element-hq / element-hq/synapse
Appservice login works for sender_localpart even if the user isn't registered, but returned access token doesn't work
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#16269](https://github.com/matrix-org/synapse/issues/16269).
---
### Description
The [appservice login](https://spec.matrix.org/v1.8/client-server-api/#appservice-login) mechanism seems to allow logging in as the `sender_localpart` user, even if the user doesn't exist. The result is extremely confusing, as the login will return a success with an access token, but trying to use the access token will just throw `M_UNKNOWN_TOKEN`. Doing the same with a namespace user rather than the sender_localpart will throw "Application service has not registered this user" in the login call.
### Steps to reproduce
1. Register an appservice
2. Use appservice login to log in as the `sender_localpart` user and receive a token back
3. Try to use the returned token and get `M_UNKNOWN_TOKEN`
4. Be confused
### Synapse Version
1.92.0rc1
### Database
PostgreSQL
### Workers
Single process
### Relevant log output
```shell
2023-09-06 22:33:47,767 - synapse.rest.client.login - 277 - INFO - POST-70 - Got appservice login request with identifier: {'type': 'm.id.user', 'user': 'sabot'}
2023-09-06 22:33:47,784 - synapse.handlers.auth - 997 - INFO - POST-70 - Logging in user @sabot:localhost on device SVMYUSNZRL
2023-09-06 22:33:47,790 - synapse.access.http.8008 - 465 - INFO - POST-70 - 127.0.0.1 - 8008 - {@sabot:localhost} Processed request: 0.023sec/0.000sec (0.002sec, 0.000sec) (0.001sec/0.018sec/4) 140B 200 "POST /_matrix/client/v3/login HTTP/1.1" "curl/7.88.1" [0 dbevts]
2023-09-06 22:33:55,561 - synapse.api.auth.internal - 288 - WARNING - GET-72 - Invalid access token in auth: cannot determine data format of binary-encoded macaroon.
2023-09-06 22:33:55,562 - synapse.http.server - 124 - INFO - GET-72 - SynapseError: 401 - Invalid access token passed.
2023-09-06 22:33:55,562 - synapse.access.http.8008 - 465 - INFO - GET-72 - 127.0.0.1 - 8008 - {None} Processed request: 0.002sec/0.000sec (0.000sec, 0.000sec) (0.000sec/0.001sec/1) 88B 401 "GET /_matrix/client/v3/account/whoami HTTP/1.1" "curl/7.88.1" [0 dbevts]
```
Contributor guide
Assessment
This issue has not been assessed yet.