element-hq / element-hq/synapse

Potential bug when using SAML and workers might result in "Unsolicited response" errors

Open
#7,530 0 comments 0 reactions 0 assignees View on GitHub
A-SSO A-Workers S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#7530](https://github.com/matrix-org/synapse/issues/7530).

---

I'm unsure if this will be a problem in reality or is just a potential for issues, but figured I should document it. This is somewhat similar to #6705, but is:
* Specific to SAML.
* Not specific to UI authentication (e.g. it will apply to login/registration as well).

The SAML handler stores state about ongoing SAML requests in memory (see uses of [`_outstanding_requests_dict`](https://github.com/matrix-org/synapse/blob/3c8a57f080a66a3d4d146adf7020c18b397bcf6c/synapse/handlers/saml_handler.py#L76-L77) in the `synapse.handlers.saml_handler.SamlHandler` class).

In worker mode, it is possible for a request to get created and the callback to occur on different workers causing an error about an unrequested SAML response.

I believe the workaround is to ensure that the following endpoints all go to the same worker:
* `/_matrix/client/r0/login/sso/redirect`
* `/_matrix/saml2/authn_response`
* `/_matrix/client/r0/auth/(org.matrix.login.sso|m.login.sso)/fallback/web`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.