Trying to login with OIDC / MAS

[WhiteSockedDancer]

Describe the bug
We are running a synapse home server with MAS OIDC with an upstream oidc identity provider.
Logging into synapse admin worked with a generated access token. I wanted to try out if i can know sign with OIDC.

When i try to login i get this error on the MAS side:

The Browser console logs dont show any informations.
Refreshing the browser also doesnt do anything.

My user is already flagged as admin in synapse. Do i need to enable this somehow in MAS?
How could i debug this?

To Reproduce
Steps to reproduce the behavior:

1. Go to synapse /admin url
2. Click on "sign in"
3. See error

Expected behavior
Get logged in.

Browser console logs
If applicable, add the browser console's log

Instance configuration:

• Synapse Admin version: [Synapse Admin v0.11.1-etke48-17-g349953b]
• Synapse version [v1.140.0]

[aine-etke]

Hello,
Thank you for reporting this!

Unfortunately, we can't help with that issue yet, because the error is returned by MAS, not Synapse Admin.

Please check your MAS logs - may be there will be more details.
Please note that when you use MAS, users are controlled by MAS, not Synapse, so if your user is marked as admin in Synapse, that doesn't mean it is actually an admin in MAS - I guess that's the first place to check

[WhiteSockedDancer]

Thanks for your answer.

It seems like i had to flag my user in mas to allow can_access_admin and now MAS lets me continue.

Got now another problem (probably with the redirect uri or something..):

I guess thats actually also no issue on this side and i have to open an issue on the MAS repo.

Thanks again. :/

[aine-etke]

Thank you for clarification!

Regarding No Such Resource - that actually could be a Synapse Admin bug (similar to #905) - would you mind providing more details about your deployment and Synapse Admin session?

1. URL of the MAS deployment (including port)
2. URL of the Synapse deployment (actual Synapse URL, not delegated domain)
3. Local storage (browser chrome dev tools -> Storage -> Local Storage) values of base_url, home_server, token_endpoint

If you consider the actual values sensitive information, you may replace them with appropriate placeholders, similar to #905

OIDC Auth support in Synapse Admin is in early stages, so it may not properly support all kind of deployments yet, so we need more details to reproduce and fix the problem.

[aine-etke]

Oh, and also I noticed the Synapse Admin icon in MAS interface is broken - would you mind sharing what link that image uses, and confirm whether there is such icon or not please?

It should be https://admin.etke.cc/images/logo.webp (of course, with your Synapse Admin's instance domain instead of admin.etke.cc)

[aine-etke]

It seems the problem was with incorrect oidc client registration that did not honor path, only domain.

It was fixed in the last commits, so I'm closing this one.
Please try it and confirm if the fix works for you!

[WhiteSockedDancer]

Thanks for your answers.

I pulled the latest version: (Synapse Admin v0.11.1-etke49-1-g3a9fa36)

Now i get some strange behavior:

1. I go to https://matrix.my.domain/admin/
2. I press "Sign in"
3. I'm relayed to https://mas.my.domain/consent/[...]

(Synapse Admin logo is working here)

4. I press "Continue"
5. I'm relayed back to the synapse admin login screen at https://matrix.my.domain/admin/auth-callback?state=[...]&code=[...]#/login

Console logs show here:

Am I missing this cc.etke.synapse.admin key in my well-known entries?

---

Well since I'm already at the login screen I just try it again:

6. I press "Sign in" again.
7. I'm relayed to https://mas.my.domain/consent/[...]
   This time with broken Synapse Admin logo

8. I press "Continue"
9. I'm relayed to a loading spinner at https://matrix.my.domain/admin/auth-callback/auth-callback?state=[...]

[aine-etke]

The cc.etke.synapse-admin is entirely optional, however the URL it tries to use is definitely incorrect.

We'll investigate it further and fix the incorrect behavior.

From what I see right now:

• incorrect path handling (matrix.my.domain/admin is used, but matrix.my.domain/admin/auth-callback is not handled correctly)
• duplicate /auth-callback/auth-callback

There may be more issues, but it seems the root cause is incorrect path handling

[aine-etke]

Please try using the latest docker tag or main git branch in your deployment and confirm whether the new fix for urls handling is working or not (unfortunately, admin.etke.cc will not help in this case, because this issue is related to pre-built Synapse Admin with base path ./ served under path prefix /admin)

[WhiteSockedDancer]

Thanks again.

Works now like a charm with Synapse Admin v0.11.1-etke49-1-g3a9fa36.

Thanks for your support!