Re-Activating account when local passwords are disabled

[dklimpel]

Fixes: #8393

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
• Pull request includes a sign off
• Code style is correct (run the linters)

Signed-off-by: Dirk Klimpel dirk@klimpel.org

[erikjohnston]

Thanks!

[clokep]

I'm not sure this will catch all the instances of this, would it make more sense to check if there's a mapping from SSO auth provider to this user?

In particular, I think many admins run with passwords completely disabled, and not specifically the localdb passwords disabled.

[dklimpel]

IMO this not the best solution. But this is like set_password is implemented.

synapse/synapse/handlers/set_password.py

Lines 37 to 45 in 1baab20

	async def set_password(
	self,
	user_id: str,
	password_hash: str,
	logout_devices: bool,
	requester: Optional[Requester] = None,
	) -> None:
	if not self.hs.config.password_localdb_enabled:
	raise SynapseError(403, "Password change disabled", errcode=Codes.FORBIDDEN)

To improve it, we have also change the check in set_password.

[clokep]

After further conversation in #synapse-dev:matrix.org, I suspect that this should check self.hs.config.password_enabled and self.hs.config.password_localdb_enabled since that is the only time it makes sense to set a password.