Improve SAML error messages #8248

clokep · 2020-09-03T19:55:57Z

This aims to improve the error messages shown during various SAML errors and consolidate the way that our SSO providers work.

It should be reviewable commit-by-commit, the diff looks scary, but when you remove the first commit (which is just refactoring code) it shouldn't be too bad.

Render the error page directly instead of pulling information out of the Synapse error.
Share an error template between the various SSO providers.

I'd like to follow this up with another PR that consolidates some of the logic between SSO providers (by adding an SSO handler base class), but not sure that's really necessary.

I think with this we can say fixes #7056.

clokep · 2020-09-08T13:52:50Z

I reworked this a bit to simply fix the regression first in #8252.

anoadragon453

Just some small things here and there. Overall a great cleanup.

synapse/handlers/saml_handler.py

synapse/res/templates/sso_error.html

anoadragon453 · 2020-09-08T16:39:38Z

synapse/rest/saml2/response_resource.py


    async def _async_render_GET(self, request):
        # We're not expecting any GET request on that resource if everything goes right,
        # but some IdPs sometimes end up responding with a 302 redirect on this endpoint.
        # In this case, just tell the user that something went wrong and they should
        # try to authenticate again.
-        f = failure.Failure(
-            SynapseError(400, "Unexpected GET request on /saml2/authn_response")
+        self._saml_handler._render_error(


Should we make render_error public, or since it's still used in synapse.rest.saml2 we consider it private?

My thought was that since it is still used in the saml code it could be private so that random users of the SamlHandler don't use it?

Fair yeah, I agree that the one exception here outweighs the issue of it being used accidentally elsewhere.

synapse/config/saml2_config.py

clokep · 2020-09-08T17:02:14Z

@anoadragon453 Thanks for reviewing, I think there's a couple of things I should have pointed out in the description:

_render_error is currently copied from OidcHandler to SamlHandler, so a couple of the comments are totally valid, but not really new in this PR. 😄
The changes to sso_error.html are essentially overwriting it with the contents of (the deleted) saml_error.html file and changing the variable names to match what _render_error uses.

Maybe this would be clearer if I did the abstracting mentioned in the description in this PR? What do you think?

anoadragon453 · 2020-09-08T17:57:35Z

Aha! I get you now, and no worries, you can shrug off the comments that aren't relevant to the changes in this PR, I think I just automatically made them 😋

Maybe this would be clearer if I did the abstracting mentioned in the description in this PR? What do you think?

Possibly, but now that I see what you mean I don't think you need to do the changes here.

anoadragon453

Feel free to cherry-pick the fixes you find relevant. I don't think the security note is really a concern, just wanted to sanity-check with you about it while we were here.

clokep · 2020-09-08T19:00:39Z

I think a couple of them are improvements so I'll put them in both spots for now. Sorry for not being clear in the description!

clokep · 2020-09-09T14:35:29Z

Do we have any opinions about just removing this template without any deprecation effort?

anoadragon453 · 2020-09-10T12:22:25Z

@clokep I think it could catch some people off-guard if they've customised their saml2 error page, but not the SSO error page. They'd then end up with a non-branded error page being presented to their users.

However, we typically place a note in UPGRADE.rst to warn sysadmins of new templates, so that they can brand them before they upgrade their Synapse.

The failure mode and process for sysadmins between these two situations is the same, so I don't think we need to do anything different from what we normally do. Thus, just sticking a note in UPGRADE.rst about the change and who it will affect should be sufficient.

Stale

clokep · 2020-09-10T18:25:08Z

@anoadragon453 Can you take a look at the upgrade note I added and see if it makes sense?

…-errs

anoadragon453

lgtm otherwise

anoadragon453 · 2020-09-14T12:22:17Z

UPGRADE.rst

+``sso_error.html`` template. If your Synapse is configured to use SAML and a
+custom ``sso_redirect_confirm_template_dir`` configuration then the
+``saml_error.html`` template will need to be renamed to ``sso_error.html`` and
+updated:


sso_error.html already exists right? As a user I may be a bit confused if I've branded both pages already, and I'm being told to "rename one to the other".

