Improve README

- List current features - List features to come - Improve wording at various places - Centralise configuration directions - Improve layout to make it easier for new users (hopefully)
Use proper ID when clearing invites from memory
2017-09-14 04:54:01 +02:00 · 2017-09-14 03:56:21 +02:00 · 2017-09-14 03:38:14 +02:00 · 2017-09-14 03:31:56 +02:00 · 2017-09-14 02:49:24 +02:00 · 2017-09-14 02:36:08 +02:00
75 changed files with 4164 additions and 479 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -7,4 +7,7 @@ out/
 .idea/

 # Local dev config
-application.yaml
+/application.yaml
+
+# Local dev storage
+/mxisd.db
--- a/README.md
+++ b/README.md
@@ -1,23 +1,34 @@
-mxisd
+mxisd - Federated Matrix Identity Server Daemon
 -----
 ![Travis-CI build status](https://travis-ci.org/kamax-io/mxisd.svg?branch=master)  

-[Overview](#overview) | [Lookup process](#lookup-process) | [Packages](#packages) | [From source](#from-source) | [Network Discovery](#network-discovery) | [Integration](#integration) | [Support](#support)
+[Overview](#overview) | [Features](#features) | [Lookup process](#lookup-process) | [Packages](#packages) | 
+[From source](#from-source) | [Configuration](#configuration) | [Network Discovery](#network-discovery) | 
+[Integration](#integration) | [Support](#support)

 # Overview
-mxisd is an implementation of the [Matrix Identity Service specification](https://matrix.org/docs/spec/identity_service/unstable.html) 
-which provides an alternative to the vector.im and matrix.org Identity servers.
+mxisd is a Federated Matrix Identity server aimed to self-hosted Matrix infrastructures.

-mxisd is federated and uses a cascading lookup model which performs lookup from a more authoritative to a less authoritative source, usually doing:
+mxisd uses a cascading lookup model which performs lookup from a more authoritative to a less authoritative source, usually doing:
 - Local identity stores: LDAP, etc.
 - Federated identity stores: another Identity Server in charge of a specific domain, if applicable
- Configured identity stores: another Identiy Server specifically configured, if part of some sort of group trust
- Root identity store: vector.im/matrix.org central Identity Server
+- Configured identity stores: another Identity Server specifically configured, if part of some sort of group trust
+- Root identity store: vector.im/matrix.org central Identity Servers

-mxisd only aims to support workflow that does NOT break federation or basic lookup process of the Matrix ecosystem.
+mxisd provides an alternative to [sydent](https://github.com/matrix-org/sydent), while still connecting to the vector.im and matrix.org Identity servers, 
+by implementing the [Matrix Identity Service specification](https://matrix.org/docs/spec/identity_service/unstable.html).

-**NOTE:** mxisd is **NOT** an authenticator module for homeservers. Identity servers are opaque public directories for those who publish their data on it.  
-For more details, please read the [Identity Service specification](https://matrix.org/docs/spec/identity_service/unstable.html).
+mxisd only aims to support workflows that do NOT break federation or basic lookup processes of the Matrix ecosystem.
+
+# Features
+- Single lookup of 3PID (E-mail, phone number, etc.) by the Matrix Client or Homeserver.
+- Bulk lookups when trying to find possible matches within contacts in Android and iOS clients.
+- Bind of 3PID by a Matrix user within a Matrix client.
+- Support of invitation to rooms by e-mail with e-mail notification to invitee.
+- Authentication support in [synapse](https://github.com/matrix-org/synapse) via the [REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth).
+
+In the pipe:
+- Support to proxy 3PID bindings in user profile to the central Matrix.org servers

 # Lookup Process
 Default Lookup strategy will use a priority order and a configurable recursive/local type of request.
@@ -39,21 +50,16 @@ Given the phone number `+123456789`, the following lookup logic will be performe
 See [releases]((https://github.com/kamax-io/mxisd/releases)) for native installers of supported systems.  
 If none is available, please use other packages or build from source.

-## Docker
-### From source
-Build the image:
-```
-docker build -t your-org/mxisd:$(git describe --tags --always --dirty) .
-```
-You can run a container of the given image and test it with the following command (adapt volumes host paths):
-```
-docker run -v /data/mxisd/etc:/etc/mxisd -v /data/mxisd/var:/var/mxisd -p 8090:8090 -t your-org/mxisd:$(git describe --tags --always --dirty)
-```
-
 ## Debian
 ### Download
 See the [releases section](https://github.com/kamax-io/mxisd/releases).

+### Configure and run
+After installation:
+1. Copy the sample config file `/etc/mxisd/mxisd-sample.yaml` to `/etc/mxisd/mxisd.yaml`
+2. [Configure](#configuration)
+3. Start the service: `sudo systemctl start mxisd`
+
 ### From source
 Requirements:
 - fakeroot
@@ -63,9 +69,24 @@ Run:
 ```
 ./gradlew buildDeb 
 ```
-
 You will find the debian package in `build/dist`

+## Docker
+```
+docker pull kamax/mxisd
+```
+
+For more info, see [the public repository](https://hub.docker.com/r/kamax/mxisd/)
+### From source
+[Build mxisd](#build) then build the docker image:
+```
+docker build -t your-org/mxisd:$(git describe --tags --always --dirty) .
+```
+You can run a container of the given image and test it with the following command (adapt volumes host paths):
+```
+docker run -v /data/mxisd/etc:/etc/mxisd -v /data/mxisd/var:/var/mxisd -p 8090:8090 -t your-org/mxisd:$(git describe --tags --always --dirty)
+```
+
 # From Source
 ## Requirements
 - JDK 1.8
@@ -76,15 +97,9 @@ git clone https://github.com/kamax-io/mxisd.git
 cd mxisd
 ./gradlew build
 ```
+then see the [Configuration](#configuration) section.

-## Configure
-1. Create a new local config: `cp application.example.yaml application.yaml`
-2. Set the `server.name` value to the domain value used in your Home Server configuration
-3. Set an absolute location for the signing keys using `key.path`
-4. Provide the LDAP attributes you want to use for lookup, if you want to use one
-5. Edit an entity in your LDAP database and set the configure attribute with a Matrix ID (e.g. `@john.doe:example.org`)
-
-## Test build and configuration
+## Test build
 Start the server in foreground to validate the build:
 ```
 java -jar build/libs/mxisd.jar
@@ -92,10 +107,18 @@ java -jar build/libs/mxisd.jar

 Ensure the signing key is available:
 ```
-curl http://localhost:8090/_matrix/identity/api/v1/pubkey/ed25519:0
+$ curl http://localhost:8090/_matrix/identity/api/v1/pubkey/ed25519:0
+{"public_key":"..."}
 ```

-Validate your LDAP config and binding info (replace the e-mail):
+Test basic recursive lookup (requires Internet connection with access to TCP 443):
+```
+$ curl 'http://localhost:8090/_matrix/identity/api/v1/lookup?medium=email&address=mxisd-lookup-test@kamax.io'
+{"address":"mxisd-lookup-test@kamax.io","medium":"email","mxid":"@mxisd-lookup-test:kamax.io",...}
+```
+
+
+If you enabled LDAP, you can also validate your config with a similar request after replacing the `address` value with something present within your LDAP
 ```
 curl "http://localhost:8090/_matrix/identity/api/v1/lookup?medium=email&address=john.doe@example.org"
 ```
@@ -132,36 +155,54 @@ chmod a+x /opt/mxisd/mxisd.jar
 ln -s /opt/mxisd/mxisd.jar /usr/bin/mxisd
 ```

-2. Copy the config file created earlier `./application.yaml` to `/etc/mxisd/mxisd.yaml`
-3. Configure `/etc/mxisd/mxisd.yaml` with production value, `key.path` being the most important - `/var/opt/mxisd/signing.key` is recommended
+2. Copy the config file created earlier `./application.example.yaml` to `/etc/mxisd/mxisd.yaml`
+3. [Configure](#configuration)
 4. Copy `<repo root>/src/systemd/mxisd.service` to `/etc/systemd/system/` and edit if needed
-5. Manage service for auto-startup
+5. Enable service for auto-startup
 ```
-# Enable service
 systemctl enable mxisd
-
-# Start service
+```
+6. Start mxisd
+```
 systemctl start mxisd
 ```

+# Configuration
+After following the specific instructions to create a config file from the sample:
+1. Set the `server.name` value to the domain value used in your Home Server configuration
+2. Set an absolute location for the signing keys using `key.path`
+3. Set a location for the default SQLite persistence using `storage.provider.sqlite.database`
+4. Configure the E-mail invite sender with items starting in `invite.sender.email`
+
+If you want to use the LDAP backend:
+1. Enable it with `ldap.enabled`
+2. Configure connection options using items starting in `ldap.connection`
+3. You may want to valid default values for `ldap.attribute` items
+
+
 # Network Discovery
 To allow other federated Identity Server to reach yours, configure the following DNS SRV entry (adapt to your values):
 ```
 _matrix-identity._tcp.example.com. 3600 IN SRV 10 0 443 matrix.example.com.
