SAML auth needs doc

[ara4n]

Particularly for integration with AD ADFS, according to #5130 (comment)

[richvdh]

For the record, the existing doc is

synapse/docs/sample_config.yaml

Line 991 in b4fd86a

# Enable SAML2 for registration and login. Uses pysaml2.

.

Our impl is quite a thin wrapper around pysaml2, so the best bet for documentation is to look there: https://pysaml2.readthedocs.io/en/latest/howto/config.html#howto-config. Obviously it wouldn't be practical to replicate all of that.

I can see that there might be scope for better documentation of how to integrate with certain IdP impls, but given that we don't use AD ourselves, I wouldn't really be confident writing such a thing so I guess we'd be looking for community contributions (and I would be worried maintaining such a thing).

[ara4n]

see #5130 (comment) for @slipeer's notes on AD

[slipeer]

@ara4n, AD (Active Directory) <> AD FS (Active Directory Federation Service)
I'm wrote about Federation Service - commonly used IdP. I provide IdP side config that work fine with @galexrt's guide

But this guide also has some flaws: it describes setting up additional attributes that synapse doesn’t actually use (mail, givenname, surname).

the existing doc is synapse/docs/sample_config.yaml
Our impl is quite a thin wrapper around pysaml2, so the best bet for documentation is to look there: https://pysaml2.readthedocs.io/en/latest/howto/config.html#howto-config. Obviously it wouldn't be practical to replicate all of that.

There is a lack of information about the attributes and format needed for Synapse!

I suppose it is necessary to bring up in one document the actual information from all these sources on how to set it up SAML2 for Synapse.

[volvicoasis]

Hello,

When we use an IDP like keycloak and using sso login method with riot/synapse, how can we use information like email or phone to auto fill a profile ? I ve got display name but no threepid info like email. (mxids login/auth endpoint is bypassed).

[sunsingerus]

@volvicoasis can you please share configuration details on how you've managed to fetch display name from Keycloak? I am trying the same config (keycloak + SAML2) and able to login, but no information is displayed in riot - say no printable name instead of userid. However, in synapse logs I clearly see 'displayName' fetched from Keycloak, but it does not appear in riot.
Thanks in advance

[benjamin-kirkbride]

I as well am having trouble getting everything configured properly in Keycloak. It would be great if someone more familiar with the underlying systems could give a write up.

I followed the instructions here:
https://edenmal.moe/post/2019/Matrix-Synapse-SAML2-Login/#your-matrix-synapse-homeserver-config-yaml-file

But that does give any info on how to populate emails or other attributes.

[ptman]

Thank you @richvdh for helping me with synapse & SAML. I ended up following parts of the edenmal.moe guide and using this for synapse config:

saml2_config:
  sp_config:
    allow_unknown_attributes: true # either allow unknown or map uid using attribute_map_dir
    metadata:
      remote:
        - url: https://keycloak.fqdn/auth/realms/master/protocol/saml/descriptor
  cert_file: /etc/matrix-synapse/saml-cert.pem
  key_file: /etc/matrix-synapse/saml-key.pem

[hex-m]

We've got basic SAML-Authentication working (with Shibboleth as IdP). 🎉

Where we struggle is restricting which users should be allowed to log in. (e.g. only users where the Attribute eduPersonScopedAffiliation contains staff should be authorized.) Does anyone have an example for how to configure this?

Update: my request was solved by #8052 (delivered in 1.13). Thanks - you are awesome! <3

[fooness]

Is there anyone who successfully connected synapse to shibboleth and could share the configuration and or documentation on how they made it work? Maybe @hex-m … seems you’re the only one who mentioned shibboleth in all of synapse’s issues.