element-hq / element-hq/synapse

Appservice login works for sender_localpart even if the user isn't registered, but returned access token doesn't work

Open
#16,269 0 comments 0 reactions 0 assignees View on GitHub
O-Uncommon S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#16269](https://github.com/matrix-org/synapse/issues/16269).

---

### Description

The [appservice login](https://spec.matrix.org/v1.8/client-server-api/#appservice-login) mechanism seems to allow logging in as the `sender_localpart` user, even if the user doesn't exist. The result is extremely confusing, as the login will return a success with an access token, but trying to use the access token will just throw `M_UNKNOWN_TOKEN`. Doing the same with a namespace user rather than the sender_localpart will throw "Application service has not registered this user" in the login call.

### Steps to reproduce

1. Register an appservice
2. Use appservice login to log in as the `sender_localpart` user and receive a token back
3. Try to use the returned token and get `M_UNKNOWN_TOKEN`
4. Be confused

### Synapse Version

1.92.0rc1

### Database

PostgreSQL

### Workers

Single process

### Relevant log output

```shell
2023-09-06 22:33:47,767 - synapse.rest.client.login - 277 - INFO - POST-70 - Got appservice login request with identifier: {'type': 'm.id.user', 'user': 'sabot'}
2023-09-06 22:33:47,784 - synapse.handlers.auth - 997 - INFO - POST-70 - Logging in user @sabot:localhost on device SVMYUSNZRL
2023-09-06 22:33:47,790 - synapse.access.http.8008 - 465 - INFO - POST-70 - 127.0.0.1 - 8008 - {@sabot:localhost} Processed request: 0.023sec/0.000sec (0.002sec, 0.000sec) (0.001sec/0.018sec/4) 140B 200 "POST /_matrix/client/v3/login HTTP/1.1" "curl/7.88.1" [0 dbevts]
2023-09-06 22:33:55,561 - synapse.api.auth.internal - 288 - WARNING - GET-72 - Invalid access token in auth: cannot determine data format of binary-encoded macaroon.
2023-09-06 22:33:55,562 - synapse.http.server - 124 - INFO - GET-72 - SynapseError: 401 - Invalid access token passed.
2023-09-06 22:33:55,562 - synapse.access.http.8008 - 465 - INFO - GET-72 - 127.0.0.1 - 8008 - {None} Processed request: 0.002sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.001sec/1) 88B 401 "GET /_matrix/client/v3/account/whoami HTTP/1.1" "curl/7.88.1" [0 dbevts]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.