This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Add some tests for `password_auth_providers` #8819

Merged

richvdh merged 8 commits into develop from rav/password_auth_tests

Dec 1, 2020

Member

richvdh commented Nov 25, 2020

These things seemed to be completely untested, so I added a load of tests for
them. Suggestions as to better places for these tests also welcome.

richvdh added 4 commits

November 25, 2020 13:50


          Add some tests for password_auth_providers

2561abd


          UI Auth tests for password providers

3a03ab5


          changelog

232e5c6


          fix lint

77ea84b

richvdh changed the title ~~Add some test for password_auth_providers~~ Add some tests for password_auth_providers


          a couple of comments

3b4f006

anoadragon453 suggested changes

View reviewed changes

Member

anoadragon453 left a comment •

edited

Loading

Yay tests! Also "forfend" is a word I hadn't heard before :)

tests/handlers/test_password_providers.py

		return mock_password_provider.check_auth(*args)


		def providers_config(*providers: Type[Any]) -> dict:

Member

anoadragon453 Nov 26, 2020

Out of curiosity, Type[Any] here is better than Any as it requires that we pass a class, rather than any old variable. Correct?

Member Author

richvdh Nov 27, 2020

correct.

tests/handlers/test_password_providers.py Outdated Show resolved Hide resolved

tests/handlers/test_password_providers.py

+                      super().setUp()
+                  @override_config(providers_config(PasswordOnlyAuthProvider))
+                  def test_password_only_auth_provider_login(self):

Member

anoadragon453 Nov 26, 2020

Perhaps we should also test that we can login with a username containing characters that aren't allowed in a typical MXID? Plus making sure usernames aren't lowercased before they get to the password provider?

Member Author

richvdh Nov 27, 2020

yeah... I'm not quite sure what the expected behaviour should be in these cases, but I've added a couple of tests to try to assert that things aren't changing unexpectedly.

tests/handlers/test_password_providers.py Outdated Show resolved Hide resolved

tests/handlers/test_password_providers.py Show resolved Hide resolved

tests/handlers/test_password_providers.py Show resolved Hide resolved

tests/handlers/test_password_providers.py Show resolved Hide resolved

tests/handlers/test_password_providers.py

Comment on lines +315 to +316

		# there's a perfectly good M_MISSING_PARAM errcode, but heaven forfend we should
		# use it...

Member

anoadragon453 Nov 26, 2020

If we're seeing M_INVALID_PARAM here instead it might be because the missing parameter is not top-level, and thus auth is invalid?

Member Author

richvdh Nov 27, 2020

no, we're seeing M_UNKNOWN.

Member

anoadragon453 Dec 1, 2020

Oh boo.

richvdh and others added 3 commits

November 27, 2020 11:46


          Apply suggestions from code review

88cce6e

Co-authored-by: Andrew Morgan <[email protected]>


          more review comments

db67127


          Add some tests for weird username/pass

1f64921

richvdh requested a review from anoadragon453

November 27, 2020 12:05

richvdh mentioned this pull request

Don't offer password login when it is disabled #8835

Merged

anoadragon453 approved these changes

View reviewed changes

Member

anoadragon453 left a comment

The new tests look good! Indeed, we don't specify any constraints on usernames or passwords in password_auth_providers.py, so codifying the current behaviour is the best route for now.

At some point in the future we should test the remaining password auth provider methods: check_3pid_auth and on_logged_out.

No need to solve the M_UNKNOWN vs M_INVALID_PARAM in this PR.

richvdh merged commit ddc4343 into develop

richvdh deleted the rav/password_auth_tests branch

December 1, 2020 11:10

netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request


          Update chat/matrix-synapse to 1.24.0

72f5fd3

Synapse 1.24.0 (2020-12-09)
===========================

Due to the two security issues highlighted below, server administrators are
encouraged to update Synapse. We are not aware of these vulnerabilities being
exploited in the wild.

Security advisory
-----------------

The following issues are fixed in v1.23.1 and v1.24.0.

