Improve readme

README.md

@@ -1,32 +1,53 @@
-# HTTP JSON REST Authenticator module for synapse
+# Synapse REST Password provider
-This synapse authentication module (password provider) allows you to query identity data in existing webapps, like:
+- [Overview](#overview)
+- [Install](#install)
+- [Configure](#configure)
+- [Integrate](#integrate)
+- [Support](#support)
+  
+## Overview
+This synapse's password provider allows you to validate a password for a given username and return a user profile using
+an existing backend, like:
 - Forums (phpBB, Discourse, etc.)
 - Custom Identity stores (Keycloak, ...)
 - CRMs (Wordpress, ...)
 - self-hosted clouds (Nextcloud, ownCloud, ...)
 
-It is mainly used with [mxisd](https://github.com/kamax-io/mxisd), the Federated Matrix Identity Server, to provide
+It is mainly used with [mxisd](https://github.com/kamax-matrix/mxisd), the Federated Matrix Identity Server, to provide
 missing features and offer a fully integrated solution (directory, authentication, search).
 
+**NOTE:** This module doesn't provide direct integration with any backend. If you do not use mxisd, you will need to write
+your own backend, following the [Integration section](#integrate). This module simply translate an anthentication result
+and profile information into actionables in synapse, and adapt your user profile with what is given.
+
 ## Install
+### From Synapse v0.34.0/py3
+Copy in whichever directory python3.x can pick it up as a module.  
+
+If you installed synapse using the Matrix debian repos:
+```
+sudo curl https://raw.githubusercontent.com/kamax-matrix/matrix-synapse-rest-auth/master/rest_auth_provider.py -o /opt/venvs/matrix-synapse/lib/python3.5/site-packages/rest_auth_provider.py
+```
+If the command fail, double check that the python version still matches. If not, please let us know by opening an issue.
+
+### Before Synapse v0.34.0/py3 or any py2-based release
 Copy in whichever directory python2.x can pick it up as a module.  
 
 If you installed synapse using the Matrix debian repos:
 ```
-git clone https://github.com/maxidor/matrix-synapse-rest-auth.git
+sudo curl https://raw.githubusercontent.com/kamax-matrix/matrix-synapse-rest-auth/master/rest_auth_provider.py -o /usr/lib/python2.7/dist-packages/rest_auth_provider.py
-cd matrix-synapse-rest-auth
-sudo cp rest_auth_provider.py /usr/lib/python2.7/dist-packages/
 ```
+If the command fail, double check that the python version still matches. If not, please let us know by opening an issue.
 
 ## Configure
 Add or amend the `password_providers` entry like so:
-```
+```yaml
 password_providers:
   - module: "rest_auth_provider.RestAuthProvider"
     config:
       endpoint: "http://change.me.example.com:12345"
 ```
-Set `endpoint` to the appropriate value.
+Set `endpoint` to the value documented with the endpoint provider.
 
 ## Use
 1. Install, configure, restart synapse
@@ -34,17 +55,18 @@ Set `endpoint` to the appropriate value.
 
 ## Next steps
 ### Lowercase username enforcement
+**NOTE**: This is no longer relevant as synapse natively enforces lowercase.
+
 To avoid creating users accounts with uppercase characters in their usernames and running into known
 issues regarding case sensitivity in synapse, attempting to login with such username will fail.
 
 It is highly recommended to keep this feature enable, but in case you would like to disable it:
-```
+```yaml
-[...]
     config:
       policy:
         registration:
           username:
-            enforceLowercase: False
+            enforceLowercase: false
 ```
 
 ### Profile auto-fill
@@ -53,27 +75,34 @@ If none is given, the display name is not set.
 Upon subsequent login, the display name is not changed.
 
