element-hq / element-hq/synapse

Allow the Admin API to create a user where the same localpart exists with uppercase letters

Open
#11,426 0 comments 0 reactions 0 assignees View on GitHub
A-Admin-API O-Uncommon S-Minor T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#11426](https://github.com/matrix-org/synapse/issues/11426).

---

# Description

Note, I have added a space after the @ in all example Matrix IDs in this issue, this is to avoid pinging the existing @ Alice user on GitHub.

## Use case

There are a handful of users who have uppercase letters in their Matrix ID from before Synapse started enforcing lowercase only. They may want to create a new Matrix account with a spec compliant all lowercase localpart.
Ie. they currently have @ Alice:example.com, but want to register @ alice:example.com

## Proposed solution

Adding a feature to the [User creation Admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account) to allow registering @ alice:example.com when @ Alice:example.com already exists.

Authentication endpoints may also need updating when implementing this as these may ignore casing currently.

## Security considerations

The localpart availability checker and both client-server and Admin user creation API endpoints ignore casing today and should continue doing this by default.

- This is to avoid impersonation by allowing client-server API registrations of the lowercase version of an existing MXID with uppercase letters. It is expected that server administrators have verified the users identity before registering this new lowercase Matrix user for them.
- Also to avoid changing the behavior of existing Synapse user management portals that rely on Synapse for localpart validation.

We should add a parameter to the API something along the lines of `&ignore_localpart_casing_duplicates=true`. This need to be an optional parameter and default to `false` if not set

Contributor guide

Open the contributing guide

Research direction

Start with the User creation Admin API documentation linked in the issue, then trace the Admin and client-server user creation endpoints and the authentication endpoints that may ignore casing. Done means an optional ignore_localpart_casing_duplicates parameter permits the Admin API case while default localpart checks and client-server registration remain case-insensitive.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.