- There is a denial of service attack
  ([CVE-2020-26257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257))
  against the federation APIs in which future events will not be correctly sent
  to other servers over federation. This affects all servers that participate in
  open federation. (Fixed in [#8776](matrix-org/synapse#8776)).

- Synapse may be affected by OpenSSL
  [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971).
  Synapse administrators should ensure that they have the latest versions of
  the cryptography Python package installed.

To upgrade Synapse along with the cryptography package:

* Administrators using the [`matrix.org` Docker
  image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu
  packages from
  `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages)
  should ensure that they have version 1.24.0 or 1.23.1 installed: these images include
  the updated packages.
* Administrators who have [installed Synapse from
  source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source)
  should upgrade the cryptography package within their virtualenv by running:
  ```sh
  <path_to_virtualenv>/bin/pip install 'cryptography>=3.3'
  ```
* Administrators who have installed Synapse from distribution packages should
  consult the information from their distributions.

Internal Changes
----------------

- Add a maximum version for pysaml2 on Python 3.5. ([\#8898](matrix-org/synapse#8898))


Synapse 1.24.0rc2 (2020-12-04)
==============================

Bugfixes
--------

- Fix a regression in v1.24.0rc1 which failed to allow SAML mapping providers which were unable to redirect users to an additional page. ([\#8878](matrix-org/synapse#8878))


Internal Changes
----------------

- Add support for the `prometheus_client` newer than 0.9.0. Contributed by Jordan Bancino. ([\#8875](matrix-org/synapse#8875))


Synapse 1.24.0rc1 (2020-12-02)
==============================

Features
--------

- Add admin API for logging in as a user. ([\#8617](matrix-org/synapse#8617))
- Allow specification of the SAML IdP if the metadata returns multiple IdPs. ([\#8630](matrix-org/synapse#8630))
- Add support for re-trying generation of a localpart for OpenID Connect mapping providers. ([\#8801](matrix-org/synapse#8801), [\#8855](matrix-org/synapse#8855))
- Allow the `Date` header through CORS. Contributed by Nicolas Chamo. ([\#8804](matrix-org/synapse#8804))
- Add a config option, `push.group_by_unread_count`, which controls whether unread message counts in push notifications are defined as "the number of rooms with unread messages" or "total unread messages". ([\#8820](matrix-org/synapse#8820))
- Add `force_purge` option to delete-room admin api. ([\#8843](matrix-org/synapse#8843))


Bugfixes
--------

- Fix a bug where appservices may be sent an excessive amount of read receipts and presence. Broke in v1.22.0. ([\#8744](matrix-org/synapse#8744))
- Fix a bug in some federation APIs which could lead to unexpected behaviour if different parameters were set in the URI and the request body. ([\#8776](matrix-org/synapse#8776))
- Fix a bug where synctl could spawn duplicate copies of a worker. Contributed by Waylon Cude. ([\#8798](matrix-org/synapse#8798))
- Allow per-room profiles to be used for the server notice user. ([\#8799](matrix-org/synapse#8799))
- Fix a bug where logging could break after a call to SIGHUP. ([\#8817](matrix-org/synapse#8817))
- Fix `register_new_matrix_user` failing with "Bad Request" when trailing slash is included in server URL. Contributed by @angdraug. ([\#8823](matrix-org/synapse#8823))
- Fix a minor long-standing bug in login, where we would offer the `password` login type if a custom auth provider supported it, even if password login was disabled. ([\#8835](matrix-org/synapse#8835))
- Fix a long-standing bug which caused Synapse to require unspecified parameters during user-interactive authentication. ([\#8848](matrix-org/synapse#8848))
- Fix a bug introduced in v1.20.0 where the user-agent and IP address reported during user registration for CAS, OpenID Connect, and SAML were of the wrong form. ([\#8784](matrix-org/synapse#8784))


