element-hq / element-hq/synapse
Potential bug when using SAML and workers might result in "Unsolicited response" errors
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#7530](https://github.com/matrix-org/synapse/issues/7530).
---
I'm unsure if this will be a problem in reality or is just a potential for issues, but figured I should document it. This is somewhat similar to #6705, but is:
* Specific to SAML.
* Not specific to UI authentication (e.g. it will apply to login/registration as well).
The SAML handler stores state about ongoing SAML requests in memory (see uses of [`_outstanding_requests_dict`](https://github.com/matrix-org/synapse/blob/3c8a57f080a66a3d4d146adf7020c18b397bcf6c/synapse/handlers/saml_handler.py#L76-L77) in the `synapse.handlers.saml_handler.SamlHandler` class).
In worker mode, it is possible for a request to get created and the callback to occur on different workers causing an error about an unrequested SAML response.
I believe the workaround is to ensure that the following endpoints all go to the same worker:
* `/_matrix/client/r0/login/sso/redirect`
* `/_matrix/saml2/authn_response`
* `/_matrix/client/r0/auth/(org.matrix.login.sso|m.login.sso)/fallback/web`
Contributor guide
Assessment
This issue has not been assessed yet.