Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Commit 78e8ec3

Browse files
richvdhrichvdh
authored
Merge pull request #6064 from matrix-org/rav/saml_config_cleanup
Make the sample saml config closer to our standards
2 parents e08ea43 + b789c7e commit 78e8ec3

File tree

3 files changed

+122
-102
lines changed

3 files changed

+122
-102
lines changed

‎changelog.d/6064.misc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Clean up the sample config for SAML authentication.

‎docs/sample_config.yaml

Lines changed: 59 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1104,65 +1104,73 @@ signing_key_path: "CONFDIR/SERVERNAME.signing.key"
11041104

11051105
# Enable SAML2 for registration and login. Uses pysaml2.
11061106
#
1107-
# `sp_config` is the configuration for the pysaml2 Service Provider.
1108-
# See pysaml2 docs for format of config.
1107+
# At least one of `sp_config` or `config_path` must be set in this section to
1108+
# enable SAML login.
11091109
#
1110-
# Default values will be used for the 'entityid' and 'service' settings,
1111-
# so it is not normally necessary to specify them unless you need to
1112-
# override them.
1110+
# (You will probably also want to set the following options to `false` to
1111+
# disable the regular login/registration flows:
1112+
# * enable_registration
1113+
# * password_config.enabled
11131114
#
11141115
# Once SAML support is enabled, a metadata file will be exposed at
11151116
# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
11161117
# use to configure your SAML IdP with. Alternatively, you can manually configure
11171118
# the IdP to use an ACS location of
11181119
# https://<server>:<port>/_matrix/saml2/authn_response.
11191120
#
1120-
#saml2_config:
1121-
# sp_config:
1122-
# # point this to the IdP's metadata. You can use either a local file or
1123-
# # (preferably) a URL.
1124-
# metadata:
1125-
# #local: ["saml2/idp.xml"]
1126-
# remote:
1127-
# - url: https://our_idp/metadata.xml
1128-
#
1129-
# # By default, the user has to go to our login page first. If you'd like to
1130-
# # allow IdP-initiated login, set 'allow_unsolicited: True' in a
1131-
# # 'service.sp' section:
1132-
# #
1133-
# #service:
1134-
# # sp:
1135-
# # allow_unsolicited: True
1136-
#
1137-
# # The examples below are just used to generate our metadata xml, and you
1138-
# # may well not need it, depending on your setup. Alternatively you
1139-
# # may need a whole lot more detail - see the pysaml2 docs!
1140-
#
1141-
# description: ["My awesome SP", "en"]
1142-
# name: ["Test SP", "en"]
1143-
#
1144-
# organization:
1145-
# name: Example com
1146-
# display_name:
1147-
# - ["Example co", "en"]
1148-
# url: "http://example.com"
1149-
#
1150-
# contact_person:
1151-
# - given_name: Bob
1152-
# sur_name: "the Sysadmin"
1153-
# email_address": ["[email protected]"]
1154-
# contact_type": technical
1155-
#
1156-
# # Instead of putting the config inline as above, you can specify a
1157-
# # separate pysaml2 configuration file:
1158-
# #
1159-
# config_path: "CONFDIR/sp_conf.py"
1160-
#
1161-
# # the lifetime of a SAML session. This defines how long a user has to
1162-
# # complete the authentication process, if allow_unsolicited is unset.
1163-
# # The default is 5 minutes.
1164-
# #
1165-
# # saml_session_lifetime: 5m
1121+
saml2_config:
1122+
# `sp_config` is the configuration for the pysaml2 Service Provider.
1123+
# See pysaml2 docs for format of config.
1124+
#
1125+
# Default values will be used for the 'entityid' and 'service' settings,
1126+
# so it is not normally necessary to specify them unless you need to
1127+
# override them.
1128+
#
1129+
#sp_config:
1130+
# # point this to the IdP's metadata. You can use either a local file or
1131+
# # (preferably) a URL.
1132+
# metadata:
1133+
# #local: ["saml2/idp.xml"]
1134+
# remote:
1135+
# - url: https://our_idp/metadata.xml
1136+
#
1137+
# # By default, the user has to go to our login page first. If you'd like
1138+
# # to allow IdP-initiated login, set 'allow_unsolicited: True' in a
1139+
# # 'service.sp' section:
1140+
# #
1141+
# #service:
1142+
# # sp:
1143+
# # allow_unsolicited: true
1144+
#
1145+
# # The examples below are just used to generate our metadata xml, and you
1146+
# # may well not need them, depending on your setup. Alternatively you
1147+
# # may need a whole lot more detail - see the pysaml2 docs!
1148+
#
1149+
# description: ["My awesome SP", "en"]
1150+
# name: ["Test SP", "en"]
1151+
#
1152+
# organization:
1153+
# name: Example com
1154+
# display_name:
1155+
# - ["Example co", "en"]
1156+
# url: "http://example.com"
1157+
#
1158+
# contact_person:
1159+
# - given_name: Bob
1160+
# sur_name: "the Sysadmin"
1161+
# email_address": ["[email protected]"]
1162+
# contact_type": technical
1163+
1164+
# Instead of putting the config inline as above, you can specify a
1165+
# separate pysaml2 configuration file:
1166+
#
1167+
#config_path: "CONFDIR/sp_conf.py"
1168+
1169+
# the lifetime of a SAML session. This defines how long a user has to
1170+
# complete the authentication process, if allow_unsolicited is unset.
1171+
# The default is 5 minutes.
1172+
#
1173+
#saml_session_lifetime: 5m
11661174

11671175

11681176

‎synapse/config/saml2_config.py

Lines changed: 62 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ def read_config(self, config, **kwargs):
2626
if not saml2_config or not saml2_config.get("enabled", True):
2727
return
2828

29+
if not saml2_config.get("sp_config") and not saml2_config.get("config_path"):
30+
return
31+
2932
try:
3033
check_requirements("saml2")
3134
except DependencyException as e:
@@ -76,65 +79,73 @@ def generate_config_section(self, config_dir_path, server_name, **kwargs):
7679
return """\
7780
# Enable SAML2 for registration and login. Uses pysaml2.
7881
#
79-
# `sp_config` is the configuration for the pysaml2 Service Provider.
80-
# See pysaml2 docs for format of config.
82+
# At least one of `sp_config` or `config_path` must be set in this section to
83+
# enable SAML login.
8184
#
82-
# Default values will be used for the 'entityid' and 'service' settings,
83-
# so it is not normally necessary to specify them unless you need to
84-
# override them.
85+
# (You will probably also want to set the following options to `false` to
86+
# disable the regular login/registration flows:
87+
# * enable_registration
88+
# * password_config.enabled
8589
#
8690
# Once SAML support is enabled, a metadata file will be exposed at
8791
# https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
8892
# use to configure your SAML IdP with. Alternatively, you can manually configure
8993
# the IdP to use an ACS location of
9094
# https://<server>:<port>/_matrix/saml2/authn_response.
9195
#
92-
#saml2_config:
93-
# sp_config:
94-
# # point this to the IdP's metadata. You can use either a local file or
95-
# # (preferably) a URL.
96-
# metadata:
97-
# #local: ["saml2/idp.xml"]
98-
# remote:
99-
# - url: https://our_idp/metadata.xml
100-
#
101-
# # By default, the user has to go to our login page first. If you'd like to
102-
# # allow IdP-initiated login, set 'allow_unsolicited: True' in a
103-
# # 'service.sp' section:
104-
# #
105-
# #service:
106-
# # sp:
107-
# # allow_unsolicited: True
108-
#
109-
# # The examples below are just used to generate our metadata xml, and you
110-
# # may well not need it, depending on your setup. Alternatively you
111-
# # may need a whole lot more detail - see the pysaml2 docs!
112-
#
113-
# description: ["My awesome SP", "en"]
114-
# name: ["Test SP", "en"]
115-
#
116-
# organization:
117-
# name: Example com
118-
# display_name:
119-
# - ["Example co", "en"]
120-
# url: "http://example.com"
121-
#
122-
# contact_person:
123-
# - given_name: Bob
124-
# sur_name: "the Sysadmin"
125-
# email_address": ["[email protected]"]
126-
# contact_type": technical
127-
#
128-
# # Instead of putting the config inline as above, you can specify a
129-
# # separate pysaml2 configuration file:
130-
# #
131-
# config_path: "%(config_dir_path)s/sp_conf.py"
132-
#
133-
# # the lifetime of a SAML session. This defines how long a user has to
134-
# # complete the authentication process, if allow_unsolicited is unset.
135-
# # The default is 5 minutes.
136-
# #
137-
# # saml_session_lifetime: 5m
96+
saml2_config:
97+
# `sp_config` is the configuration for the pysaml2 Service Provider.
98+
# See pysaml2 docs for format of config.
99+
#
100+
# Default values will be used for the 'entityid' and 'service' settings,
101+
# so it is not normally necessary to specify them unless you need to
102+
# override them.
103+
#
104+
#sp_config:
105+
# # point this to the IdP's metadata. You can use either a local file or
106+
# # (preferably) a URL.
107+
# metadata:
108+
# #local: ["saml2/idp.xml"]
109+
# remote:
110+
# - url: https://our_idp/metadata.xml
111+
#
112+
# # By default, the user has to go to our login page first. If you'd like
113+
# # to allow IdP-initiated login, set 'allow_unsolicited: True' in a
114+
# # 'service.sp' section:
115+
# #
116+
# #service:
117+
# # sp:
118+
# # allow_unsolicited: true
119+
#
120+
# # The examples below are just used to generate our metadata xml, and you
121+
# # may well not need them, depending on your setup. Alternatively you
122+
# # may need a whole lot more detail - see the pysaml2 docs!
123+
#
124+
# description: ["My awesome SP", "en"]
125+
# name: ["Test SP", "en"]
126+
#
127+
# organization:
128+
# name: Example com
129+
# display_name:
130+
# - ["Example co", "en"]
131+
# url: "http://example.com"
132+
#
133+
# contact_person:
134+
# - given_name: Bob
135+
# sur_name: "the Sysadmin"
136+
# email_address": ["[email protected]"]
137+
# contact_type": technical
138+
139+
# Instead of putting the config inline as above, you can specify a
140+
# separate pysaml2 configuration file:
141+
#
142+
#config_path: "%(config_dir_path)s/sp_conf.py"
143+
144+
# the lifetime of a SAML session. This defines how long a user has to
145+
# complete the authentication process, if allow_unsolicited is unset.
146+
# The default is 5 minutes.
147+
#
148+
#saml_session_lifetime: 5m
138149
""" % {
139150
"config_dir_path": config_dir_path
140151
}

0 commit comments

Comments
 (0)