 ```
-This would only apply for 3PID that are DNS-based, like e-mails. For anything else, like phone numbers, no federation is currently possible.  
+This would only apply for 3PID that are DNS-based, like e-mails. For anything else, like phone numbers, no federation 
+is currently possible.  

 The port must be HTTPS capable. Typically, the port `8090` of mxisd should be behind a reverse proxy which does HTTPS.
 See the [integration section](#integration) for more details.

 # Integration
 - [HTTPS and Reverse proxy](https://github.com/kamax-io/mxisd/wiki/HTTPS)
- [synapse](https://github.com/kamax-io/mxisd/wiki/Homeserver-Integration)
+- [synapse](https://github.com/kamax-io/mxisd/wiki/Homeserver-Integration) as Identity server
+- [synapse with REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth/blob/master/README.md) 
+as authentication module

 # Support
 ## Community
-If you need help, want to report a bug or just say hi, you can reach us on Matrix at [#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io)  
-For more high-level discussion about the Identity Server architecture/API, go to [#matrix-identity:matrix.org](https://matrix.to/#/#matrix-identity:matrix.org)
+If you need help, want to report a bug or just say hi, you can reach us on Matrix at 
+[#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io) or [directly peek anonymously](https://view.matrix.org/room/!NPRUEisLjcaMtHIzDr:kamax.io/).
+For more high-level discussion about the Identity Server architecture/API, go to 
+[#matrix-identity:matrix.org](https://matrix.to/#/#matrix-identity:matrix.org)

 ## Professional
 If you would prefer professional support/custom development for mxisd and/or for Matrix in general, including other open source technologies/products, 
--- a/application.example.yaml
+++ b/application.example.yaml
@@ -1,148 +1,326 @@
-server:
-
-  # Indicate on which port the Identity Server will listen.
-  #
-  # This is be default an unencrypted port.
-  # HTTPS can be configured using Tomcat configuration properties.
-  port: 8090
-
-  # Realm under which this Identity Server is authoritative, required.
-  #
-  # This is used to avoid unnecessary connections and endless recursive lookup.
-  # e.g. domain name in e-mails.
-  name: 'example.org'
+# Sample configuration file explaining all possible options, their default value and if they are required or not.
+#
+# Any optional configuration item will be prefixed by # (comment character) with the configuration item following
+# directly without any whitespace character.
+# Default values for optional configuration item will also follow such item.
+#
+# Any mandatory configuration item will not be prefixed by # and will also contain a value as example that must be
+# changed. It is advised to re-create a clean config file with only the required configuration item.


-
-key:
-
-  # Absolute path for the Identity Server signing key, required.
-  # During testing, /var/tmp/mxisd.key is a possible value
-  #
-  # For production, use a stable location like:
-  #   - /var/opt/mxisd/sign.key
-  #   - /var/local/mxisd/sign.key
-  #   - /var/lib/mxisd/sign.key
-  path: '%SIGNING_KEYS_PATH%'
+#######################
+# Server config items #
+#######################
+# Indicate on which port the Identity Server will listen.
+#
+# This is be default an unencrypted port.
+# HTTPS can be configured using Tomcat configuration properties.
+#
+#server.port: 8090


-
-# This element contains all the configuration item for lookup strategies
-lookup:
-
-  # Configuration items for recursion-type of lookup
-  #
-  # Lookup access are divided into two types:
-  # - Local
-  # - Remote
-  #
-  # This is similar to DNS lookup and recursion and is therefore prone to the same vulnerabilities.
-  # By default, only non-public hosts are allowed to perform recursive lookup.
-  #
-  # This will also prevent very basic endless loops where host A ask host B, which in turn is configured to ask host A,
-  # which would then ask host B again, etc.
-  recursive:
-
-    # Enable recursive lookup globally
-    enabled: true
-
-    # Whitelist of CIDR that will trigger a recursive lookup.
-    # The default list includes all private IPv4 address and the IPv6 loopback.
-    allowedCidr:
-      - '127.0.0.0/8'
-      - '10.0.0.0/8'
-      - '172.16.0.0/12'
-      - '192.168.0.0/16'
-      - '::1/128'
-
-    # In case no binding is found, query an application server which implements the single lookup end-point
-    # to return bridge virtual user that would allow the user to be contacted directly by the said bridge.
-    #
-    # If a binding is returned, the application server is not expected to sign the message as it is not meant to be
-    # reachable from the outside.
-    # If a signature is provided, it will be discarded/replaced by this IS implementation (to be implemented).
-    #
-    # IMPORTANT: This bypass the regular Invite system of the Homeserver. It will be up to the Application Server
-    # to handle such invite. Also, if the bridged user were to actually join Matrix later, or if a 3PID binding is found
-    # room rights and history would not be transferred, as it would appear as a regular Matrix user to the Homeserver.
-    #
-    # This configuration is only helpful for Application Services that want to overwrite bridging for 3PID that are
-    # handled by the Homeserver. Do not enable unless the Application Server specifically supports it!
-    bridge:
-
-      # Enable unknown 3PID bridging globally
-      enabled: false
-
-      # Enable unknown 3PID bridging for hosts that are allowed to perform recursive lookups.
-      # Leaving this setting to true is highly recommended in a standard setup, unless this Identity Server
-      # is meant to always return a virtual user MXID even for the outside world.
-      recursiveOnly: true
-
-      # This mechanism can handle the following scenarios:
-      #
-      # - Single Application Server for all 3PID types: only configure the server value, comment out the rest.
-      #
-      # - Specific Application Server for some 3PID types, default server for the rest: configure the server value and
-      #          each specific 3PID type.
-      #
-      # - Only specific 3PID types: do not configure the server value or leave it empty/blank, configure each specific
-      #          3PID type.
-
-      # Default application server to use for all 3PID types. Remove config item or leave empty/blank to disable.
-      server: ''
-
-      # Configure each 3PID type with a specific application server. Remove config item or leave empty/blank to disable.
-      mappings:
-        email: 'http://localhost:8091'
-        msisdn: ''
+# Realm under which this Identity Server is authoritative.
+#
+# This is used to avoid unnecessary connections and endless recursive lookup.
+# e.g. domain name in e-mails.
+server.name: 'example.org'


-
-ldap:
-  enabled: false
-  tls: false
-  host: 'localhost'
-  port: 389
-  bindDn: 'CN=Matrix Identity Server,CN=Users,DC=example,DC=org'
-  bindPassword: 'password'
-  baseDn: 'CN=Users,DC=example,DC=org'
-
-  # How should we resolve the Matrix ID in case of a match using the attribute.
-  #
-  # The following type are supported:
-  # - uid : the attribute only contains the UID part of the Matrix ID. e.g. 'john.doe' in @john.doe:example.org
-  # - mxid : the attribute contains the full Matrix ID - e.g. '@john.doe:example.org'
-  type: 'uid'
-
-  # The attribute containing the binding itself. This value will be used differently depending on the type.
-  #
-  # /!\ This should match the synapse LDAP Authenticator 'uid' configuration /!\
-  #
-  # Typical values:
-  # - For type 'uid': 'userPrincipalName' or 'uid' or 'saMAccountName'
-  # - For type 'mxid', regardless of the directory type, we recommend using 'pager' as it is a standard attribute and
-  #   is typically not used.
-  attribute: 'userPrincipalName'
-
-  # Configure each 3PID type with a dedicated query.
-  mappings:
-    email: "(|(mailPrimaryAddress=%3pid)(mail=%3pid)(otherMailbox=%3pid))"
-
-    # Phone numbers query.
-    #
-    # Phone numbers use the MSISDN format: https://en.wikipedia.org/wiki/MSISDN
-    # This format does not include international prefix (+ or 00) and therefore has to be put in the query.
-    # Adapt this to your needs for each attribute.
-    msisdn: "(|(telephoneNumber=+%3pid)(mobile=+%3pid)(homePhone=+%3pid)(otherTelephone=+%3pid)(otherMobile=+%3pid)(otherHomePhone=+%3pid))"
+# Public URL to reach this identity server
+#
+# This is used with 3PID invites in room and other Homeserver key verification workflow.
+# If left unconfigured, it will be generated from the server name
+#
+#server.publicUrl: 'https://example.org'


+#############################
+# Signing keys config items #
+#############################
+# Absolute path for the Identity Server signing key.
+# During testing, /var/tmp/mxisd.key is a possible value
+#
+# For production, use a stable location like:
+#   - /var/opt/mxisd/sign.key
+#   - /var/local/mxisd/sign.key
+#   - /var/lib/mxisd/sign.key
+key.path: '/path/to/sign.key'

-forward:

-  # List of forwarders to use to try to match a 3PID.
-  #
-  # Each server will be tried in the given order, going to the next if no binding was found or an error occurred.
-  # These are the current root Identity Servers of the Matrix network.