It does, but if you were using SAML you wouldn't/shouldn't have been using it. I'll try to clarify this though!

Looks great, thanks!

@dklimpel

Synapse 1.21.0rc1 (2020-10-01) ============================== Features -------- - Require the user to confirm that their password should be reset after clicking the email confirmation link. ([\#8004](#8004)) - Add an admin API `GET /_synapse/admin/v1/event_reports` to read entries of table `event_reports`. Contributed by @dklimpel. ([\#8217](#8217)) - Consolidate the SSO error template across all configuration. ([\#8248](#8248), [\#8405](#8405)) - Add a configuration option to specify a whitelist of domains that a user can be redirected to after validating their email or phone number. ([\#8275](#8275), [\#8417](#8417)) - Add experimental support for sharding event persister. ([\#8294](#8294), [\#8387](#8387), [\#8396](#8396), [\#8419](#8419)) - Add the room topic and avatar to the room details admin API. ([\#8305](#8305)) - Add an admin API for querying rooms where a user is a member. Contributed by @dklimpel. ([\#8306](#8306)) - Add `uk.half-shot.msc2778.login.application_service` login type to allow appservices to login. ([\#8320](#8320)) - Add a configuration option that allows existing users to log in with OpenID Connect. Contributed by @BBBSnowball and @OmmyZhang. ([\#8345](#8345)) - Add prometheus metrics for replication requests. ([\#8406](#8406)) - Support passing additional single sign-on parameters to the client. ([\#8413](#8413)) - Add experimental reporting of metrics on expensive rooms for state-resolution. ([\#8420](#8420)) - Add experimental prometheus metric to track numbers of "large" rooms for state resolutiom. ([\#8425](#8425)) - Add prometheus metrics to track federation delays. ([\#8430](#8430)) Bugfixes -------- - Fix a bug in the media repository where remote thumbnails with the same size but different crop methods would overwrite each other. Contributed by @deepbluev7. ([\#7124](#7124)) - Fix inconsistent handling of non-existent push rules, and stop tracking the `enabled` state of removed push rules. ([\#7796](#7796)) - Fix a longstanding bug when storing a media file with an empty `upload_name`. ([\#7905](#7905)) - Fix messages not being sent over federation until an event is sent into the same room. ([\#8230](#8230), [\#8247](#8247), [\#8258](#8258), [\#8272](#8272), [\#8322](#8322)) - Fix a longstanding bug where files that could not be thumbnailed would result in an Internal Server Error. ([\#8236](#8236), [\#8435](#8435)) - Upgrade minimum version of `canonicaljson` to version 1.4.0, to fix an unicode encoding issue. ([\#8262](#8262)) - Fix longstanding bug which could lead to incomplete database upgrades on SQLite. ([\#8265](#8265)) - Fix stack overflow when stderr is redirected to the logging system, and the logging system encounters an error. ([\#8268](#8268)) - Fix a bug which cause the logging system to report errors, if `DEBUG` was enabled and no `context` filter was applied. ([\#8278](#8278)) - Fix edge case where push could get delayed for a user until a later event was pushed. ([\#8287](#8287)) - Fix fetching malformed events from remote servers. ([\#8324](#8324)) - Fix `UnboundLocalError` from occuring when appservices send a malformed register request. ([\#8329](#8329)) - Don't send push notifications to expired user accounts. ([\#8353](#8353)) - Fix a regression in v1.19.0 with reactivating users through the admin API. ([\#8362](#8362)) - Fix a bug where during device registration the length of the device name wasn't limited. ([\#8364](#8364)) - Include `guest_access` in the fields that are checked for null bytes when updating `room_stats_state`. Broke in v1.7.2. ([\#8373](#8373)) - Fix theoretical race condition where events are not sent down `/sync` if the synchrotron worker is restarted without restarting other workers. ([\#8374](#8374)) - Fix