element-hq / element-hq/synapse
Access tokens are not invalidated when credentials are invalidated via an external auth provider
Open
Security
T-Enhancement
z-p2
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 46
Description
This issue has been migrated from [#4158](https://github.com/matrix-org/synapse/issues/4158).
---
If synapse is configured to interface with an external auth provider (such as LDAP), there is no mechanism for that external system to feed back to synapse if a user's credentials have been locked/revoked/etc. Synapse's `access_tokens` stay valid forever.
A related question: if a user's password is changed in the external system, should we require all matrix clients to log in again, as we would with a local password change? If so, how should this be implemented?
Contributor guide
Assessment
This issue has not been assessed yet.