-  servers:
-    - "https://matrix.org"
-    - "https://vector.im"
+#################################
+# Recurisve lookup config items #
+#################################
+# Configuration items for recursion-type of lookup
+#
+# Lookup access are divided into two types:
+# - Local
+# - Remote
+#
+# This is similar to DNS lookup and recursion and is therefore prone to the same vulnerabilities.
+# By default, only non-public hosts are allowed to perform recursive lookup.
+#
+# This will also prevent very basic endless loops where host A ask host B, which in turn is configured to ask host A,
+# which would then ask host B again, etc.
+
+# Enable recursive lookup globally
+#
+#lookup.recursive.enabled: true
+
+
+# Whitelist of CIDR that will trigger a recursive lookup.
+# The default list includes all private IPv4 address and the IPv6 loopback.
+#
+#lookup.recursive.allowedCidr:
+#  - '127.0.0.0/8'
+#  - '10.0.0.0/8'
+#  - '172.16.0.0/12'
+#  - '192.168.0.0/16'
+#  - '::1/128'
+
+
+# In case no binding is found, query an application server which implements the single lookup end-point
+# to return bridge virtual user that would allow the user to be contacted directly by the said bridge.
+#
+# If a binding is returned, the application server is not expected to sign the message as it is not meant to be
+# reachable from the outside.
+# If a signature is provided, it will be discarded/replaced by this IS implementation (to be implemented).
+#
+# IMPORTANT: This bypass the regular Invite system of the Homeserver. It will be up to the Application Server
+# to handle such invite. Also, if the bridged user were to actually join Matrix later, or if a 3PID binding is found
+# room rights and history would not be transferred, as it would appear as a regular Matrix user to the Homeserver.
+#
+# This configuration is only helpful for Application Services that want to overwrite bridging for 3PID that are
+# handled by the Homeserver. Do not enable unless the Application Server specifically supports it!
+
+# Enable unknown 3PID bridging globally
+#
+#lookup.recursive.bridge.enabled: false
+
+
+# Enable unknown 3PID bridging for hosts that are allowed to perform recursive lookups.
+# Leaving this setting to true is highly recommended in a standard setup, unless this Identity Server
+# is meant to always return a virtual user MXID even for the outside world.
+#
+#lookup.recursive.bridge.recursiveOnly: true
+
+
+# This mechanism can handle the following scenarios:
+#
+# - Single Application Server for all 3PID types: only configure the server value, comment out the rest.
+#
+# - Specific Application Server for some 3PID types, default server for the rest: configure the server value and
+#          each specific 3PID type.
+#
+# - Only specific 3PID types: do not configure the server value or leave it empty/blank, configure each specific
+#          3PID type.
+
+# Default application server to use for all 3PID types. Remove config item or leave empty/blank to disable.
+#
+#lookup.recursive.bridge.server: ''
+
+
+# Configure each 3PID type with a specific application server. Remove config item or leave empty/blank to disable.
+#
+#lookup.recursive.bridge.mappings.email: 'http://localhost:8091'
+#lookup.recursive.bridge.mappings.msisdn: ''
+
+
+#####################
+# LDAP config items #
+#####################
+
+# Global enable/disable switch
+#
+#ldap.enabled: false
+
+#### Connection related config items
+# If the connection should be secure
+#
+#ldap.connection.tls: false
+
+
+# Host to connect to
+#
+#ldap.connection.host: 'localhost'
+
+
+# Port to connect to
+#
+#ldap.connection.port: 389
+
+
+# Bind DN to use when performing lookups
+#
+#ldap.connection.bindDn: 'CN=Matrix Identity Server,CN=Users,DC=example,DC=org'
+
+
+# Bind password to use
+#
+#ldap.connection.bindPassword: 'password'
+
+
+# Base DN used in all queries
+#
+#ldap.connection.baseDn: 'CN=Users,DC=example,DC=org'
+
+
+#### How to map Matrix attributes with LDAP attributes when performing lookup/auth
+#
+# How should we resolve the Matrix ID in case of a match using the attribute.
+#
+# The following type are supported:
+# - uid : the attribute only contains the UID part of the Matrix ID. e.g. 'john.doe' in @john.doe:example.org
+# - mxid : the attribute contains the full Matrix ID - e.g. '@john.doe:example.org'
+#
+#ldap.attribute.uid.type: 'uid'
+
+
+# The attribute containing the binding itself. This value will be used differently depending on the type.
+#
+# /!\ This should match the synapse LDAP Authenticator 'uid' configuration /!\
+#
+# Typical values:
+# - For type 'uid': 'userPrincipalName' or 'uid' or 'saMAccountName'
+# - For type 'mxid', regardless of the directory type, we recommend using 'pager' as it is a standard attribute and
+#   is typically not used.
+#
+#ldap.attribute.uid.value: 'userPrincipalName'
+
+
+# The display name of the user
+#
+#ldap.attribute.name: 'displayName'
+
+
+#### Configuration section relating the authentication of users performed via LDAP.
+#
+# This can be done using the REST Auth module for synapse and pointing it to the identity server.
+# See https://github.com/maxidor/matrix-synapse-rest-auth
+#
+# During authentication, What to filter potential users by, typically by using a dedicated group.
+# If this value is not set, login check will be performed for all entities within the LDAP
+#
+# Example: (memberOf=CN=Matrix Users,CN=Users,DC=example,DC=org)
+#
+# /!\ Currently NOT supported due to a possible bug in LDAP library /!\
+#
+#ldap.auth.filter: ''
+
+
+#### Configuration section relating to identity lookups
+#
+# E-mail query
+#
+#ldap.identity.medium.email: "(|(mailPrimaryAddress=%3pid)(mail=%3pid)(otherMailbox=%3pid))"
+
+
+# Phone numbers query
+#
+# Phone numbers use the MSISDN format: https://en.wikipedia.org/wiki/MSISDN
+# This format does not include international prefix (+ or 00) and therefore has to be put in the query.
+# Adapt this to your needs for each attribute.
+#
+#ldap.identity.medium.msisdn: "(|(telephoneNumber=+%3pid)(mobile=+%3pid)(homePhone=+%3pid)(otherTelephone=+%3pid)(otherMobile=+%3pid)(otherHomePhone=+%3pid))"
+
+
+#######################################
+# Lookup queries forward config items #
+#######################################
+# List of forwarders to use to try to match a 3PID.
+#
+# Each server will be tried in the given order, going to the next if no binding was found or an error occurred.
+# These are the current root Identity Servers of the Matrix network.
+#
+#forward.servers:
+#  - "https://matrix.org"
+#  - "https://vector.im"
+
+
+#############################
+# 3PID invites config items #
+#############################
+#
+#### E-mail invite sender
+#
+# SMTP host
+invite.sender.email.host: "smtp.example.org"
+
+
+# SMTP port
+invite.sender.email.port: 587
+
+
+# TLS mode for the connection.
+#
+# Possible values:
+#  0    Disable TLS entirely
+#  1    Enable TLS if supported by server
+#  2    Force TLS and fail if not available
+#
+#invite.sender.email.tls: 1
+
+
+# Login for SMTP
+invite.sender.email.login: "matrix-identity@example.org"
+
+
+# Password for the account
+invite.sender.email.password: "ThePassword"
+
+
+# The e-mail to send as. If empty, will be the same as login
+invite.sender.email.email: "matrix-identity@example.org"
+
+
+# The display name used in the e-mail
+#
+#invite.sender.email.name: "mxisd Identity Server"
+
+
+# The E-mail template to use, using built-in template by default
+#
+# The template is expected to be a full e-mail body, including client headers, using MIME and UTF-8 encoding.