a bug which could cause errors in rooms with malformed membership events, on servers using sqlite. ([\#8385](#8385)) - Fix "Re-starting finished log context" warning when receiving an event we already had over federation. ([\#8398](#8398)) - Fix incorrect handling of timeouts on outgoing HTTP requests. ([\#8400](#8400)) - Fix a regression in v1.20.0 in the `synapse_port_db` script regarding the `ui_auth_sessions_ips` table. ([\#8410](#8410)) - Remove unnecessary 3PID registration check when resetting password via an email address. Bug introduced in v0.34.0rc2. ([\#8414](#8414)) Improved Documentation ---------------------- - Add `/_synapse/client` to the reverse proxy documentation. ([\#8227](#8227)) - Add note to the reverse proxy settings documentation about disabling Apache's mod_security2. Contributed by Julian Fietkau (@jfietkau). ([\#8375](#8375)) - Improve description of `server_name` config option in `homserver.yaml`. ([\#8415](#8415)) Deprecations and Removals ------------------------- - Drop support for `prometheus_client` older than 0.4.0. ([\#8426](#8426)) Internal Changes ---------------- - Fix tests on distros which disable TLSv1.0. Contributed by @danc86. ([\#8208](#8208)) - Simplify the distributor code to avoid unnecessary work. ([\#8216](#8216)) - Remove the `populate_stats_process_rooms_2` background job and restore functionality to `populate_stats_process_rooms`. ([\#8243](#8243)) - Clean up type hints for `PaginationConfig`. ([\#8250](#8250), [\#8282](#8282)) - Track the latest event for every destination and room for catch-up after federation outage. ([\#8256](#8256)) - Fix non-user visible bug in implementation of `MultiWriterIdGenerator.get_current_token_for_writer`. ([\#8257](#8257)) - Switch to the JSON implementation from the standard library. ([\#8259](#8259)) - Add type hints to `synapse.util.async_helpers`. ([\#8260](#8260)) - Simplify tests that mock asynchronous functions. ([\#8261](#8261)) - Add type hints to `StreamToken` and `RoomStreamToken` classes. ([\#8279](#8279)) - Change `StreamToken.room_key` to be a `RoomStreamToken` instance. ([\#8281](#8281)) - Refactor notifier code to correctly use the max event stream position. ([\#8288](#8288)) - Use slotted classes where possible. ([\#8296](#8296)) - Support testing the local Synapse checkout against the [Complement homeserver test suite](https://github.com/matrix-org/complement/). ([\#8317](#8317)) - Update outdated usages of `metaclass` to python 3 syntax. ([\#8326](#8326)) - Move lint-related dependencies to package-extra field, update CONTRIBUTING.md to utilise this. ([\#8330](#8330), [\#8377](#8377)) - Use the `admin_patterns` helper in additional locations. ([\#8331](#8331)) - Fix test logging to allow braces in log output. ([\#8335](#8335)) - Remove `__future__` imports related to Python 2 compatibility. ([\#8337](#8337)) - Simplify `super()` calls to Python 3 syntax. ([\#8344](#8344)) - Fix bad merge from `release-v1.20.0` branch to `develop`. ([\#8354](#8354)) - Factor out a `_send_dummy_event_for_room` method. ([\#8370](#8370)) - Improve logging of state resolution. ([\#8371](#8371)) - Add type annotations to `SimpleHttpClient`. ([\#8372](#8372)) - Refactor ID generators to use `async with` syntax. ([\#8383](#8383)) - Add `EventStreamPosition` type. ([\#8388](#8388)) - Create a mechanism for marking tests "logcontext clean". ([\#8399](#8399)) - A pair of tiny cleanups in the federation request code. ([\#8401](#8401)) - Add checks on startup that PostgreSQL sequences are consistent with their associated tables. ([\#8402](#8402)) - Do not include appservice users when calculating the total MAU for a server. ([\#8404](#8404)) - Typing fixes for `synapse.handlers.federation`. ([\#8422](#8422)) - Various refactors to simplify stream token handling. ([\#8423](#8423)) - Make stream token serializing/deserializing async. ([\#8427](#8427))

@dklimpel

Synapse 1.21.2 (2020-10-15) =========================== Debian packages and Docker images have been rebuilt using the latest versions of dependency libraries, including authlib 0.15.1. Please see bugfixes below. Security advisory ----------------- * HTML pages served via Synapse were vulnerable to cross-site scripting (XSS) attacks. All server administrators are encouraged to upgrade. ([\#8444](matrix-org/synapse#8444)) ([CVE-2020-26891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26891)) This fix was originally included in v1.21.0 but was missing a security advisory. This was reported by [Denis Kasak](https://github.com/dkasak). Bugfixes -------- - Fix rare bug where sending an event would fail due to a racey assertion. ([\#8530](matrix-org/synapse#8530)) - An updated version of the authlib dependency is included in the Docker and Debian images to fix an issue using OpenID Connect. See [\#8534](matrix-org/synapse#8534) for details. Synapse 1.21.1 (2020-10-13) =========================== This release fixes a regression in v1.21.0 that prevented debian packages from being built. It is otherwise identical to v1.21.0. Synapse 1.21.0 (2020-10-12) =========================== No significant changes since v1.21.0rc3. As [noted in v1.20.0](https://github.com/matrix-org/synapse/blob/release-v1.21.0/CHANGES.md#synapse-1200-2020-09-22), a future release will drop support for accessing Synapse's [Admin API](https://github.com/matrix-org/synapse/tree/master/docs/admin_api) under the `/_matrix/client/*` endpoint prefixes. At that point, the Admin API will only be accessible under `/_synapse/admin`. Synapse 1.21.0rc3 (2020-10-08) ============================== Bugfixes -------- - Fix duplication of events on high traffic servers, caused by PostgreSQL `could not serialize access due to concurrent update` errors. ([\#8456](matrix-org/synapse#8456)) Internal Changes ---------------- - Add Groovy Gorilla to the list of distributions we build `.deb`s for. ([\#8475](matrix-org/synapse#8475)) Synapse 1.21.0rc2 (2020-10-02) ============================== Features -------- - Convert additional templates from inline HTML to Jinja2 templates. ([\#8444](matrix-org/synapse#8444)) Bugfixes -------- - Fix a regression in v1.21.0rc1 which broke thumbnails of remote media. ([\#8438](matrix-org/synapse#8438)) - Do not expose the experimental `uk.half-shot.msc2778.login.application_service` flow in the login API, which caused a compatibility problem with Element iOS. ([\#8440](matrix-org/synapse#8440)) - Fix malformed log line in new federation "catch up" logic. ([\#8442](matrix-org/synapse#8442)) - Fix DB query on startup for negative streams which caused long start up times. Introduced in [\#8374](matrix-org/synapse#8374). ([\#8447](matrix-org/synapse#8447)) Synapse 1.21.0rc1 (2020-10-01) ============================== Features -------- - Require the user to confirm that their password should be reset after clicking the email confirmation link. ([\#8004](matrix-org/synapse#8004)) - Add an admin API `GET /_synapse/admin/v1/event_reports` to read entries of table `event_reports`. Contributed by @dklimpel. ([\#8217](matrix-org/synapse#8217)) - Consolidate the SSO error template across all configuration. ([\#8248](matrix-org/synapse#8248), [\#8405](matrix-org/synapse#8405)) - Add a configuration option to specify a whitelist of domains that a user can be redirected to after validating their email or phone number. ([\#8275](matrix-org/synapse#8275), [\#8417](matrix-org/synapse#8417)) - Add experimental support for sharding event persister. ([\#8294](matrix-org/synapse#8294), [\#8387](matrix-org/synapse#8387), [\#8396](matrix-org/synapse#8396), [\#8419](matrix-org/synapse#8419)) - Add the room topic and avatar to the room details admin API. ([\#8305](matrix-org/synapse#8305)) - Add an admin API for querying rooms where a user is a member. Contributed by @dklimpel. ([\#8306](matrix-org/synapse#8306)) - Add `uk.half-shot.msc2778.login.application_service` login type to allow appservices to login. ([\#8320](matrix-org/synapse#8320)) - Add a configuration option that allows existing users to log in with OpenID Connect. Contributed by @BBBSnowball and @OmmyZhang. ([\#8345](matrix-org/synapse#8345)) - Add prometheus metrics for replication requests. ([\#8406](matrix-org/synapse#8406)) - Support passing additional single sign-on parameters to the client. ([\#8413](matrix-org/synapse#8413)) - Add experimental reporting of metrics on expensive rooms for state-resolution. ([\#8420](matrix-org/synapse#8420)) - Add experimental prometheus metric to track numbers of "large" rooms for state resolutiom. ([\#8425](matrix-org/synapse#8425)) - Add prometheus metrics to track federation delays. ([\#8430](matrix-org/synapse#8430)) Bugfixes -------- - Fix a bug in the media repository where remote thumbnails with the same size but different crop methods would overwrite each other. Contributed by @deepbluev7. ([\#7124](matrix-org/synapse#7124)) - Fix inconsistent handling of non-existent push rules, and stop tracking the `enabled` state of removed push rules. ([\#7796](matrix-org/synapse#7796)) - Fix a longstanding bug when storing a media file with an empty `upload_name`. ([\#7905](matrix-org/synapse#7905)) - Fix messages not being sent over federation until an event is sent into the same room. ([\#8230](matrix-org/synapse#8230), [\#8247](matrix-org/synapse#8247), [\#8258](matrix-org/synapse#8258), [\#8272](matrix-org/synapse#8272), [\#8322](matrix-org/synapse#8322)) - Fix a longstanding bug where files that could not be thumbnailed would result in an Internal Server Error. ([\#8236](matrix-org/synapse#8236), [\#8435](matrix-org/synapse#8435)) - Upgrade minimum version of `canonicaljson` to version 1.4.0, to fix an unicode encoding issue. ([\#8262](matrix-org/synapse#8262)) - Fix longstanding bug which could lead to incomplete database upgrades on SQLite. ([\#8265](matrix-org/synapse#8265)) - Fix stack overflow when stderr is redirected to the logging system, and the logging system encounters an error. ([\#8268](matrix-org/synapse#8268)) - Fix a bug which cause the logging system to report errors, if `DEBUG` was enabled and no `context` filter was applied. ([\#8278](matrix-org/synapse#8278)) - Fix edge case where push could get delayed for a user until a later event was pushed. ([\#8287](matrix-org/synapse#8287)) - Fix fetching malformed events from remote servers. ([\#8324](matrix-org/synapse#8324)) - Fix `UnboundLocalError` from occuring when appservices send a malformed register request. ([\#8329](matrix-org/synapse#8329)) - Don't send push notifications to expired user accounts. ([\#8353](matrix-org/synapse#8353)) - Fix a regression in v1.19.0 with reactivating users through the admin API. ([\#8362](matrix-org/synapse#8362)) - Fix a bug where during device registration the length of the device name wasn't limited. ([\#8364](matrix-org/synapse#8364)) - Include `guest_access` in the fields that are checked for null bytes when updating `room_stats_state`. Broke in v1.7.2. ([\#8373](matrix-org/synapse#8373)) - Fix theoretical race condition where events are not sent down `/sync` if the synchrotron worker is restarted without restarting other workers. ([\#8374](matrix-org/synapse#8374)) - Fix a bug which could cause errors in rooms with malformed membership events, on servers using sqlite. ([\#8385](matrix-org/synapse#8385)) - Fix "Re-starting finished log context" warning when receiving an event we already had over federation. ([\#8398](matrix-org/synapse#8398)) - Fix incorrect handling of timeouts on outgoing HTTP requests. ([\#8400](matrix-org/synapse#8400)) - Fix a regression in v1.20.0 in the `synapse_port_db` script regarding the `ui_auth_sessions_ips` table. ([\#8410](matrix-org/synapse#8410)) - Remove unnecessary 3PID registration check when resetting password via an email address. Bug introduced in v0.34.0rc2. ([\#8414](matrix-org/synapse#8414)) Improved Documentation ---------------------- - Add `/_synapse/client` to the reverse proxy documentation. ([\#8227](matrix-org/synapse#8227)) - Add note to the reverse proxy settings documentation about disabling Apache's mod_security2. Contributed by Julian Fietkau (@jfietkau). ([\#8375](matrix-org/synapse#8375)) - Improve description of `server_name` config option in `homserver.yaml`. ([\#8415](matrix-org/synapse#8415)) Deprecations and Removals ------------------------- - Drop support for `prometheus_client` older than 0.4.0. ([\#8426](matrix-org/synapse#8426)) Internal Changes ---------------- - Fix tests on distros which disable TLSv1.0. Contributed by @danc86. ([\#8208](matrix-org/synapse#8208)) - Simplify the distributor code to avoid unnecessary work. ([\#8216](matrix-org/synapse#8216)) - Remove the `populate_stats_process_rooms_2` background job and restore functionality to `populate_stats_process_rooms`. ([\#8243](matrix-org/synapse#8243)) - Clean up type hints for `PaginationConfig`. ([\#8250](matrix-org/synapse#8250), [\#8282](matrix-org/synapse#8282)) - Track the latest event for every destination and room for catch-up after federation outage. ([\#8256](matrix-org/synapse#8256)) - Fix non-user visible bug in implementation of `MultiWriterIdGenerator.get_current_token_for_writer`. ([\#8257](matrix-org/synapse#8257)) - Switch to the JSON implementation from the standard library. ([\#8259](matrix-org/synapse#8259)) - Add type hints to `synapse.util.async_helpers`. ([\#8260](matrix-org/synapse#8260)) - Simplify tests that mock asynchronous functions. ([\#8261](matrix-org/synapse#8261)) - Add type hints to `StreamToken` and `RoomStreamToken` classes. ([\#8279](matrix-org/synapse#8279)) - Change `StreamToken.room_key` to be a `RoomStreamToken` instance. ([\#8281](matrix-org/synapse#8281)) - Refactor notifier code to correctly use the max event stream position. ([\#8288](matrix-org/synapse#8288)) - Use slotted classes where possible. ([\#8296](matrix-org/synapse#8296)) - Support testing the local Synapse checkout against the [Complement homeserver test suite](https://github.com/matrix-org/complement/). ([\#8317](matrix-org/synapse#8317)) - Update outdated usages of `metaclass` to python 3 syntax. ([\#8326](matrix-org/synapse#8326)) - Move lint-related dependencies to package-extra field, update CONTRIBUTING.md to utilise this. ([\#8330](matrix-org/synapse#8330), [\#8377](matrix-org/synapse#8377)) - Use the `admin_patterns` helper in additional locations. ([\#8331](matrix-org/synapse#8331)) - Fix test logging to allow braces in log output. ([\#8335](matrix-org/synapse#8335)) - Remove `__future__` imports related to Python 2 compatibility. ([\#8337](matrix-org/synapse#8337)) - Simplify `super()` calls to Python 3 syntax. ([\#8344](matrix-org/synapse#8344)) - Fix bad merge from `release-v1.20.0` branch to `develop`. ([\#8354](matrix-org/synapse#8354)) - Factor out a `_send_dummy_event_for_room` method. ([\#8370](matrix-org/synapse#8370)) - Improve logging of state resolution. ([\#8371](matrix-org/synapse#8371)) - Add type annotations to `SimpleHttpClient`. ([\#8372](matrix-org/synapse#8372)) - Refactor ID generators to use `async with` syntax. ([\#8383](matrix-org/synapse#8383)) - Add `EventStreamPosition` type. ([\#8388](matrix-org/synapse#8388)) - Create a mechanism for marking tests "logcontext clean". ([\#8399](matrix-org/synapse#8399)) - A pair of tiny cleanups in the federation request code. ([\#8401](matrix-org/synapse#8401)) - Add checks on startup that PostgreSQL sequences are consistent with their associated tables. ([\#8402](matrix-org/synapse#8402)) - Do not include appservice users when calculating the total MAU for a server. ([\#8404](matrix-org/synapse#8404)) - Typing fixes for `synapse.handlers.federation`. ([\#8422](matrix-org/synapse#8422)) - Various refactors to simplify stream token handling. ([\#8423](matrix-org/synapse#8423)) - Make stream token serializing/deserializing async. ([\#8427](matrix-org/synapse#8427))

