mirror/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2025-10-17 01:39:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Stabilize Matrix Authentication Service integration for Synapse

Browse Source 
Related to https://github.com/element-hq/synapse/pull/18759

Currently problematic (leading to failures to start for Synapse) because of:
https://github.com/element-hq/synapse/pull/18759#issuecomment-3172744530
This commit is contained in:
Slavi Pantaleev
2025-08-14 07:59:32 +03:00
parent 865345a08f
commit a396e32151
6 changed files with 67 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/custom/matrix-synapse/tasks/main.yml
View File

@@ -62,7 +62,7 @@
- tags:
- register-user
block:
- when: matrix_synapse_enabled and not matrix_synapse_experimental_features_msc3861_enabled
- when: matrix_synapse_enabled and not matrix_synapse_matrix_authentication_service_enabled
ansible.builtin.include_tasks: "{{ role_path }}/tasks/register_user.yml"
- tags:

58
roles/custom/matrix-synapse/tasks/validate_config.yml
View File

@@ -39,23 +39,11 @@
- {'name': 'matrix_synapse_metrics_proxying_hostname', when: "{{ matrix_synapse_metrics_proxying_enabled }}"}
- {'name': 'matrix_synapse_metrics_proxying_path_prefix', when: "{{ matrix_synapse_metrics_proxying_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_issuer', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_client_id', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_client_auth_method', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_client_secret', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_admin_token', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_experimental_features_msc3861_account_management_url', when: "{{ matrix_synapse_experimental_features_msc3861_enabled }}"}
- {'name': 'matrix_synapse_matrix_authentication_service_endpoint', when: "{{ matrix_synapse_matrix_authentication_service_enabled }}"}
- {'name': 'matrix_synapse_matrix_authentication_service_secret', when: "{{ matrix_synapse_matrix_authentication_service_enabled }}"}
- {'name': 'matrix_synapse_container_labels_traefik_compression_middleware_name', when: "{{ matrix_synapse_container_labels_traefik_compression_middleware_enabled }}"}
# If only MSC 4108 is enabled, Synapse fails with: "MSC4108 requires MSC3861 to be enabled"
- name: Fail if Synapse experimental feature QR code login (MSC4108) is enabled while Next-Gen Auth (MSC3861) is not
ansible.builtin.fail:
msg: >-
QR code login (MSC4108) requires Next-Gen Auth (MSC3861) to be enabled or Synapse will fail to start.
Enable `matrix_synapse_experimental_features_msc3861_enabled` when using `matrix_synapse_experimental_features_msc4108_enabled`.
when: "matrix_synapse_experimental_features_msc4108_enabled and not matrix_synapse_experimental_features_msc3861_enabled"
- name: Fail if asking for more than 1 instance of single-instance workers
ansible.builtin.fail:
msg: >-
@@ -121,6 +109,14 @@
- {'old': 'matrix_s3_goofys_docker_image_name_prefix', 'new': 'matrix_s3_goofys_docker_image_registry_prefix'}
- {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_name_prefix', 'new': 'matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix'}
- {'old': 'matrix_synapse_experimental_features_msc3861_enabled', 'new': 'matrix_synapse_matrix_authentication_service_enabled'}
- {'old': 'matrix_synapse_experimental_features_msc3861_issuer', 'new': '<superseded by matrix_synapse_matrix_authentication_service_endpoint>'}
- {'old': 'matrix_synapse_experimental_features_msc3861_client_id', 'new': '<removed>'}
- {'old': 'matrix_synapse_experimental_features_msc3861_client_auth_method', 'new': '<removed>'}
- {'old': 'matrix_synapse_experimental_features_msc3861_client_secret', 'new': '<removed>'}
- {'old': 'matrix_synapse_experimental_features_msc3861_admin_token', 'new': '<removed>'}
- {'old': 'matrix_synapse_experimental_features_msc3861_account_management_url', 'new': '<removed>'}
- name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml
ansible.builtin.fail:
msg: >-
@@ -163,8 +159,8 @@
- name: Fail if known Synapse password provider modules are enabled when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse is delegating authentication to Matrix Authentication Service, it does not make sense to enable password provider modules, because it is not Synapse that is handling authentication. Please disable {{ item }} before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."
when: matrix_synapse_experimental_features_msc3861_enabled and vars[item] | bool
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it does not make sense to enable password provider modules, because it is not Synapse that is handling authentication. Please disable {{ item }} before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and vars[item] | bool
with_items:
- matrix_synapse_ext_password_provider_rest_auth_enabled
- matrix_synapse_ext_password_provider_shared_secret_auth_enabled
@@ -172,10 +168,30 @@
- name: Fail if password config is enabled for Synapse when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse is delegating authentication to Matrix Authentication Service, it doesn't make sense to enable the password config (`matrix_synapse_password_config_enabled: true`), because it is not Synapse that is handling authentication. Please remove your `matrix_synapse_password_config_enabled: true` setting before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."
when: matrix_synapse_experimental_features_msc3861_enabled and matrix_synapse_password_config_enabled
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable the password config (`matrix_synapse_password_config_enabled: true`), because it is not Synapse that is handling authentication. Please remove your `matrix_synapse_password_config_enabled: true` setting before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_password_config_enabled
- name: Fail if QR code login (MSC4108) is enabled while Next-Gen Auth (MSC3861) is not
- name: Fail if registration is enabled for Synapse when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse QR code login is enabled (MSC4108 via `matrix_synapse_experimental_features_msc4108_enabled`), Next-Gen auth (MSC3861 via `matrix_synapse_experimental_features_msc3861_enabled`) must also be enabled."
when: matrix_synapse_experimental_features_msc4108_enabled and not matrix_synapse_experimental_features_msc3861_enabled
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable registration (`matrix_synapse_enable_registration: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_enable_registration
- name: Fail if registration CAPTCHA is enabled for Synapse when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable registration CAPTCHA (`matrix_synapse_enable_registration_captcha: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_enable_registration_captcha
- name: Fail if OpenID Connect is enabled for Synapse when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable OpenID Connect (`matrix_synapse_oidc_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_oidc_enabled
- name: Fail if CAS config is enabled for Synapse when auth is delegated to Matrix Authentication Service
ansible.builtin.fail:
msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable CAS config (`matrix_synapse_cas_config_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_cas_config_enabled
- name: Fail if QR code login (MSC4108) is enabled while Matrix Authentication Service is not
ansible.builtin.fail:
msg: "When Synapse QR code login is enabled (MSC4108 via `matrix_synapse_experimental_features_msc4108_enabled`), Matrix Authentication Service integration (`matrix_synapse_matrix_authentication_service_enabled`) must also be enabled."
when: matrix_synapse_experimental_features_msc4108_enabled and not matrix_synapse_matrix_authentication_service_enabled