element-hq / element-hq/synapse

Admin API cannot create deactivated users

Open
#12,057 1 comment 1 reaction 0 assignees View on GitHub
A-Account-Deactivation A-Admin-API A-Docs T-Task
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#12057](https://github.com/matrix-org/synapse/issues/12057).

---

### Description

When using [Admin API to create new users](https://matrix-org.github.io/synapse/develop/admin_api/user_admin_api.html#create-or-modify-account), the `deactivated` body attribute is ignored. According to the docs, "**If unspecified**, deactivation state will be left unchanged on existing accounts **and set to false for new accounts**". It seems like it's set to false for new accounts regardless of what the attribute is set to.

### Steps to reproduce

- Create a new user with the admin API:

```
PUT /_synapse/admin/v2/users/@jsmith:server {
displayname: 'Jacob Smith',
password: 'hello.code.reviewer',
deactivated: true
}
```

- The response indicates that the user is not deactivated, contrary to what was requested:

```
{
name: '@jsmith:server',
is_guest: 0,
admin: 0,
consent_version: null,
consent_server_notice_sent: null,
appservice_id: null,
creation_ts: 1645530918,
user_type: null,
deactivated: 0,
shadow_banned: 0,
displayname: 'Jacob Smith',
avatar_url: null,
threepids: [],
external_ids: []
}

```

- The user can login, even though they shouldn't be able to.

It'd be fair if that option was unsupported during user creation, but the docs don't indicate that it is. It should either work as expected, or be documented (and preferably return a 400 when used) not to.

### Version information

Synapse 1.51.0 running under docker with [homerunner](https://github.com/matrix-org/complement/tree/main/cmd/homerunner).

Contributor guide

Open the contributing guide

Research direction

Start with the Admin API endpoint documented under “Create or modify account” and reproduce the PUT request with deactivated: true. Confirm that the response and subsequent login still show an active user; done means the requested deactivation is applied on creation, or the API rejects the unsupported attribute with a 400 and the documentation explains it.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.