David Robertson
32a59a6495
Keep track of user_ips and monthly_active_users when delegating auth ( #16672 )
...
* Describe `insert_client_ip`
* Pull out client_ips and MAU tracking to BaseAuth
* Define HAS_AUTHLIB once in tests
sick of copypasting
* Track ips and token usage when delegating auth
* Test that we track MAU and user_ips
* Don't track `__oidc_admin`
2023-11-23 12:35:37 +00:00
Patrick Cloke
55c20da4a3
Merge remote-tracking branch 'origin/release-v1.91' into release-v1.92
2023-09-06 11:25:28 -04:00
Quentin Gliech
1940d990a3
Revert MSC3861 introspection cache, admin impersonation and account lock ( #16258 )
2023-09-06 15:19:51 +01:00
Patrick Cloke
a8a46b1336
Replace simple_async_mock with AsyncMock ( #16180 )
...
Python 3.8 has a native AsyncMock, use it instead of a custom
implementation.
2023-08-25 09:27:21 -04:00
Shay
69048f7b48
Add an admin endpoint to allow authorizing server to signal token revocations ( #16125 )
2023-08-22 14:15:34 +00:00
Mathieu Velten
2d15e39684
MSC3861: allow impersonation by an admin using a query param ( #16132 )
2023-08-18 15:46:46 +02:00
Shay
54a51ff6c1
Cache token introspection response from OIDC provider ( #16117 )
2023-08-17 10:53:10 -07:00
Quentin Gliech
ceb3dd77db
Enforce that an admin token also has the basic Matrix API scope
2023-05-30 09:43:06 -04:00
Quentin Gliech
f739bde962
Reject tokens with multiple device scopes
2023-05-30 09:43:06 -04:00
Quentin Gliech
14a5be9c4d
Handle errors when introspecting tokens
...
This returns a proper 503 when the introspection endpoint is not working
for some reason, which should avoid logging out clients in those cases.
2023-05-30 09:43:06 -04:00
Quentin Gliech
e343125b38
Disable incompatible Admin API endpoints
2023-05-30 09:43:06 -04:00
Quentin Gliech
4d0231b364
Make AS tokens work & allow ASes to /register
2023-05-30 09:43:06 -04:00
Hugh Nimmo-Smith
249f4a338d
Refactor config to be an experimental feature
...
Also enforce you can't combine it with incompatible config options
2023-05-30 09:43:06 -04:00
Quentin Gliech
31691d6151
Disable account related endpoints when using OAuth delegation
2023-05-30 09:43:06 -04:00
Hugh Nimmo-Smith
5fe96082d0
Actually enforce guest + return www-authenticate header
2023-05-30 09:43:06 -04:00
Hugh Nimmo-Smith
28a9663bdf
Initial tests for OAuth delegation
2023-05-30 09:43:06 -04:00