+# The following headers will be set by mxisd directly and should not be present in the template:
+# - From
+# - To
+# - Date
+# - Message-Id
+# - X-Mailer
+#
+# The following placeholders are available:
+# - %DOMAIN%                Domain name as per server.name config item
+# - %DOMAIN_PRETTY%         Word capitalize version of the domain. e.g. example.org -> Example.org
+# - %FROM_EMAIL%            Value of this section's email config item
+# - %FROM_NAME%             Value of this section's name config item
+# - %SENDER_ID%             Matrix ID of the invitation sender
+# - %SENDER_NAME%           Display name of the invitation sender, empty if not available
+# - %SENDER_NAME_OR_ID%     Value of %SENDER_NAME% or, if empty, value of %SENDER_ID%
+# - %INVITE_MEDIUM%         Medium of the invite (e.g. email, msisdn)
+# - %INVITE_ADDRESS%        Address used to invite
+# - %ROOM_ID%               ID of the room where the invitation took place
+# - %ROOM_NAME%             Name of the room, empty if not available
+# - %ROOM_NAME_OR_ID%       Value of %ROOM_NAME% or, if empty, value of %ROOM_ID%
+#
+#invite.sender.email.template: "/absolute/path/to/file"
+
+
+############################
+# Persistence config items #
+############################
+
+# Configure the storage backend, usually a DB
+# Possible built-in values:
+#   sqlite                      SQLite backend, default
+#
+#storage.backend: 'sqlite'
+
+#### Generic SQLite provider config
+#
+# Path to the SQLite DB file, required if SQLite backend is chosen
+#
+# Examples:
+#  - /var/opt/mxisd/mxisd.db
+#  - /var/local/mxisd/mxisd.db
+#  - /var/lib/mxisd/mxisd.db
+#
+storage.provider.sqlite.database: '/path/to/mxisd.db'
--- a/build.gradle
+++ b/build.gradle
@@ -62,6 +62,7 @@ buildscript {
 }

 repositories {
+    maven { url "https://kamax.io/maven/releases/" }
    mavenCentral()
 }

@@ -75,6 +76,9 @@ dependencies {
    // Spring Boot - standalone app
    compile 'org.springframework.boot:spring-boot-starter-web:1.5.3.RELEASE'

+    // Matrix Java SDK
+    compile 'io.kamax:matrix-java-sdk:0.0.2'
+
    // ed25519 handling
    compile 'net.i2p.crypto:eddsa:0.1.0'

@@ -93,6 +97,19 @@ dependencies {
    // Phone numbers validation
    compile 'com.googlecode.libphonenumber:libphonenumber:8.7.1'

+    // E-mail sending
+    compile 'com.sun.mail:javax.mail:1.5.6'
+    compile 'javax.mail:javax.mail-api:1.5.6'
+
+    // Google Firebase Authentication backend
+    compile 'com.google.firebase:firebase-admin:5.3.0'
+
+    // ORMLite
+    compile 'com.j256.ormlite:ormlite-jdbc:5.0'
+
+    // SQLite
+    compile 'org.xerial:sqlite-jdbc:3.20.0'
+
    testCompile 'junit:junit:4.12'
 }

@@ -104,6 +121,17 @@ springBoot {
    ]
 }

+processResources {
+    doLast {
+        copy {
+            from('build/resources/main/application.yaml') {
+                rename 'application.yaml', 'mxisd.yaml'
+            }
+            into 'build/resources/main'
+        }
+    }
+}
+
 task buildDeb(dependsOn: build) {
    doLast {
        def v = gitVersion()
@@ -133,10 +161,16 @@ task buildDeb(dependsOn: build) {
            into debBuildConfPath
        }

-        ant.replace(
+        ant.replaceregexp(
            file: "${debBuildConfPath}/${debConfFileName}",
-            token: '%SIGNING_KEYS_PATH%',
-            value: "${debDataPath}/signing.key"
+            match: "key.path:(.*)",
+            replace: "key.path: '${debDataPath}/signing.key'"
+        )
+
+        ant.replaceregexp(
+            file: "${debBuildConfPath}/${debConfFileName}",
+            match: "storage.provider.sqlite.database:(.*)",
+            replace: "storage.provider.sqlite.database: '${debDataPath}/mxisd.db'"
        )

        copy {
--- a/media/mx-id-icon-reverse.png
+++ b/media/mx-id-icon-reverse.png
--- a/media/mx-id-icon.png
+++ b/media/mx-id-icon.png
--- a/src/main/groovy/io/kamax/mxisd/ThreePid.java
+++ b/src/main/groovy/io/kamax/mxisd/ThreePid.java
@@ -0,0 +1,47 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd;
+
+// FIXME this should be in matrix-java-sdk
+public class ThreePid {
+
+    private String medium;
+    private String address;
+
+    public ThreePid(String medium, String address) {
+        this.medium = medium;
+        this.address = address;
+    }
+
+    public String getMedium() {
+        return medium;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    @Override
+    public String toString() {
+        return getMedium() + ":" + getAddress();
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/auth/AuthManager.java
+++ b/src/main/groovy/io/kamax/mxisd/auth/AuthManager.java
@@ -0,0 +1,69 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth;
+
+import io.kamax.mxisd.ThreePid;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.invitation.InvitationManager;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@Service
+public class AuthManager {
+
+    private Logger log = LoggerFactory.getLogger(AuthManager.class);
+
+    @Autowired
+    private List<AuthenticatorProvider> providers = new ArrayList<>();
+
+    @Autowired
+    private InvitationManager invMgr;
+
+    public UserAuthResult authenticate(String id, String password) {
+        for (AuthenticatorProvider provider : providers) {
+            if (!provider.isEnabled()) {
+                continue;
+            }
+
+            UserAuthResult result = provider.authenticate(id, password);
+            if (result.isSuccess()) {
+                log.info("{} was authenticated by {}, publishing 3PID mappings, if any", id, provider.getClass().getSimpleName());
+                for (ThreePid pid : result.getThreePids()) {
+                    log.info("Processing {} for {}", pid, id);
+                    invMgr.publishMappingIfInvited(new ThreePidMapping(pid, result.getMxid()));
+                }
+
+                invMgr.lookupMappingsForInvites();
+
+                return result;
+            }
+        }
+
+        return new UserAuthResult().failure();
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/auth/UserAuthResult.java
+++ b/src/main/groovy/io/kamax/mxisd/auth/UserAuthResult.java
@@ -0,0 +1,91 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth;
+
+import io.kamax.matrix.ThreePidMedium;
+import io.kamax.mxisd.ThreePid;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+public class UserAuthResult {
+
+    private boolean success;
+    private String mxid;
+    private String displayName;
+    private List<ThreePid> threePids = new ArrayList<>();
+
+    public UserAuthResult failure() {
+        success = false;
+        mxid = null;
+        displayName = null;
+
+        return this;
+    }
+
+    public UserAuthResult success(String mxid, String displayName) {
+        setSuccess(true);
+        setMxid(mxid);
+        setDisplayName(displayName);
+
+        return this;
+    }
+
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public void setSuccess(boolean success) {
+        this.success = success;
+    }
+
+    public String getMxid() {
+        return mxid;
+    }
+
+    public void setMxid(String mxid) {
+        this.mxid = mxid;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public UserAuthResult withThreePid(ThreePidMedium medium, String address) {
+        return withThreePid(medium.getId(), address);
+    }
+
+    public UserAuthResult withThreePid(String medium, String address) {
+        threePids.add(new ThreePid(medium, address));
+
+        return this;
+    }
+
+    public List<ThreePid> getThreePids() {
+        return Collections.unmodifiableList(threePids);
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/auth/provider/AuthenticatorProvider.java
+++ b/src/main/groovy/io/kamax/mxisd/auth/provider/AuthenticatorProvider.java
@@ -0,0 +1,31 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth.provider;
+
+import io.kamax.mxisd.auth.UserAuthResult;
+
+public interface AuthenticatorProvider {
+
+    boolean isEnabled();
+
+    UserAuthResult authenticate(String id, String password);
+
+}
--- a/src/main/groovy/io/kamax/mxisd/auth/provider/GoogleFirebaseAuthenticator.groovy
+++ b/src/main/groovy/io/kamax/mxisd/auth/provider/GoogleFirebaseAuthenticator.groovy
@@ -0,0 +1,196 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth.provider
+
+import com.google.firebase.FirebaseApp
+import com.google.firebase.FirebaseOptions
+import com.google.firebase.auth.*
+import com.google.firebase.internal.NonNull
+import com.google.firebase.tasks.OnFailureListener
+import com.google.firebase.tasks.OnSuccessListener
+import io.kamax.matrix.ThreePidMedium
+import io.kamax.mxisd.auth.UserAuthResult
+import org.apache.commons.lang.StringUtils
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.regex.Matcher
+import java.util.regex.Pattern
+
+public class GoogleFirebaseAuthenticator implements AuthenticatorProvider {
+
+    private Logger log = LoggerFactory.getLogger(GoogleFirebaseAuthenticator.class);
+
+    private static final Pattern matrixIdLaxPattern = Pattern.compile("@(.*):(.+)"); // FIXME use matrix-java-sdk
+
+    private boolean isEnabled;
+    private String domain;
+    private FirebaseApp fbApp;
+    private FirebaseAuth fbAuth;
+
+    private void waitOnLatch(UserAuthResult result, CountDownLatch l, long timeout, TimeUnit unit, String purpose) {
+        try {
+            l.await(timeout, unit);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for " + purpose);
+            result.failure();
+        }
+    }
+
+    public GoogleFirebaseAuthenticator(boolean isEnabled) {
+        this.isEnabled = isEnabled;
+    }
+
+    public GoogleFirebaseAuthenticator(String credsPath, String db, String domain) {
+        this(true);
+        this.domain = domain;
+        try {
+            fbApp = FirebaseApp.initializeApp(getOpts(credsPath, db), "AuthenticationProvider");
+            fbAuth = FirebaseAuth.getInstance(fbApp);
+
+            log.info("Google Firebase Authentication is ready");
+        } catch (IOException e) {
+            throw new RuntimeException("Error when initializing Firebase", e);
+        }
+    }
+
+    private FirebaseCredential getCreds(String credsPath) throws IOException {
+        if (StringUtils.isNotBlank(credsPath)) {
+            return FirebaseCredentials.fromCertificate(new FileInputStream(credsPath));
+        } else {
+            return FirebaseCredentials.applicationDefault();
+        }
+    }
+
+    private FirebaseOptions getOpts(String credsPath, String db) throws IOException {
+        if (StringUtils.isBlank(db)) {
+            throw new IllegalArgumentException("Firebase database is not configured");
+        }
+
+        return new FirebaseOptions.Builder()
+                .setCredential(getCreds(credsPath))
+                .setDatabaseUrl(db)
+                .build();
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return isEnabled;
+    }
+
+    private void waitOnLatch(CountDownLatch l) {
+        try {
+            l.await(30, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for Firebase auth check");
+        }
+    }
+
+    @Override
+    public UserAuthResult authenticate(String id, String password) {
+        if (!isEnabled()) {
+            throw new IllegalStateException();
+        }
+
+        final UserAuthResult result = new UserAuthResult();
+
+        log.info("Trying to authenticate {}", id);
+        Matcher m = matrixIdLaxPattern.matcher(id);
+        if (!m.matches()) {
+            log.warn("Could not validate {} as a Matrix ID", id);
+            result.failure();
+        }
+
+        String localpart = m.group(1);
+
+        CountDownLatch l = new CountDownLatch(1);
+        fbAuth.verifyIdToken(password).addOnSuccessListener(new OnSuccessListener<FirebaseToken>() {
+            @Override
+            void onSuccess(FirebaseToken token) {
+                try {
+                    if (!StringUtils.equals(localpart, token.getUid())) {
+                        log.info("Failture to authenticate {}: Matrix ID localpart '{}' does not match Firebase UID '{}'", id, localpart, token.getUid());
+                        result.failure();
+                        return;
+                    }
+
+                    log.info("{} was successfully authenticated", id);
+                    result.success(id, token.getName());
+
+                    log.info("Fetching profile for {}", id);
+                    CountDownLatch userRecordLatch = new CountDownLatch(1);
+                    fbAuth.getUser(token.getUid()).addOnSuccessListener(new OnSuccessListener<UserRecord>() {
+                        @Override
+                        void onSuccess(UserRecord user) {
+                            try {
+                                if (StringUtils.isNotBlank(user.getEmail())) {
+                                    result.withThreePid(ThreePidMedium.Email, user.getEmail());
+                                }
+
+                                if (StringUtils.isNotBlank(user.getPhoneNumber())) {
+                                    result.withThreePid(ThreePidMedium.PhoneNumber, user.getPhoneNumber());
+                                }
+                            } finally {
+                                userRecordLatch.countDown();
+                            }
+                        }
+                    }).addOnFailureListener(new OnFailureListener() {
+                        @Override
+                        void onFailure(@NonNull Exception e) {
+                            try {
+                                log.warn("Unable to fetch Firebase user profile for {}", id);
+                                result.failure();
+                            } finally {
+                                userRecordLatch.countDown();
+                            }
+                        }
+                    });
+
+                    waitOnLatch(result, userRecordLatch, 30, TimeUnit.SECONDS, "Firebase user profile");
+                } finally {
+                    l.countDown()
+                }
+            }
+        }).addOnFailureListener(new OnFailureListener() {
+            @Override
+            void onFailure(@NonNull Exception e) {
+                try {
+                    if (e instanceof IllegalArgumentException) {
+                        log.info("Failure to authenticate {}: invalid firebase token", id);
+                    } else {
+                        log.info("Failure to authenticate {}: {}", id, e.getMessage(), e);
+                        log.info("Exception", e);
+                    }
+
+                    result.failure();
+                } finally {
+                    l.countDown()
+                }
+            }
+        });
+
+        waitOnLatch(result, l, 30, TimeUnit.SECONDS, "Firebase auth check");
+        return result;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/auth/provider/LdapAuthProvider.java
+++ b/src/main/groovy/io/kamax/mxisd/auth/provider/LdapAuthProvider.java
@@ -0,0 +1,135 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth.provider;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.mxisd.auth.UserAuthResult;
+import io.kamax.mxisd.config.ldap.LdapConfig;
+import io.kamax.mxisd.lookup.provider.LdapProvider;
+import org.apache.commons.lang.StringUtils;
+import org.apache.directory.api.ldap.model.cursor.CursorException;
+import org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException;
+import org.apache.directory.api.ldap.model.cursor.EntryCursor;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.SearchScope;
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.apache.directory.ldap.client.api.LdapNetworkConnection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+public class LdapAuthProvider implements AuthenticatorProvider {
+
+    private Logger log = LoggerFactory.getLogger(LdapAuthProvider.class);
+
+    @Autowired
+    private LdapConfig ldapCfg;
+
+    private LdapConnection getConn() {
+        return new LdapNetworkConnection(ldapCfg.getConn().getHost(), ldapCfg.getConn().getPort(), ldapCfg.getConn().isTls());
+    }
+
+    private void bind(LdapConnection conn) throws LdapException {
+        conn.bind(ldapCfg.getConn().getBindDn(), ldapCfg.getConn().getBindPassword());
+    }
+
+    private String getUidAttribute() {
+        return ldapCfg.getAttribute().getUid().getValue();
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return ldapCfg.isEnabled();
+    }
+
+    @Override
+    public UserAuthResult authenticate(String id, String password) {
+        log.info("Performing auth for {}", id);
+
+        LdapConnection conn = getConn();
+        try {
+            bind(conn);
+
+            String uidType = ldapCfg.getAttribute().getUid().getType();
+            MatrixID mxIdExt = new MatrixID(id);
+            String userFilterValue = StringUtils.equals(LdapProvider.UID, uidType) ? mxIdExt.getLocalPart() : mxIdExt.getId();
+            String userFilter = "(" + ldapCfg.getAttribute().getUid().getValue() + "=" + userFilterValue + ")";
+            EntryCursor cursor = conn.search(ldapCfg.getConn().getBaseDn(), userFilter, SearchScope.SUBTREE, getUidAttribute(), ldapCfg.getAttribute().getName());
+            try {
+                while (cursor.next()) {
+                    Entry entry = cursor.get();
+                    String dn = entry.getDn().getName();
+                    log.info("Checking possible match, DN: {}", dn);
+
+                    Attribute attribute = entry.get(getUidAttribute());
+                    if (attribute == null) {
+                        log.info("DN {}: no attribute {}, skpping", dn, getUidAttribute());
+                        continue;
+                    }
+
+                    String data = attribute.get().toString();
+                    if (data.length() < 1) {
+                        log.info("DN {}: empty attribute {}, skipping", getUidAttribute());
+                        continue;
+                    }
+
+                    log.info("Attempting authentication on LDAP for {}", dn);
+                    try {
+                        conn.bind(entry.getDn(), password);
+                    } catch (LdapException e) {
+                        log.info("Unable to bind using {} because {}", entry.getDn().getName(), e.getMessage());
+                        return new UserAuthResult().failure();
+                    }
+
+                    Attribute nameAttribute = entry.get(ldapCfg.getAttribute().getName());
+                    String name = nameAttribute != null ? nameAttribute.get().toString() : null;
+
+                    log.info("Authentication successful for {}", entry.getDn().getName());
+                    log.info("DN {} is a valid match", dn);
+
+                    return new UserAuthResult().success(mxIdExt.getId(), name);
+                }
+            } catch (CursorLdapReferralException e) {
+                log.warn("Entity for {} is only available via referral, skipping", mxIdExt);
+            } finally {
+                cursor.close();
+            }
+
+            log.info("No match were found for {}", id);
+            return new UserAuthResult().failure();
+        } catch (LdapException | IOException | CursorException e) {
+            throw new RuntimeException(e);
+        } finally {
+            try {
+                conn.close();
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/FirebaseConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/FirebaseConfig.java
@@ -0,0 +1,101 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.GoogleFirebaseAuthenticator;
+import io.kamax.mxisd.lookup.provider.GoogleFirebaseProvider;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("firebase")
+public class FirebaseConfig {
+
+    private Logger log = LoggerFactory.getLogger(FirebaseConfig.class);
+
+    @Autowired
+    private ServerConfig srvCfg;
+
+    private boolean enabled;
+    private String credentials;
+    private String database;
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getCredentials() {
+        return credentials;
+    }
+
+    public void setCredentials(String credentials) {
+        this.credentials = credentials;
+    }
+
+    public String getDatabase() {
+        return database;
+    }
+
+    public void setDatabase(String database) {
+        this.database = database;
+    }
+
+    @PostConstruct
+    private void postConstruct() {
+        log.info("--- Firebase configuration ---");
+        log.info("Enabled: {}", isEnabled());
+        if (isEnabled()) {
+            log.info("Credentials: {}", getCredentials());
+            log.info("Database: {}", getDatabase());
+        }
+    }
+
+    @Bean
+    public AuthenticatorProvider getAuthProvider() {
+        if (!enabled) {
+            return new GoogleFirebaseAuthenticator(false);
+        } else {
+            return new GoogleFirebaseAuthenticator(credentials, database, srvCfg.getName());
+        }
+    }
+
+    @Bean
+    public IThreePidProvider getLookupProvider() {
+        if (!enabled) {
+            return new GoogleFirebaseProvider(false);
+        } else {
+            return new GoogleFirebaseProvider(credentials, database, srvCfg.getName());
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ForwardConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/ForwardConfig.groovy
@@ -27,7 +27,7 @@ import org.springframework.context.annotation.Configuration
@ConfigurationProperties(prefix = "forward")
 class ForwardConfig {

-    private List<String> servers
+    private List<String> servers = new ArrayList<>()

    List<String> getServers() {
        return servers
--- a/src/main/groovy/io/kamax/mxisd/config/KeyConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/KeyConfig.groovy
@@ -20,6 +20,7 @@

 package io.kamax.mxisd.config

+import io.kamax.mxisd.exception.ConfigurationException
 import org.apache.commons.lang.StringUtils
 import org.springframework.beans.factory.InitializingBean
 import org.springframework.boot.context.properties.ConfigurationProperties
@@ -42,7 +43,7 @@ class KeyConfig implements InitializingBean {
    @Override
    void afterPropertiesSet() throws Exception {
        if (StringUtils.isBlank(getPath())) {
-            throw new RuntimeException("Key path must be configured!")
+            throw new ConfigurationException("key.path")
        }
    }

--- a/src/main/groovy/io/kamax/mxisd/config/LdapConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/LdapConfig.groovy
@@ -1,156 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.config
-
-import org.apache.commons.lang.StringUtils
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
-
-@Configuration
-@ConfigurationProperties(prefix = "ldap")
-class LdapConfig implements InitializingBean {
-
-    private Logger log = LoggerFactory.getLogger(LdapConfig.class)
-
-    private boolean enabled
-    private boolean tls
-    private String host
-    private int port
-    private String baseDn
-    private String type
-    private String attribute
-    private String bindDn
-    private String bindPassword
-    private Map<String, String> mappings
-
-    boolean getEnabled() {
-        return enabled
-    }
-
-    void setEnabled(boolean enabled) {
-        this.enabled = enabled
-    }
-
-    boolean getTls() {
-        return tls
-    }
-
-    void setTls(boolean tls) {
-        this.tls = tls
-    }
-
-    String getHost() {
-        return host
-    }
-
-    void setHost(String host) {
-        this.host = host
-    }
-
-    int getPort() {
-        return port
-    }
-
-    void setPort(int port) {
-        this.port = port
-    }
-
-    String getBaseDn() {
-        return baseDn
-    }
-
-    void setBaseDn(String baseDn) {
-        this.baseDn = baseDn
-    }
-
-    String getType() {
-        return type
-    }
-
-    void setType(String type) {
-        this.type = type
-    }
-
-    String getAttribute() {
-        return attribute
-    }
-
-    void setAttribute(String attribute) {
-        this.attribute = attribute
-    }
-
-    String getBindDn() {
-        return bindDn
-    }
-
-    void setBindDn(String bindDn) {
-        this.bindDn = bindDn
-    }
-
-    String getBindPassword() {
-        return bindPassword
-    }
-
-    void setBindPassword(String bindPassword) {
-        this.bindPassword = bindPassword
-    }
-
-    Map<String, String> getMappings() {
-        return mappings
-    }
-
-    void setMappings(Map<String, String> mappings) {
-        this.mappings = mappings
-    }
-
-    Optional<String> getMapping(String type) {
-        if (mappings == null) {
-            return Optional.empty()
-        }
-
-        return Optional.ofNullable(mappings.get(type))
-    }
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        log.info("LDAP enabled: {}", getEnabled())
-
-        if (!getEnabled()) {
-            return
-        }
-
-        log.info("Matrix ID type: {}", getType())
-        log.info("LDAP Host: {}", getHost())
-        log.info("LDAP Bind DN: {}", getBindDn())
-        log.info("LDAP Attribute: {}", getAttribute())
-
-        if (StringUtils.isBlank(getHost())) {
-            throw new IllegalStateException("LDAP Host must be configured!")
-        }
-        if (StringUtils.isBlank(getAttribute())) {
-            throw new IllegalStateException("LDAP attribute must be configured!")
-        }
-    }
-
-}
--- a/src/main/groovy/io/kamax/mxisd/config/RecursiveLookupBridgeConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/RecursiveLookupBridgeConfig.groovy
@@ -1,3 +1,23 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.config

 import org.slf4j.Logger
@@ -15,7 +35,7 @@ class RecursiveLookupBridgeConfig implements InitializingBean {
    private boolean enabled
    private boolean recursiveOnly
    private String server
-    private Map<String, String> mappings
+    private Map<String, String> mappings = new HashMap<>()

    boolean getEnabled() {
        return enabled
@@ -51,10 +71,13 @@ class RecursiveLookupBridgeConfig implements InitializingBean {

    @Override
    void afterPropertiesSet() throws Exception {
+        log.info("--- Bridge integration lookups config ---")
        log.info("Enabled: {}", getEnabled())
+        if (getEnabled()) {
            log.info("Recursive only: {}", getRecursiveOnly())
-        log.info("Server: {}", getServer())
+            log.info("Fallback Server: {}", getServer())
            log.info("Mappings: {}", mappings.size())
        }
+    }

 }
--- a/src/main/groovy/io/kamax/mxisd/config/SQLiteStorageConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/SQLiteStorageConfig.java
@@ -0,0 +1,40 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties("storage.provider.sqlite")
+public class SQLiteStorageConfig {
+
+    private String database;
+
+    public String getDatabase() {
+        return database;
+    }
+
+    public void setDatabase(String database) {
+        this.database = database;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ServerConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/ServerConfig.groovy
@@ -20,7 +20,10 @@

 package io.kamax.mxisd.config

+import io.kamax.mxisd.exception.ConfigurationException
 import org.apache.commons.lang.StringUtils
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.InitializingBean
 import org.springframework.boot.context.properties.ConfigurationProperties
 import org.springframework.context.annotation.Configuration
@@ -29,7 +32,11 @@ import org.springframework.context.annotation.Configuration
@ConfigurationProperties(prefix = "server")
 class ServerConfig implements InitializingBean {

+    private Logger log = LoggerFactory.getLogger(ServerConfig.class);
+
    private String name
+    private int port
+    private String publicUrl

    String getName() {
        return name
@@ -39,11 +46,43 @@ class ServerConfig implements InitializingBean {
        this.name = name
    }

+    int getPort() {
+        return port
+    }
+
+    void setPort(int port) {
+        this.port = port
+    }
+
+    String getPublicUrl() {
+        return publicUrl
+    }
+
+    void setPublicUrl(String publicUrl) {
+        this.publicUrl = publicUrl
+    }
+
    @Override
    void afterPropertiesSet() throws Exception {
        if (StringUtils.isBlank(getName())) {
-            throw new RuntimeException("Server name must be configured. Use the same realm as your Homeserver")
+            throw new ConfigurationException("server.name")
        }
+
+        if (StringUtils.isBlank(getPublicUrl())) {
+            log.warn("Public URL is empty, generating from name {}", getName())
+            publicUrl = "https://${getName()}"
+        }
+
+        try {
+            new URL(getPublicUrl())
+        } catch (MalformedURLException e) {
+            log.warn("Public URL is not valid: {}", StringUtils.defaultIfBlank(e.getMessage(), "<no reason provided>"))
+        }
+
+        log.info("--- Server config ---")
+        log.info("Name: {}", getName())
+        log.info("Port: {}", getPort())
+        log.info("Public URL: {}", getPublicUrl())
    }

 }
--- a/src/main/groovy/io/kamax/mxisd/config/StorageConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/StorageConfig.java
@@ -0,0 +1,51 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("storage")
+public class StorageConfig {
+
+    private String backend;
+
+    public String getBackend() {
+        return backend;
+    }
+
+    public void setBackend(String backend) {
+        this.backend = backend;
+    }
+
+    @PostConstruct
+    private void postConstruct() {
+        if (StringUtils.isBlank(getBackend())) {
+            throw new ConfigurationException("storage.backend");
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/invite/sender/EmailSenderConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/invite/sender/EmailSenderConfig.java
@@ -0,0 +1,135 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.invite.sender;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.io.File;
+
+@Configuration
+@ConfigurationProperties(prefix = "invite.sender.email")
+public class EmailSenderConfig {
+
+    private Logger log = LoggerFactory.getLogger(EmailSenderConfig.class);
+
+    private String host;
+    private int port;
+    private int tls;
+    private String login;
+    private String password;
+    private String email;
+    private String name;
+    private String template;
+
+    public String getHost() {
+        return host;
+    }
+
+    public void setHost(String host) {
+        this.host = host;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    public void setPort(int port) {
+        this.port = port;
+    }
+
+    public int getTls() {
+        return tls;
+    }
+
+    public void setTls(int tls) {
+        this.tls = tls;
+    }
+
+    public String getLogin() {
+        return login;
+    }
+
+    public void setLogin(String login) {
+        this.login = login;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getTemplate() {
+        return template;
+    }
+
+    public void setTemplate(String template) {
+        this.template = template;
+    }
+
+    @PostConstruct
+    private void postConstruct() {
+        log.info("--- E-mail Invite Sender config ---");
+        log.info("Host: {}", getHost());
+        log.info("Port: {}", getPort());
+        log.info("TLS Mode: {}", getTls());
+        log.info("Login: {}", getLogin());
+        log.info("Has password: {}", StringUtils.isBlank(getPassword()));
+        log.info("E-mail: {}", getEmail());
+        if (!StringUtils.startsWith(getTemplate(), "classpath:")) {
+            if (StringUtils.isBlank(getTemplate())) {
+                log.warn("invite.sender.template is empty! Will not send invites");