Improved Documentation
----------------------

- Clarify the usecase for a msisdn delegate. Contributed by Adrian Wannenmacher. ([\#8734](matrix-org/synapse#8734))
- Remove extraneous comma from JSON example in User Admin API docs. ([\#8771](matrix-org/synapse#8771))
- Update `turn-howto.md` with troubleshooting notes. ([\#8779](matrix-org/synapse#8779))
- Fix the example on how to set the `Content-Type` header in nginx for the Client Well-Known URI. ([\#8793](matrix-org/synapse#8793))
- Improve the documentation for the admin API to list all media in a room with respect to encrypted events. ([\#8795](matrix-org/synapse#8795))
- Update the formatting of the `push` section of the homeserver config file to better align with the [code style guidelines](https://github.com/matrix-org/synapse/blob/develop/docs/code_style.md#configuration-file-format). ([\#8818](matrix-org/synapse#8818))
- Improve documentation how to configure prometheus for workers. ([\#8822](matrix-org/synapse#8822))
- Update example prometheus console. ([\#8824](matrix-org/synapse#8824))


Deprecations and Removals
-------------------------

- Remove old `/_matrix/client/*/admin` endpoints which were deprecated since Synapse 1.20.0. ([\#8785](matrix-org/synapse#8785))
- Disable pretty printing JSON responses for curl. Users who want pretty-printed output should use [jq](https://stedolan.github.io/jq/) in combination with curl. Contributed by @tulir. ([\#8833](matrix-org/synapse#8833))


Internal Changes
----------------

- Simplify the way the `HomeServer` object caches its internal attributes. ([\#8565](matrix-org/synapse#8565), [\#8851](matrix-org/synapse#8851))
- Add an example and documentation for clock skew to the SAML2 sample configuration to allow for clock/time difference between the homserver and IdP. Contributed by @localguru. ([\#8731](matrix-org/synapse#8731))
- Generalise `RoomMemberHandler._locally_reject_invite` to apply to more flows than just invite. ([\#8751](matrix-org/synapse#8751))
- Generalise `RoomStore.maybe_store_room_on_invite` to handle other, non-invite membership events. ([\#8754](matrix-org/synapse#8754))
- Refactor test utilities for injecting HTTP requests. ([\#8757](matrix-org/synapse#8757), [\#8758](matrix-org/synapse#8758), [\#8759](matrix-org/synapse#8759), [\#8760](matrix-org/synapse#8760), [\#8761](matrix-org/synapse#8761), [\#8777](matrix-org/synapse#8777))
- Consolidate logic between the OpenID Connect and SAML code. ([\#8765](matrix-org/synapse#8765))
- Use `TYPE_CHECKING` instead of magic `MYPY` variable. ([\#8770](matrix-org/synapse#8770))
- Add a commandline script to sign arbitrary json objects. ([\#8772](matrix-org/synapse#8772))
- Minor log line improvements for the SSO mapping code used to generate Matrix IDs from SSO IDs. ([\#8773](matrix-org/synapse#8773))
- Add additional error checking for OpenID Connect and SAML mapping providers. ([\#8774](matrix-org/synapse#8774), [\#8800](matrix-org/synapse#8800))
- Add type hints to HTTP abstractions. ([\#8806](matrix-org/synapse#8806), [\#8812](matrix-org/synapse#8812))
- Remove unnecessary function arguments and add typing to several membership replication classes. ([\#8809](matrix-org/synapse#8809))
- Optimise the lookup for an invite from another homeserver when trying to reject it. ([\#8815](matrix-org/synapse#8815))
- Add tests for `password_auth_provider`s. ([\#8819](matrix-org/synapse#8819))
- Drop redundant database index on `event_json`. ([\#8845](matrix-org/synapse#8845))
- Simplify `uk.half-shot.msc2778.login.application_service` login handler. ([\#8847](matrix-org/synapse#8847))
- Refactor `password_auth_provider` support code. ([\#8849](matrix-org/synapse#8849))
- Add missing `ordering` to background database updates. ([\#8850](matrix-org/synapse#8850))
- Allow for specifying a room version when creating a room in unit tests via `RestHelper.create_room_as`. ([\#8854](matrix-org/synapse#8854))

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet