Added possibilty to disable local password authentication

changelog.d/5092.feature

@@ -0,0 +1,6 @@
+Added possibilty to disable local password authentication
+
+I've picked up the old pull requests #3485 and implimented @richvdh comments.
+
+This change allows to disable the local password authentication which is useful
+when password providers are used.

docs/sample_config.yaml

@@ -910,6 +910,11 @@ password_config:
    #
    #enabled: false
 
+   # set to false if you do not want to authenticate
+   # against the local db (when using other password_providers
+   #
+   localdb_enabled: true
+
    # Uncomment and change to a secret random string for extra security.
    # DO NOT CHANGE THIS AFTER INITIAL SETUP!
    #

synapse/config/password.py

@@ -26,6 +26,7 @@ def read_config(self, config):
             password_config = {}
 
         self.password_enabled = password_config.get("enabled", True)
+        self.password_localdb_enabled = password_config.get("localdb_enabled", True)
         self.password_pepper = password_config.get("pepper", "")
 
     def default_config(self, config_dir_path, server_name, **kwargs):
@@ -35,6 +36,11 @@ def default_config(self, config_dir_path, server_name, **kwargs):
            #
            #enabled: false
 
+           # set to false if you do not want to authenticate
+           # against the local db (when using other password_providers
+           #
+           localdb_enabled: true
+
            # Uncomment and change to a secret random string for extra security.
            # DO NOT CHANGE THIS AFTER INITIAL SETUP!
            #

synapse/handlers/auth.py

@@ -717,7 +717,7 @@ def validate_login(self, username, login_submission):
                     result = (result, None)
                 defer.returnValue(result)
 
-        if login_type == LoginType.PASSWORD:
+        if login_type == LoginType.PASSWORD and self.hs.config.password_localdb_enabled:
             known_login_type = True
 
             canonical_user_id = yield self._check_local_password(

synapse/handlers/set_password.py

@@ -32,6 +32,10 @@ def __init__(self, hs):
 
     @defer.inlineCallbacks
     def set_password(self, user_id, newpassword, requester=None):
+        if not self.hs.config.password_localdb_enabled:
+            raise SynapseError(403, "Password change disabled",
+                               errcode=Codes.FORBIDDEN)
+
         password_hash = yield self._auth_handler.hash(newpassword)
 
         except_device_id = requester.device_id if requester else None