 If you would like to change the behaviour, you can use the following configuration items:
-```
+```yaml
-[...]
     config:
       policy:
         registration:
           profile:
-            name: True
+            name: true
         login:
           profile:
-            name: False
+            name: false
 ```
 
 3PIDs received from the backend are merged with the ones already linked to the account.
+If you would like to change this behaviour, you can use the following configuration item:
+```yaml
+    config:
+      policy:
+        all:
+          threepid:
+            update: false
+```
 
 ## Integrate
-To use this module with your backend, you will need to implement a single REST endpoint:
+To use this module with your back-end, you will need to implement a single REST endpoint:
 
 Path: `/_matrix-internal/identity/v1/check_credentials`  
 Method: POST  
 Body as JSON UTF-8:
-```
+```json
 {
   "user": {
     "id": "@matrix.id.of.the.user:example.com",
@@ -82,12 +111,12 @@ Body as JSON UTF-8:
 }
 ```
 
-The following JSON answer will be provided:
+If the credentials are accepted, the following JSON answer will be provided:
-```
+```json
 {
   "auth": {
-    "success": <boolean>
+    "success": true,
-    "mxid": "@matrix.id.of.the.user:example.com"
+    "mxid": "@matrix.id.of.the.user:example.com",
     "profile": {
       "display_name": "John Doe",
       "three_pids": [
@@ -104,6 +133,18 @@ The following JSON answer will be provided:
   }
 }
 ```
+`auth.profile` and any sub-key are optional.
+
+---
+
+If the credentials are refused, the following JSON answer will be provided:
+```json
+{
+  "auth": {
+    "success": false
+  }
+}
+```
 
 ## Support
 For community support, visit our Matrix room [#matrix-synapse-rest-auth:kamax.io](https://matrix.to/#/#matrix-synapse-rest-auth:kamax.io)

rest_auth_provider.py

@@ -87,25 +87,28 @@ class RestAuthProvider(object):
             else:
                 logger.info("Display name was not set because it was not given or policy restricted it")
             
-            if "three_pids" in profile:
+            if (self.config.updateThreepid):
-                logger.info("Handling 3PIDs")
+                if "three_pids" in profile:
-                for threepid in profile["three_pids"]:
+                    logger.info("Handling 3PIDs")
-                    medium = threepid["medium"].lower()
+                    for threepid in profile["three_pids"]:
-                    address = threepid["address"].lower()
+                        medium = threepid["medium"].lower()
-                    logger.info("Looking for 3PID %s:%s in user profile", medium, address)
+                        address = threepid["address"].lower()
+                        logger.info("Looking for 3PID %s:%s in user profile", medium, address)
 
-                    validated_at = self.account_handler.hs.get_clock().time_msec()
+                        validated_at = self.account_handler.hs.get_clock().time_msec()
-                    if not (yield store.get_user_id_by_threepid(medium, address)):
+                        if not (yield store.get_user_id_by_threepid(medium, address)):
-                        logger.info("3PID is not present, adding")
+                            logger.info("3PID is not present, adding")
-                        yield store.user_add_threepid(
+                            yield store.user_add_threepid(
-                            user_id,
+                                user_id,
-                            medium,
+                                medium,
-                            address,
+                                address,
-                            validated_at,
+                                validated_at,
-                            validated_at
+                                validated_at
-                        )
+                            )
-                    else:
+                        else:
-                        logger.info("3PID is present, skipping")
+                            logger.info("3PID is present, skipping")
+            else:
+                logger.info("3PIDs were not updated due to policy")
         else:
             logger.info("No profile data")
 
@@ -121,6 +124,7 @@ class RestAuthProvider(object):
             regLower = True
             setNameOnRegister = True
             setNameOnLogin = False
+            updateThreepid = True
 
         rest_config = _RestConfig()
         rest_config.endpoint = config["endpoint"]
@@ -152,6 +156,15 @@ class RestAuthProvider(object):
             # we don't care
             pass
 
+        try:
+            rest_config.updateThreepid = config['policy']['all']['threepid']['update']
+        except TypeError:
+            # we don't care
+            pass
+        except KeyError:
+            # we don't care
+            pass
+
         return rest_config
 
 def _require_keys(config, required):