Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Synapse does not report a device_id for appservice masqueraded requests to /whoami when using MSC3861 #16945

Closed
Half-Shot opened this issue Feb 20, 2024 · 1 comment

Comments

@Half-Shot
Copy link
Member

This seems to be a bit of missing functionality in the implementation of delegated auth.

On vanilla Synapse, requesting a GET /_matrix/client/v3/account/whoami will return the masqueraded device back in the response.

$ curl -X GET -H "Authorization: Bearer my_as_token" 'http://example.com/_matrix/client/v3/account/whoami?org.matrix.msc3202.device_id=my_device&user_id=@my_user:example.com`
HTTP/1.1 200 OK

{
    "user_id": "@my_user:example.com",
    "is_guest": false,
    "device_id": "my_device"
}

whereas the same request on a MAS-enabled synapse will give no device ID at all:

$ curl https://mas-enabled-example.com/_matrix/client/v3/account/whoami\?access_token=my_as_token&org.matrix.msc3202.device_id=my_device\&user_id\=@my_user:example.com
HTTP/2 200

{
    "user_id": "@auditbot:matrix.staging.ems.element.dev",
    "is_guest": false
}

While this might seem like a fairly easy thing to workaround, the library we use to make these requests would need to specialcase around this a bit more. Ideally, the same request would give the same response.

@Half-Shot
Copy link
Member Author

In the end it was a misconfiguration, I just needed unstable_features.msc3202_device_masquerading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant