mirror of
https://mau.dev/maunium/synapse.git
synced 2024-12-14 04:13:46 +01:00
Put SAML callback URI under /_synapse/client. (#9289)
This commit is contained in:
parent
846b9d3df0
commit
8f75bf1df7
10 changed files with 25 additions and 13 deletions
|
@ -99,6 +99,10 @@ to the list of permitted "redirect URIs" at the identity provider.
|
|||
See `docs/openid.md <docs/openid.md>`_ for more information on setting up OpenID
|
||||
Connect.
|
||||
|
||||
(Note: a similar change is being made for SAML2; in this case the old URI
|
||||
``[synapse public baseurl]/_matrix/saml2`` is being deprecated, but will continue to
|
||||
work, so no immediate changes are required for existing installations.)
|
||||
|
||||
Changes to HTML templates
|
||||
-------------------------
|
||||
|
||||
|
|
1
changelog.d/9289.removal
Normal file
1
changelog.d/9289.removal
Normal file
|
@ -0,0 +1 @@
|
|||
Add new endpoint `/_synapse/client/saml2` for SAML2 authentication callbacks, and deprecate the old endpoint `/_matrix/saml2`.
|
|
@ -1566,10 +1566,10 @@ trusted_key_servers:
|
|||
# enable SAML login.
|
||||
#
|
||||
# Once SAML support is enabled, a metadata file will be exposed at
|
||||
# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
|
||||
# https://<server>:<port>/_synapse/client/saml2/metadata.xml, which you may be able to
|
||||
# use to configure your SAML IdP with. Alternatively, you can manually configure
|
||||
# the IdP to use an ACS location of
|
||||
# https://<server>:<port>/_matrix/saml2/authn_response.
|
||||
# https://<server>:<port>/_synapse/client/saml2/authn_response.
|
||||
#
|
||||
saml2_config:
|
||||
# `sp_config` is the configuration for the pysaml2 Service Provider.
|
||||
|
|
|
@ -269,7 +269,7 @@ using):
|
|||
^/_synapse/client/oidc/callback$
|
||||
|
||||
# SAML requests.
|
||||
^/_matrix/saml2/authn_response$
|
||||
^/_synapse/client/saml2/authn_response$
|
||||
|
||||
# CAS requests.
|
||||
^/_matrix/client/(api/v1|r0|unstable)/login/cas/ticket$
|
||||
|
|
|
@ -194,8 +194,8 @@ class SAML2Config(Config):
|
|||
optional_attributes.add(self.saml2_grandfathered_mxid_source_attribute)
|
||||
optional_attributes -= required_attributes
|
||||
|
||||
metadata_url = public_baseurl + "_matrix/saml2/metadata.xml"
|
||||
response_url = public_baseurl + "_matrix/saml2/authn_response"
|
||||
metadata_url = public_baseurl + "_synapse/client/saml2/metadata.xml"
|
||||
response_url = public_baseurl + "_synapse/client/saml2/authn_response"
|
||||
return {
|
||||
"entityid": metadata_url,
|
||||
"service": {
|
||||
|
@ -233,10 +233,10 @@ class SAML2Config(Config):
|
|||
# enable SAML login.
|
||||
#
|
||||
# Once SAML support is enabled, a metadata file will be exposed at
|
||||
# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
|
||||
# https://<server>:<port>/_synapse/client/saml2/metadata.xml, which you may be able to
|
||||
# use to configure your SAML IdP with. Alternatively, you can manually configure
|
||||
# the IdP to use an ACS location of
|
||||
# https://<server>:<port>/_matrix/saml2/authn_response.
|
||||
# https://<server>:<port>/_synapse/client/saml2/authn_response.
|
||||
#
|
||||
saml2_config:
|
||||
# `sp_config` is the configuration for the pysaml2 Service Provider.
|
||||
|
|
|
@ -133,7 +133,7 @@ class SamlHandler(BaseHandler):
|
|||
raise Exception("prepare_for_authenticate didn't return a Location header")
|
||||
|
||||
async def handle_saml_response(self, request: SynapseRequest) -> None:
|
||||
"""Handle an incoming request to /_matrix/saml2/authn_response
|
||||
"""Handle an incoming request to /_synapse/client/saml2/authn_response
|
||||
|
||||
Args:
|
||||
request: the incoming request from the browser. We'll
|
||||
|
|
|
@ -52,10 +52,13 @@ def build_synapse_client_resource_tree(hs: "HomeServer") -> Mapping[str, Resourc
|
|||
resources["/_synapse/client/oidc"] = OIDCResource(hs)
|
||||
|
||||
if hs.config.saml2_enabled:
|
||||
from synapse.rest.saml2 import SAML2Resource
|
||||
from synapse.rest.synapse.client.saml2 import SAML2Resource
|
||||
|
||||
# This is mounted under '/_matrix' for backwards-compatibility.
|
||||
resources["/_matrix/saml2"] = SAML2Resource(hs)
|
||||
res = SAML2Resource(hs)
|
||||
resources["/_synapse/client/saml2"] = res
|
||||
|
||||
# This is also mounted under '/_matrix' for backwards-compatibility.
|
||||
resources["/_matrix/saml2"] = res
|
||||
|
||||
return resources
|
||||
|
||||
|
|
|
@ -12,12 +12,13 @@
|
|||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import logging
|
||||
|
||||
from twisted.web.resource import Resource
|
||||
|
||||
from synapse.rest.saml2.metadata_resource import SAML2MetadataResource
|
||||
from synapse.rest.saml2.response_resource import SAML2ResponseResource
|
||||
from synapse.rest.synapse.client.saml2.metadata_resource import SAML2MetadataResource
|
||||
from synapse.rest.synapse.client.saml2.response_resource import SAML2ResponseResource
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
@ -27,3 +28,6 @@ class SAML2Resource(Resource):
|
|||
Resource.__init__(self)
|
||||
self.putChild(b"metadata.xml", SAML2MetadataResource(hs))
|
||||
self.putChild(b"authn_response", SAML2ResponseResource(hs))
|
||||
|
||||
|
||||
__all__ = ["SAML2Resource"]
|
Loading…
Reference in a new issue