Support SAML in the user interactive authentication workflow.

[clokep]

This aims to accomplish a portion of #5667:

• Update validate_user_via_ui_auth to return m.login.sso for homeservers which use sso login
• Implement a handler for /_matrix/client/r0/auth/m.login.sso/fallback/web which shows a confirmation page, and redirects to the SAML server.
• Update the SAML return page handlers to behave differently for a UI auth flow, and:
  • Update the UI Auth session
  • Return the fallback completion page

TODO

• Remove any debug statements.
• Handle any other TODO comments.
• Add validation of session + user information.
• Think about redirect URLs.
• Use a Jinja template for the confirmation page.
• Fix unit tests.
• SyTests? See Add tests for SSO + user interactive authentication. sytest#845

This is currently based on #7115.

Testing

SAML

I was testing SAML by first generally following the directions at docs/dev/saml.md to create a user. Note that I also had to set the following in the config:

public_baseurl: http://localhost:8080/

Then to test the UI Auth workflow:

1. Add a debug line so you can see what UI-Auth sessions are getting created in Synapse:

diff --git a/synapse/handlers/auth.py b/synapse/handlers/auth.py
--- a/synapse/handlers/auth.py
+++ b/synapse/handlers/auth.py
@@ -494,6 +494,7 @@ class AuthHandler(BaseHandler):
             while session_id is None or session_id in self.sessions:
                 session_id = stringutils.random_string(24)
             self.sessions[session_id] = {"id": session_id}
+            print("Created new session: %s" % session_id)
 
         return self.sessions[session_id]
 

2. Restart Synapse to pick up the change.
3. Go to the "User Details" page on https://capriza.github.io/samling/samling.html and click "Logout" (weirdly this doesn't show anything, refresh the page to ensure you're logged out).
4. Perform an operation that dumps you into the UI Auth workflow (e.g. deleting a device).
5. Check out the logs to get the session ID.
6. Browse to http://localhost:8080/_matrix/client/r0/auth/org.matrix.login.sso/fallback/web?session=
7. Read this, go through the SSO workflow.
8. You should end up at a success page telling you to close the window.

Unfortunately at this point you're stuck since the client doesn't know the auth has completed.

[clokep]

Some useful notes:

• SAML 2.0 flow diagram
• CAS flow diagram

[clokep]

Note that I don't think we have to worry about rate limiting in this code since the validation code handles this (in validate_user_via_ui_auth), specifically around:

synapse/synapse/handlers/auth.py

Lines 162 to 185 in c2db659

	# Check if we should be ratelimited due to too many previous failed attempts
	self._failed_uia_attempts_ratelimiter.ratelimit(
	user_id,
	time_now_s=self._clock.time(),
	rate_hz=self.hs.config.rc_login_failed_attempts.per_second,
	burst_count=self.hs.config.rc_login_failed_attempts.burst_count,
	update=False,
	)
	# build a list of supported flows
	flows = [[login_type] for login_type in self._supported_login_types]
	try:
	result, params, _ = yield self.check_auth(flows, request_body, clientip)
	except LoginError:
	# Update the ratelimite to say we failed (`can_do_action` doesn't raise).
	self._failed_uia_attempts_ratelimiter.can_do_action(
	user_id,
	time_now_s=self._clock.time(),
	rate_hz=self.hs.config.rc_login_failed_attempts.per_second,
	burst_count=self.hs.config.rc_login_failed_attempts.burst_count,
	update=True,
	)
	raise

[clokep]

I think this is ready for some feedback. Note that the CAS code is untested, still trying to figure out a way to do that.

[richvdh]

generally looks like the right sort of thing to me!

[richvdh]

assuming that you know this text needs changing!

[clokep]

Yes, but thank you for marking it! 👍

[clokep]

Any thoughts on how customizable we want this to be? Do we want the "reason" to be templated or static?

[richvdh]

I don't think I understand the question. The "reason" is defined by the operation the client is requesting, so it needs to be substituted somehow?

It might be worth seeking some feedback in the "Write Club" room (#write-club-internal:matrix.org) for suggestions on what this page ought to look like.

[clokep]

I completely rewrote the history of this branch to make it clearer (and removed the CAS support for this feature here). I'll do the CAS support in a separate branch since it ideally has some refactoring to go with it.

[clokep]

@richvdh Setting review on this again to get your feedback in the comments. Not really ready for a full review again.

[clokep]

I was able to test this end-to-end with matrix-org/matrix-react-sdk#4292 and it worked well.

[clokep]

Looks like this needs a rebase actually.

[richvdh]

still need to fix up the template text.

lgtm otherwise.

[clokep]

Requesting review on this for the implementation of the human readable descriptions.

[richvdh]

lgtm otherwise