Allow multiple values for OIDC attribute requirements #12488

chugunov · 2022-04-17T22:56:37Z

I need to filter SSO logins by multiple domains (Google OpenID uses hd claim in response)
I've tried to extend the ability of filtering SSO attribute values for that use case, as described at #12238 (comment).

Signed-off-by: Andrey Chugunov andrey@chugunov.me

Pull Request Checklist

Pull request is based on the develop branch
Pull request includes a changelog file. The entry should:
- Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
- Use markdown where necessary, mostly for code blocks.
- End with either a period (.) or an exclamation mark (!).
- Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
Pull request includes a sign off
Code style is correct
(run the linters)

Signed-off-by: Andrey Chugunov <andrey@chugunov.me>

richvdh

Thanks very much for contributing!

I think this is a good start, but also there is quite a lot that needs cleaning up - see the comments below.

Regarding the documentation, let us know if you need a hand with the English, but please could you have a go yourself first?

richvdh · 2022-04-20T13:11:55Z

synapse/config/oidc.py

+        #   `attribute_requirements` as shown below. All of the listed in `value` attributes and
+        #   any of the listed in `values` attributes must match for the login to be permitted.


This new sentence isn't very clear - please could you expand on it somewhat?

In general this paragraph is very unclear to start with, so anything you can do to improve it would be much appreciated.

richvdh · 2022-04-20T13:13:11Z

synapse/config/oidc.py

+        #   If you specify both `value` and `values` entries, then only `value` entry will be checked
+        #   and `values` will be ignored.


Suggested change

# If you specify both `value` and `values` entries, then only `value` entry will be checked

# and `values` will be ignored.

# If you specify both `value` and `values` entries, then only the `value` entry will be checked

# and `values` will be ignored.

since you're using oneOf in the json schema, my understanding is that if you specify both values, the configuration will be rejected. Are you sure this sentence is correct?

richvdh · 2022-04-20T13:22:05Z

synapse/config/sso.py

@@ -36,13 +36,27 @@ class SsoAttributeRequirement:
    """Object describing a single requirement for SSO attributes."""

    attribute: str
-    # If a value is not given, than the attribute must simply exist.
-    value: Optional[str]
+    # If a value or values are not given, than the attribute must simply exist.


according to the schema, one or both of value or values is required - so I don't understand this comment?

richvdh · 2022-04-20T13:36:14Z

synapse/config/sso.py

+    value: Optional[str] = None
+    values: Optional[List[str]] = []


rather than having both of these, could we just have a values: List[str], and convert value into a single-item list?

richvdh · 2022-04-20T13:36:58Z

synapse/config/oidc.py

        #
        #   attribute_requirements:
+        #     - attribute: given_name
+        #       values: ["Andries", "Michael"]


I think a different name might make the behaviour here clearer - for example allowable_values ?

richvdh · 2022-04-20T13:45:35Z

tests/handlers/test_oidc.py

+        }
+    )
+    def test_attribute_requirements_exists(self) -> None:
+        """The required attributes must exists."""


Suggested change

"""The required attributes must exists."""

"""The required attributes must exist."""

richvdh · 2022-04-20T13:49:49Z

synapse/handlers/sso.py

+    elif req.values:
+        req_values.extend(req.values)
+    else:
+        # If the requirement is None or empty, the attribute existing is enough.


having special behaviour for an empty list feels extremely unintuitive. At the very least it should be documented, but I am not in favour.

richvdh · 2022-04-20T13:50:49Z

tests/handlers/test_oidc.py

+        }
+    )
+    def test_attribute_requirements_contains_any_values(self) -> None:
+        """Test that auth succeeds if userinfo attribute CONTAINS ANY required values"""


Suggested change

"""Test that auth succeeds if userinfo attribute CONTAINS ANY required values"""

"""Test that auth succeeds if userinfo attribute contains any of the required values"""

richvdh · 2022-04-20T13:51:05Z

tests/handlers/test_oidc.py

+    )
+    def test_attribute_requirements_mismatch_any_values(self) -> None:
+        """
+        Test that auth fails if attributes exist but don't match ANY VALUE,


Suggested change

Test that auth fails if attributes exist but don't match ANY VALUE,

Test that auth fails if attributes exist but don't match any of the required values,

richvdh · 2022-04-20T13:52:56Z

docs/sample_config.yaml

-#   match for the login to be permitted. Additional attributes can be added to
-#   userinfo by expanding the `scopes` section of the OIDC config to retrieve
-#   additional information from the OIDC provider.
+#   `attribute_requirements` as shown below. All of the listed in `value` attributes and


by the way, don't forget to update the manual at https://github.com/matrix-org/synapse/blob/develop/docs/usage/configuration/config_documentation.md - currently this has to be done manually. Maybe best to wait until we can agree wording though.

reivilibre · 2022-08-05T09:48:15Z

@chugunov As this has sat around for a bit now: are you still interested in working on this?

clokep · 2023-08-24T14:27:25Z

Closing due to lack of response.

chugunov added 3 commits April 18, 2022 02:25

Add values to SSO attribute requirement

d331807

Signed-off-by: Andrey Chugunov <andrey@chugunov.me>

Update oidc doc config section

593d9bc

Add changelog file

b8540cd

Signed-off-by: Andrey Chugunov <andrey@chugunov.me>

chugunov marked this pull request as ready for review April 17, 2022 22:58

chugunov requested a review from a team as a code owner April 17, 2022 22:58

chugunov added 4 commits April 18, 2022 03:15

Clarify oidc config comment

6600f09

Signed-off-by: Andrey Chugunov <andrey@chugunov.me>

Regenerate sample_config.yml

73aaff4

Remove trailing whitespaces

2777a22

Update sample_config.yaml

6522b00

richvdh changed the title ~~Add values to SSO attribute requirement~~ ALlow multiple values to SSO attribute requirement Apr 20, 2022

richvdh changed the title ~~ALlow multiple values to SSO attribute requirement~~ Allow multiple values for OIDC attribute requirements Apr 20, 2022

richvdh suggested changes Apr 20, 2022

View reviewed changes

reivilibre added the X-Awaiting-Changes A contributed PR which needs changes and re-review before it can be merged label Aug 5, 2022

villepeh mentioned this pull request Feb 25, 2023

Add the ability to enable/disable registrations when in the OIDC flow #14978

Merged

4 tasks

clokep closed this Aug 24, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow multiple values for OIDC attribute requirements #12488

Allow multiple values for OIDC attribute requirements #12488

chugunov commented Apr 17, 2022 •

edited

Loading

richvdh left a comment

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

richvdh Apr 20, 2022

reivilibre commented Aug 5, 2022

clokep commented Aug 24, 2023

		# `attribute_requirements` as shown below. All of the listed in `value` attributes and
		# any of the listed in `values` attributes must match for the login to be permitted.

		# If you specify both `value` and `values` entries, then only `value` entry will be checked
		# and `values` will be ignored.

	"""The required attributes must exists."""
	"""The required attributes must exist."""

	"""Test that auth succeeds if userinfo attribute CONTAINS ANY required values"""
	"""Test that auth succeeds if userinfo attribute contains any of the required values"""

	Test that auth fails if attributes exist but don't match ANY VALUE,
	Test that auth fails if attributes exist but don't match any of the required values,

Allow multiple values for OIDC attribute requirements #12488

Allow multiple values for OIDC attribute requirements #12488

Conversation

chugunov commented Apr 17, 2022 • edited Loading

Pull Request Checklist

richvdh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

reivilibre commented Aug 5, 2022

clokep commented Aug 24, 2023

chugunov commented Apr 17, 2022 •

edited

Loading