+            } else {
+                File cp = new File(getTemplate()).getAbsoluteFile();
+                log.info("Template: {}", cp.getAbsolutePath());
+                if (!cp.exists() || !cp.isFile() || !cp.canRead()) {
+                    log.warn(getTemplate() + " does not exist, is not a file or cannot be read");
+                }
+            }
+        } else {
+            log.info("Template: Built-in");
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAttributeConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAttributeConfig.java
@@ -0,0 +1,49 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.attribute")
+public class LdapAttributeConfig {
+
+    private LdapAttributeUidConfig uid;
+    private String name;
+
+    public LdapAttributeUidConfig getUid() {
+        return uid;
+    }
+
+    public void setUid(LdapAttributeUidConfig uid) {
+        this.uid = uid;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAttributeUidConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAttributeUidConfig.java
@@ -0,0 +1,49 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.attribute.uid")
+public class LdapAttributeUidConfig {
+
+    private String type;
+    private String value;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAuthConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapAuthConfig.java
@@ -0,0 +1,40 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.auth")
+public class LdapAuthConfig {
+
+    private String filter;
+
+    public String getFilter() {
+        return filter;
+    }
+
+    public void setFilter(String filter) {
+        this.filter = filter;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapConfig.groovy
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapConfig.groovy
@@ -0,0 +1,129 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap
+
+import groovy.json.JsonOutput
+import io.kamax.mxisd.lookup.provider.LdapProvider
+import org.apache.commons.lang.StringUtils
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.context.properties.ConfigurationProperties
+import org.springframework.context.annotation.Configuration
+
+import javax.annotation.PostConstruct
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap")
+class LdapConfig {
+
+    private Logger log = LoggerFactory.getLogger(LdapConfig.class)
+
+    private boolean enabled
+
+    @Autowired
+    private LdapConnectionConfig conn
+    private LdapAttributeConfig attribute
+    private LdapAuthConfig auth
+    private LdapIdentityConfig identity
+
+    boolean isEnabled() {
+        return enabled
+    }
+
+    void setEnabled(boolean enabled) {
+        this.enabled = enabled
+    }
+
+    LdapConnectionConfig getConn() {
+        return conn
+    }
+
+    void setConn(LdapConnectionConfig conn) {
+        this.conn = conn
+    }
+
+    LdapAttributeConfig getAttribute() {
+        return attribute
+    }
+
+    void setAttribute(LdapAttributeConfig attribute) {
+        this.attribute = attribute
+    }
+
+    LdapAuthConfig getAuth() {
+        return auth
+    }
+
+    void setAuth(LdapAuthConfig auth) {
+        this.auth = auth
+    }
+
+    LdapIdentityConfig getIdentity() {
+        return identity
+    }
+
+    void setIdentity(LdapIdentityConfig identity) {
+        this.identity = identity
+    }
+
+    @PostConstruct
+    void afterPropertiesSet() {
+        log.info("--- LDAP Config ---")
+        log.info("Enabled: {}", isEnabled())
+
+        if (!isEnabled()) {
+            return
+        }
+
+        if (StringUtils.isBlank(conn.getHost())) {
+            throw new IllegalStateException("LDAP Host must be configured!")
+        }
+
+        if (1 > conn.getPort() || 65535 < conn.getPort()) {
+            throw new IllegalStateException("LDAP port is not valid")
+        }
+
+        if (StringUtils.isBlank(attribute.getUid().getType())) {
+            throw new IllegalStateException("Attribute UID Type cannot be empty")
+        }
+
+
+        if (StringUtils.isBlank(attribute.getUid().getValue())) {
+            throw new IllegalStateException("Attribute UID value cannot be empty")
+        }
+
+        String uidType = attribute.getUid().getType();
+        if (!StringUtils.equals(LdapProvider.UID, uidType) && !StringUtils.equals(LdapProvider.MATRIX_ID, uidType)) {
+            throw new IllegalArgumentException("Unsupported LDAP UID type: " + uidType)
+        }
+
+        log.info("Host: {}", conn.getHost())
+        log.info("Port: {}", conn.getPort())
+        log.info("Bind DN: {}", conn.getBindDn())
+        log.info("Base DN: {}", conn.getBaseDn())
+
+        log.info("Attribute: {}", JsonOutput.toJson(attribute))
+        log.info("Auth: {}", JsonOutput.toJson(auth))
+        log.info("Identity: {}", JsonOutput.toJson(identity))
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapConnectionConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapConnectionConfig.java
@@ -0,0 +1,85 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.connection")
+public class LdapConnectionConfig {
+
+    private boolean tls;
+    private String host;
+    private int port;
+    private String bindDn;
+    private String bindPassword;
+    private String baseDn;
+
+    public boolean isTls() {
+        return tls;
+    }
+
+    public void setTls(boolean tls) {
+        this.tls = tls;
+    }
+
+    public String getHost() {
+        return host;
+    }
+
+    public void setHost(String host) {
+        this.host = host;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    public void setPort(int port) {
+        this.port = port;
+    }
+
+    public String getBindDn() {
+        return bindDn;
+    }
+
+    public void setBindDn(String bindDn) {
+        this.bindDn = bindDn;
+    }
+
+    public String getBindPassword() {
+        return bindPassword;
+    }
+
+    public void setBindPassword(String bindPassword) {
+        this.bindPassword = bindPassword;
+    }
+
+    public String getBaseDn() {
+        return baseDn;
+    }
+
+    public void setBaseDn(String baseDn) {
+        this.baseDn = baseDn;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/config/ldap/LdapIdentityConfig.java
+++ b/src/main/groovy/io/kamax/mxisd/config/ldap/LdapIdentityConfig.java
@@ -0,0 +1,48 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.identity")
+public class LdapIdentityConfig {
+
+    private Map<String, String> medium = new HashMap<>();
+
+    public Map<String, String> getMedium() {
+        return medium;
+    }
+
+    public Optional<String> getQuery(String key) {
+        return Optional.ofNullable(medium.get(key));
+    }
+
+    public void setMedium(Map<String, String> medium) {
+        this.medium = medium;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/AuthController.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/AuthController.java
@@ -0,0 +1,89 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller.v1;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import io.kamax.mxisd.auth.AuthManager;
+import io.kamax.mxisd.auth.UserAuthResult;
+import org.apache.commons.io.IOUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+@RestController
+@CrossOrigin
+@RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
+public class AuthController {
+
+    private Logger log = LoggerFactory.getLogger(AuthController.class);
+
+    private Gson gson = new Gson();
+
+    @Autowired
+    private AuthManager mgr;
+
+    @RequestMapping(value = "/_matrix-internal/identity/v1/check_credentials", method = RequestMethod.POST)
+    public String checkCredentials(HttpServletRequest req) {
+        try {
+            JsonElement el = new JsonParser().parse(IOUtils.toString(req.getInputStream(), StandardCharsets.UTF_8));
+            if (!el.isJsonObject() || !el.getAsJsonObject().has("user")) {
+                throw new IllegalArgumentException("Missing user key");
+            }
+
+            JsonObject authData = el.getAsJsonObject().get("user").getAsJsonObject();
+            if (!authData.has("id") || !authData.has("password")) {
+                throw new IllegalArgumentException("Missing id or password keys");
+            }
+
+            String id = authData.get("id").getAsString();
+            log.info("Requested to check credentials for {}", id);
+            String password = authData.get("password").getAsString();
+
+            UserAuthResult result = mgr.authenticate(id, password);
+
+            JsonObject authObj = new JsonObject();
+            authObj.addProperty("success", result.isSuccess());
+            if (result.isSuccess()) {
+                authObj.addProperty("mxid", result.getMxid());
+                authObj.addProperty("display_name", result.getDisplayName());
+            }
+            JsonObject obj = new JsonObject();
+
+            obj.add("authentication", authObj);
+            return gson.toJson(obj);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/DefaultExceptionHandler.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/DefaultExceptionHandler.java
@@ -0,0 +1,78 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller.v1;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonObject;
+import io.kamax.mxisd.exception.BadRequestException;
+import io.kamax.mxisd.exception.MappingAlreadyExistsException;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.MissingServletRequestParameterException;
+import org.springframework.web.bind.annotation.*;
