element-hq / element-hq/matrix-authentication-service

base64 secrets don't seem to work as the client secret between MAS and homeserver

Open
#2,780 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
280
Forks
111
Avg merge
3d 1h
Merged PRs (30d)
25

Description

*This issue was originally created by [**@pontaoski**](https://github.com/pontaoski) at .*

```
May 16 16:54:49 ilo-kulupu mas-cli[4227]: 2024-05-16T16:54:49.222047Z ERROR http.server.request{otel.kind="server" otel.name="POST /oauth2/introspect" network.protocol.name="http" network.protocol.version="1.1" http.request.method="POST" url.path="/oauth2/introspect" url.scheme="http" http.route="/oauth2/introspect" user_agent.original="Synapse/1.105.1"}:handlers.oauth2.introspection.post{client.id="0000000000000000000SYNAPSE"}:verify: mas_axum_utils::client_authorization: error=client secret did not match
```
```
2024-05-16 16:54:46,992 - synapse.http.client - 426 - INFO - GET-118 - Received response to POST https://mas.toki.club/oauth2/introspect: 401
2024-05-16 16:54:46,992 - synapse.api.auth.msc3861_delegated - 270 - ERROR - GET-118 - Failed to introspect token
Traceback (most recent call last):
File "/usr/lib64/python3.12/site-packages/synapse/api/auth/msc3861_delegated.py", line 268, in get_user_by_access_token
introspection_result = await self._introspect_token(token)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.12/site-packages/synapse/api/auth/msc3861_delegated.py", line 204, in _introspect_token
raise HttpResponseException(
synapse.api.errors.HttpResponseException: 401: Unauthorized
2024-05-16 16:54:46,992 - synapse.http.server - 130 - INFO - GET-118 - SynapseError: 503 - Unable to introspect the access token
```

example secrets that don't work for me: (openssl rand base64)
- `zk3kKn1QpZgZoKAllMoLXBdpySFflBPM5d4fnKAlgpfzR7c8G/1+Z2RHr7cPqU7+`
- `Cv+YUm7VLclQTrfcAFeXBb6/HKgYb3jLTmnYkwFk9q+qgDx6LwC0geMcMHY+zhCm`
- `myCBOIoCeArhQ/EtJDftyVa5q1ah7PjumSb7mwVLyoPbpBMitew2pAMfsoxPTxOp`

example secrets that do work for me: (openssl rand hex)
- `cb6b76fe4b1cbbc56e18b7486d09997847d6b56370178ea73deed3805700044d1391a36629ed0370002172620f3c2b3b`
- `e8c337ceaffd0d98a70ee61a31d987d7443174c1b12561232c817ffacfc1135fc70339d5a3c14ce96fb05fda3c4dd31e`
- `f1abc758100688ea23198d1b0d5b9713a5c467cb5cacdcab4900065a35102a5c30e492c7e436e39f769b68e972f58a7f``

i edited the MAS file as so:
```yaml
clients:
- client_id: 0000000000000000000SYNAPSE
client_auth_method: client_secret_basic
client_secret: "1234"
```
and then `mas-cli config sync`.

i edited the synapse file as so:
```yaml
experimental_features:
msc3861:
enabled: true
issuer: https://mas.toki.club/
client_id: "0000000000000000000SYNAPSE"
client_auth_method: client_secret_basic
client_secret: "1234"
admin_token: "..."
account_management_url: "https://ldap.toki.club"
```
and then restarted synapse.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.