Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Fix SSO on workers #9271

Merged
merged 7 commits into from
Feb 1, 2021
Merged

Fix SSO on workers #9271

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a83decf
Factor out build_synapse_client_resource_tree
richvdh Jan 30, 2021
3fb8c08
Move sso init into build_synapse_client_resource_tree
richvdh Jan 30, 2021
64f5b6c
Fix SSO-login-via-a-worker
richvdh Jan 30, 2021
e897ff1
Update workers config for new endpoints
richvdh Jan 30, 2021
d500d1c
remove submit_token from workers endpoints list
richvdh Jan 30, 2021
bf83a20
changelog
richvdh Jan 30, 2021
ca42754
Add a comment about the odd path for SAML2Resource
richvdh Feb 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions docs/workers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,25 +256,28 @@ Additionally, the following endpoints should be included if Synapse is configure
to use SSO (you only need to include the ones for whichever SSO provider you're
using):

# for all SSO providers
^/_matrix/client/(api/v1|r0|unstable)/login/sso/redirect
^/_synapse/client/pick_idp$
^/_synapse/client/pick_username
^/_synapse/client/sso_register$

# OpenID Connect requests.
^/_matrix/client/(api/v1|r0|unstable)/login/sso/redirect$
^/_synapse/oidc/callback$

# SAML requests.
^/_matrix/client/(api/v1|r0|unstable)/login/sso/redirect$
^/_matrix/saml2/authn_response$

# CAS requests.
^/_matrix/client/(api/v1|r0|unstable)/login/(cas|sso)/redirect$
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this one was slightly different in that it has (cas|sso) in it. Not sure if any clients still use the cas path though.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeahh, I'm hoping that's old enough that basically nobody will encounter it.

^/_matrix/client/(api/v1|r0|unstable)/login/cas/ticket$

Note that a HTTP listener with `client` and `federation` resources must be
configured in the `worker_listeners` option in the worker config.

Ensure that all SSO logins go to a single process (usually the main process).
Ensure that all SSO logins go to a single process.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably true for the UI auth endpoints too?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure it is? afaik nothing is tracked in-memory for UIA (at least for CAS/OIDC; SAML has #7530)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, the username mapping sessions and extra attributes only matter on login, not during UI auth. OK.

For multiple workers not handling the SSO endpoints properly, see
[#7530](https://github.com/matrix-org/synapse/issues/7530).

Note that a HTTP listener with `client` and `federation` resources must be
configured in the `worker_listeners` option in the worker config.

#### Load balancing

It is possible to run multiple instances of this worker app, with incoming requests
Expand Down