limited():
Expand All @@ -191,9 +184,9 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, LoginResponse]:
appservice,
should_issue_refresh_token=should_issue_refresh_token,
)
elif self.jwt_enabled and (
login_submission["type"] == LoginRestServlet.JWT_TYPE
or login_submission["type"] == LoginRestServlet.JWT_TYPE_DEPRECATED
elif (
self.jwt_enabled
and login_submission["type"] == LoginRestServlet.JWT_TYPE
):
await self._address_ratelimiter.ratelimit(None, request.getClientIP())
result = await self._do_jwt_login(
Expand Down
4 changes: 1 addition & 3 deletions tests/handlers/test_password_providers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,9 @@
from tests.test_utils import make_awaitable
from tests.unittest import override_config

# (possibly experimental) login flows we expect to appear in the list after the normal
# ones
# Login flows we expect to appear in the list after the normal ones.
ADDITIONAL_LOGIN_FLOWS = [
{"type": "m.login.application_service"},
{"type": "uk.half-shot.msc2778.login.application_service"},
]

# a mock instance which the dummy auth providers delegate to, so we can see what's going
Expand Down
4 changes: 1 addition & 3 deletions tests/rest/client/test_login.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,11 +81,9 @@
# the query params in TEST_CLIENT_REDIRECT_URL
EXPECTED_CLIENT_REDIRECT_URL_PARAMS = [("<ab c>", ""), ('q" =+"', '"fö&=o"')]

# (possibly experimental) login flows we expect to appear in the list after the normal
# ones
# Login flows we expect to appear in the list after the normal ones.
ADDITIONAL_LOGIN_FLOWS = [
{"type": "m.login.application_service"},
{"type": "uk.half-shot.msc2778.login.application_service"},
]


Expand Down