Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow the Admin API to create a user where the same localpart exists with uppercase letters #11426

Open
matrixbot opened this issue Dec 19, 2023 · 0 comments

Comments

@matrixbot
Copy link
Collaborator

matrixbot commented Dec 19, 2023

This issue has been migrated from #11426.


Description

Note, I have added a space after the @ in all example Matrix IDs in this issue, this is to avoid pinging the existing @ Alice user on GitHub.

Use case

There are a handful of users who have uppercase letters in their Matrix ID from before Synapse started enforcing lowercase only. They may want to create a new Matrix account with a spec compliant all lowercase localpart.
Ie. they currently have @ Alice:example.com, but want to register @ alice:example.com

Proposed solution

Adding a feature to the User creation Admin API to allow registering @ alice:example.com when @ Alice:example.com already exists.

Authentication endpoints may also need updating when implementing this as these may ignore casing currently.

Security considerations

The localpart availability checker and both client-server and Admin user creation API endpoints ignore casing today and should continue doing this by default.

  • This is to avoid impersonation by allowing client-server API registrations of the lowercase version of an existing MXID with uppercase letters. It is expected that server administrators have verified the users identity before registering this new lowercase Matrix user for them.
  • Also to avoid changing the behavior of existing Synapse user management portals that rely on Synapse for localpart validation.

We should add a parameter to the API something along the lines of &ignore_localpart_casing_duplicates=true. This need to be an optional parameter and default to false if not set

@matrixbot matrixbot changed the title Dummy issue Allow the Admin API to create a user where the same localpart exists with uppercase letters Dec 21, 2023
@matrixbot matrixbot reopened this Dec 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant