Skip to content

Improve SSO/delegated authentication worker docs #19752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benbz wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

Improve SSO/delegated authentication worker docs #19752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
defd7c3
Highlight that some endpoints are only available in experimental MAS …
benbz May 5, 2026
06f007c
Fix endpoints handled by DeviceRestServlet and DevicesRestServlet
benbz May 5, 2026
f0d7eb8
Document stabilised delegated authentication workers
benbz May 5, 2026
f6b33b6
Highlight that the SSO paths aren't need if either form of delegated …
benbz May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/19752.1.doc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Document the paths that can be handled on workers with stabilised delegated authentication.
1 change: 1 addition & 0 deletions changelog.d/19752.doc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Improve documentation around endpoints that can be enabled with MSC3861.
11 changes: 9 additions & 2 deletions docs/workers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,9 @@ information.
# Unstable MSC4140 support
^/_matrix/client/unstable/org.matrix.msc4140/delayed_events(/.*/restart)?$

# Stabilised Delegated Authentication support (`matrix_authentication_service.enabled: true`)
^/_synapse/mas/
Comment on lines +293 to +294
Copy link
Copy Markdown
Member Author

@benbz benbz May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documented up here rather than next to the experimental_features.msc3861.enabled paths as AFAICT it can be handled by any worker rather than a worker with a single process only


Additionally, the following REST endpoints can be handled for GET requests:

# Push rules requests
Expand All @@ -314,7 +317,7 @@ for the room are in flight:

Additionally, the following endpoints should be included if Synapse is configured
to use SSO (you only need to include the ones for whichever SSO provider you're
using):
using) and delegated authentication isn't enabled:
Copy link
Copy Markdown
Member Author

@benbz benbz May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've made the assertion here that none of these paths are useful in delegated auth world (be it experimental config or stabilised)


# for all SSO providers
^/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
Expand Down Expand Up @@ -343,7 +346,11 @@ set to `true`), the following endpoints can be handled by the worker:
^/_synapse/admin/v2/users/[^/]+$
^/_synapse/admin/v1/username_available$
^/_synapse/admin/v1/users/[^/]+/_allow_cross_signing_replacement_without_uia$
^/_synapse/admin/v1/users/[^/]+/devices$
^/_synapse/admin/v2/users/[^/]+/devices(/|$)

Do note that these endpoints can't be handled by workers if the stabilised delegated
authentication support is enabled (`matrix_authentication_service.enabled` set to
`true`).

Note that a [HTTP listener](usage/configuration/config_documentation.md#listeners)
with `client` and `federation` `resources` must be configured in the
Expand Down
Loading