* commit '837293c31': Remove obsolete __future__ imports (#8337) Use admin_patterns for all admin APIs. (#8331) Fix a potential bug of UnboundLocalError (#8329) Switch metaclass initialization to python 3-compatible syntax (#8326) Catch-up after Federation Outage (split, 4): catch-up loop (#8272) Use slots in attrs classes where possible (#8296) Fix typos in comments. Add the topic and avatar to the room details admin API (#8305) Improve SAML error messages (#8248) Add experimental support for sharding event persister. Again. (#8294) Make `StreamToken.room_key` be a `RoomStreamToken` instance. (#8281) Use TLSv1.2 for fake servers in tests (#8208) Add /_synapse/client to the reverse proxy docs (#8227) Clean up `Notifier.on_new_room_event` code path (#8288)

clokep mentioned this pull request Sep 4, 2020

Fix a regression from calling read_templates. #8252

Merged

clokep force-pushed the clokep/better-saml-errs branch from 6b805cb to 34e4f0f Compare September 4, 2020 11:25

clokep added 6 commits September 8, 2020 09:51

Separate the SAML2 mapping code from the response parsing code.

c34eca9

Render errors for issues handling the SAML response.

5171d1f

Render errors for issues mapping to an MXID.

a11c959

Use the SAML error page for all SSO errors.

0b3f8aa

Stop using the SAML error page.

f6fb379

Add changelog file.

01978a2

clokep force-pushed the clokep/better-saml-errs branch from 34e4f0f to 01978a2 Compare September 8, 2020 13:52

clokep requested a review from a team September 8, 2020 14:36

anoadragon453 reviewed Sep 8, 2020

View reviewed changes

anoadragon453 previously approved these changes Sep 8, 2020

View reviewed changes

clokep added 2 commits September 9, 2020 10:33

Review feedback.

0b51a20

Merge branch 'develop' into clokep/better-saml-errs

15dfc46

Add upgrade notes.

eb6be88

clokep requested a review from anoadragon453 September 10, 2020 18:24

clokep added 2 commits September 11, 2020 08:43

Merge remote-tracking branch 'origin/develop' into clokep/better-saml…

ba9c7db

…-errs

Move upgrade notes.

3a9e289

anoadragon453 approved these changes Sep 14, 2020

View reviewed changes

Review feedback.

d097dba

clokep merged commit 6605470 into develop Sep 14, 2020

clokep deleted the clokep/better-saml-errs branch September 14, 2020 13:05

clokep mentioned this pull request Sep 25, 2020

Escape the error description on the sso_error template. #8405

Merged

clokep mentioned this pull request Nov 16, 2020

Abstract shared SSO code #8765

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve SAML error messages #8248

Improve SAML error messages #8248

clokep commented Sep 3, 2020 •

edited

Loading

clokep commented Sep 8, 2020

anoadragon453 left a comment

anoadragon453 Sep 8, 2020

clokep Sep 9, 2020

anoadragon453 Sep 14, 2020

clokep commented Sep 8, 2020

anoadragon453 commented Sep 8, 2020

anoadragon453 left a comment

clokep commented Sep 8, 2020

clokep commented Sep 9, 2020

anoadragon453 commented Sep 10, 2020

clokep commented Sep 10, 2020

anoadragon453 left a comment

anoadragon453 Sep 14, 2020

clokep Sep 14, 2020

anoadragon453 Sep 14, 2020

Improve SAML error messages #8248

Improve SAML error messages #8248

Conversation

clokep commented Sep 3, 2020 • edited Loading

clokep commented Sep 8, 2020

anoadragon453 left a comment

Choose a reason for hiding this comment

anoadragon453 Sep 8, 2020

Choose a reason for hiding this comment

clokep Sep 9, 2020

Choose a reason for hiding this comment

anoadragon453 Sep 14, 2020

Choose a reason for hiding this comment

clokep commented Sep 8, 2020

anoadragon453 commented Sep 8, 2020

anoadragon453 left a comment

Choose a reason for hiding this comment

clokep commented Sep 8, 2020

clokep commented Sep 9, 2020

anoadragon453 commented Sep 10, 2020

clokep commented Sep 10, 2020

anoadragon453 left a comment

Choose a reason for hiding this comment

anoadragon453 Sep 14, 2020

Choose a reason for hiding this comment

clokep Sep 14, 2020

Choose a reason for hiding this comment

anoadragon453 Sep 14, 2020

Choose a reason for hiding this comment

clokep commented Sep 3, 2020 •

edited

Loading