Update to 1.9.0 breaks authentication via LDAP (ma1sd / rest client) about ma1sd

[jacotec]

@ma1uta Seems that needs a final fixing in ma1sd:
matrix-org/synapse#6772 (comment)

[ma1uta]

I have pushed to the master the temporary fix of the rest_password_provider. Also I am going to create PR to add missing methods to the public API.

[MurzNN]

Same problem, here is Synapse issue about this problem: matrix-org/synapse#6772

[anoadragon453]

@ma1uta Were these ever done?

[ma1uta]

Maybe. I don't well with python and too busy. PR welcome.

[anoadragon453]

@ma1uta I can take a look. What do you need exactly? Where is the python code?

[ma1uta]

@anoadragon453 thanks for help. The problem code: https://github.com/ma1uta/matrix-synapse-rest-password-provider/blob/master/rest_auth_provider.py#L86
One of the cases of the matrix-synapse-rest-password-provider:

1. a new user is trying to log in
2. synapse delegates passwords check to the matrix-synapse-rest-password-provider
3. rest-provider sends a request to the ma1sd
4. ma1sd finds login/password in an one of the storages
5. ma1sd returns profile of a new user
6. rest-provider registers a new user if necessary and update the profile

What wrong with that? I don't think that register and update profile a new user on the password checks is a good idea, but synapse doesn't have another module or user/profile/... providers to implement this feature.

Currently rest-provider uses a protected profile handler. I am not so good with the synapse code and cannot find the best alternative.

[anoadragon453]

So, it looks like the two features of matrix-synapse-rest-password-provider that use the datastore here are:

• Setting the displayname of the user on login/register
• Updating/replacing the current set of 3PIDs for the user upon login/registration

The only relevant things the current module API provides is:

• Setting displayname on register (not login)
• Setting initial emails on register (not login) (not phone numbers)

So at this time, the features you would need from the ModuleApi to stop reaching into the datastore would be:

• Ability to set user displayname
• Ability to set the user's threepids (and an option to erase existing threepids)

I've added an issue for adding this functionality here: matrix-org/synapse#7734 (you could continue to use the database-reaching functionality for older versions of Synapse).

While browsing through the module's code... I realized it could really use some cleaning up. I may submit a PR for that at some point 🙂

Do you know what the minimum Synapse version you'd like to support is? And do you still want https://github.com/ma1uta/matrix-synapse-rest-password-provider to support Python 2?

[ma1uta]

Thanks a lot for help!

Do you know what the minimum Synapse version you'd like to support is? And do you still want https://github.com/ma1uta/matrix-synapse-rest-password-provider to support Python 2?

I think to support only Synapse versions which officially supported. Since Synapse support only Python 3.5-3.8 https://github.com/matrix-org/synapse/blob/develop/INSTALL.md#installing-from-source we can drop Python 2 support.