This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Repository navigation
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
synapse requires unspecified user for m.login.password UI auth #5665
Description
The spec says that the client should submit a dict including an identifier object. In practice, synapse requires you to instead to just submit a user field, so the dict looks like:
{
"type": "m.login.password",
"user": "<user_id or user localpart>",
"password": "<password>",
"session": "<session ID>"
}
Activity
richvdh commentedon Jul 11, 2019
Note that riot-web currently relies on the broken impl working (element-hq/element-web#10312)
turt2live commentedon Jul 11, 2019
Also applies to
threepidCredson MSISDN (see matrix-org/matrix-react-sdk#3211)richvdh commentedon Aug 28, 2019
This is no longer true: riot-web submits both formats, and should continue to work when we fix this.
bmarty commentedon Nov 21, 2019
FTR RiotX uses the
identifierobjectdbkr commentedon Jan 21, 2020
It's obviously easy to do so, but I'm having to work around this in riot web now.
jcgruenhage commentedon May 4, 2020
So, riot-web has been sending both user and identifier for a while. Can the user parameter be removed as a requirement and just be optional, so that clients correctly implementing the spec can work with synapse?
jcgruenhage commentedon May 4, 2020
(Making this optional will not break clients)
jcgruenhage commentedon May 4, 2020
Also, riot-web is still broken with password changes: https://github.com/matrix-org/matrix-react-sdk/blob/0fcbe40becf8f2c3d0bc684728cf1f4646986e44/src/components/views/settings/ChangePassword.js#L144
Performance improvements and refactor of Ratelimiter (#7595)
Performance improvements and refactor of Ratelimiter (matrix-org#7595)
anoadragon453 commentedon Aug 27, 2020
#8182 is one part of this and is currently in review.
[-]synapse implements m.login.password UI auth incorrectly[/-][+]synapse requires unspecified `user` for m.login.password UI auth[/+]richvdh commentedon Nov 27, 2020
@turt2live: please can you help me out here: I can't figure out which endpoint is being called with what parameters, and what the correct behaviour is. (it sounds like a separate problem: better to open a separate issue?)
turt2live commentedon Nov 27, 2020
Between that PR and the others (matrix-org/matrix-react-sdk#4667 and company) there's a fairly wide range of endpoints. The
threepidCredsthing is most apparent on password resets or anything having UIA and email addresses as a flow. Theuserthing is most obvious on account deactivation, but can also be a case for changing passwords in the app (not reset, changing) as well.turt2live commentedon Nov 27, 2020
The undocumented
userobject is more or less at the wrong place compared to the spec, so Synapse just needs to change its lookup. ThethreepidCredsproblem is similar in that it's just spelled wrong between the spec and synapse's expectations.richvdh commentedon Nov 27, 2020
@turt2live: ok, to save readers of this issue (including myself) trying to reverse-engineer the problem from react-sdk PRs, please can you try to give some specific examples. The spec says
threepidCredsin some places andthree_pid_credsin others. What is synapse expecting, and what should it be expecting?Again I think this is orthogonal to
userso I'd encourage you to open a new issue.turt2live commentedon Nov 27, 2020
I don't have the context to be able to write up that issue anymore, sorry.
richvdh commentedon Nov 30, 2020
ok, I'm going to fix the
userissue and considerthreepidCredsan unrelated problem. If you/anyone has more info, please open a new issue.Support "identifier" dicts in UIA (#8848)