+
+import javax.servlet.http.HttpServletRequest;
+
+@ControllerAdvice
+@ResponseBody
+@RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
+public class DefaultExceptionHandler {
+
+    private Logger log = LoggerFactory.getLogger(DefaultExceptionHandler.class);
+
+    private static Gson gson = new Gson();
+
+    static String handle(String erroCode, String error) {
+        JsonObject obj = new JsonObject();
+        obj.addProperty("errcode", erroCode);
+        obj.addProperty("error", error);
+        return gson.toJson(obj);
+    }
+
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    @ExceptionHandler(MissingServletRequestParameterException.class)
+    public String handle(MissingServletRequestParameterException e) {
+        return handle("M_INVALID_BODY", e.getMessage());
+    }
+
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    @ExceptionHandler(MappingAlreadyExistsException.class)
+    public String handle(MappingAlreadyExistsException e) {
+        return handle("M_ALREADY_EXISTS", e.getMessage());
+    }
+
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    @ExceptionHandler(BadRequestException.class)
+    public String handle(BadRequestException e) {
+        return handle("M_BAD_REQUEST", e.getMessage());
+    }
+
+    @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
+    @ExceptionHandler(RuntimeException.class)
+    public String handle(HttpServletRequest req, RuntimeException e) {
+        log.error("Unknown error when handling {}", req.getRequestURL(), e);
+        return handle("M_UNKNOWN", StringUtils.defaultIfBlank(e.getMessage(), "An uknown error occured. Contact the server administrator if this persists."));
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/InvitationController.groovy
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/InvitationController.groovy
@@ -20,10 +20,22 @@

 package io.kamax.mxisd.controller.v1

-import io.kamax.mxisd.exception.NotImplementedException
+import com.google.gson.Gson
+import io.kamax.matrix.MatrixID
+import io.kamax.mxisd.config.ServerConfig
+import io.kamax.mxisd.controller.v1.io.ThreePidInviteReplyIO
+import io.kamax.mxisd.invitation.IThreePidInvite
+import io.kamax.mxisd.invitation.IThreePidInviteReply
+import io.kamax.mxisd.invitation.InvitationManager
+import io.kamax.mxisd.invitation.ThreePidInvite
+import io.kamax.mxisd.key.KeyManager
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.http.MediaType
+import org.springframework.web.bind.annotation.CrossOrigin
 import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RequestParam
 import org.springframework.web.bind.annotation.RestController

 import javax.servlet.http.HttpServletRequest
@@ -31,15 +43,38 @@ import javax.servlet.http.HttpServletRequest
 import static org.springframework.web.bind.annotation.RequestMethod.POST

@RestController
+@CrossOrigin
+@RequestMapping(path = "/_matrix/identity/api/v1", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
 class InvitationController {

    private Logger log = LoggerFactory.getLogger(InvitationController.class)

-    @RequestMapping(value = "/_matrix/identity/api/v1/store-invite", method = POST)
-    String store(HttpServletRequest request) {
-        log.error("{} was requested but not implemented", request.getRequestURL())
+    @Autowired
+    private InvitationManager mgr

-        throw new NotImplementedException()
+    @Autowired
+    private KeyManager keyMgr
+
+    @Autowired
+    private ServerConfig srvCfg
+
+    private Gson gson = new Gson()
+
+    @RequestMapping(value = "/store-invite", method = POST)
+    String store(
+            HttpServletRequest request,
+            @RequestParam String sender,
+            @RequestParam String medium,
+            @RequestParam String address,
+            @RequestParam("room_id") String roomId) {
+        Map<String, String> parameters = new HashMap<>()
+        for (String key : request.getParameterMap().keySet()) {
+            parameters.put(key, request.getParameter(key));
+        }
+        IThreePidInvite invite = new ThreePidInvite(new MatrixID(sender), medium, address, roomId, parameters)
+        IThreePidInviteReply reply = mgr.storeInvite(invite)
+
+        return gson.toJson(new ThreePidInviteReplyIO(reply, keyMgr.getPublicKeyBase64(keyMgr.getCurrentIndex()), srvCfg.getPublicUrl()))
    }

 }
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/KeyController.groovy
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/KeyController.groovy
@@ -24,18 +24,20 @@ import groovy.json.JsonOutput
 import io.kamax.mxisd.exception.BadRequestException
 import io.kamax.mxisd.exception.NotImplementedException
 import io.kamax.mxisd.key.KeyManager
+import org.apache.commons.lang.StringUtils
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.web.bind.annotation.PathVariable
-import org.springframework.web.bind.annotation.RequestMapping
-import org.springframework.web.bind.annotation.RestController
+import org.springframework.http.MediaType
+import org.springframework.web.bind.annotation.*

 import javax.servlet.http.HttpServletRequest

 import static org.springframework.web.bind.annotation.RequestMethod.GET

@RestController
+@CrossOrigin
+@RequestMapping(path = "/_matrix/identity/api/v1", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
 class KeyController {

    private Logger log = LoggerFactory.getLogger(KeyController.class)
@@ -43,29 +45,34 @@ class KeyController {
    @Autowired
    private KeyManager keyMgr

-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/{keyType}:{keyId}", method = GET)
+    @RequestMapping(value = "/pubkey/{keyType}:{keyId}", method = GET)
    String getKey(@PathVariable String keyType, @PathVariable int keyId) {
        if (!"ed25519".contentEquals(keyType)) {
            throw new BadRequestException("Invalid algorithm: " + keyType)
        }

+        log.info("Key {}:{} was requested", keyType, keyId)
        return JsonOutput.toJson([
                public_key: keyMgr.getPublicKeyBase64(keyId)
        ])
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/ephemeral/isvalid", method = GET)
+    @RequestMapping(value = "/pubkey/ephemeral/isvalid", method = GET)
    String checkEphemeralKeyValidity(HttpServletRequest request) {
        log.error("{} was requested but not implemented", request.getRequestURL())

        throw new NotImplementedException()
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/isvalid", method = GET)
-    String checkKeyValidity(HttpServletRequest request) {
-        log.error("{} was requested but not implemented", request.getRequestURL())
+    @RequestMapping(value = "/pubkey/isvalid", method = GET)
+    String checkKeyValidity(HttpServletRequest request, @RequestParam("public_key") String pubKey) {
+        log.info("Validating public key {}", pubKey)

-        throw new NotImplementedException()
+        // TODO do in manager
+        boolean valid = StringUtils.equals(pubKey, keyMgr.getPublicKeyBase64(keyMgr.getCurrentIndex()))
+        return JsonOutput.toJson(
+                valid: valid
+        )
    }

 }
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/MappingController.groovy
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/MappingController.groovy
@@ -20,17 +20,20 @@

 package io.kamax.mxisd.controller.v1

+import com.google.gson.Gson
+import com.google.gson.JsonObject
 import groovy.json.JsonOutput
 import groovy.json.JsonSlurper
-import io.kamax.mxisd.lookup.BulkLookupRequest
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
+import io.kamax.mxisd.controller.v1.io.SingeLookupReplyJson
+import io.kamax.mxisd.lookup.*
 import io.kamax.mxisd.lookup.strategy.LookupStrategy
 import io.kamax.mxisd.signature.SignatureManager
 import org.apache.commons.lang.StringUtils
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.http.MediaType
+import org.springframework.web.bind.annotation.CrossOrigin
 import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RequestParam
 import org.springframework.web.bind.annotation.RestController
@@ -41,10 +44,13 @@ import static org.springframework.web.bind.annotation.RequestMethod.GET
 import static org.springframework.web.bind.annotation.RequestMethod.POST

@RestController
+@CrossOrigin
+@RequestMapping(path = "/_matrix/identity/api/v1", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
 class MappingController {

    private Logger log = LoggerFactory.getLogger(MappingController.class)
    private JsonSlurper json = new JsonSlurper()
+    private Gson gson = new Gson()

    @Autowired
    private LookupStrategy strategy
@@ -52,38 +58,50 @@ class MappingController {
    @Autowired
    private SignatureManager signMgr

-    @RequestMapping(value = "/_matrix/identity/api/v1/lookup", method = GET)
-    String lookup(HttpServletRequest request, @RequestParam String medium, @RequestParam String address) {
-        String remote = StringUtils.defaultIfBlank(request.getHeader("X-FORWARDED-FOR"), request.getRemoteAddr())
-        log.info("Got request from {}", remote)
+    private void setRequesterInfo(ALookupRequest lookupReq, HttpServletRequest req) {
+        lookupReq.setRequester(req.getRemoteAddr())
+        String xff = req.getHeader("X-FORWARDED-FOR")
+        lookupReq.setRecursive(StringUtils.isNotBlank(xff))
+        if (lookupReq.isRecursive()) {
+            lookupReq.setRecurseHosts(Arrays.asList(xff.split(",")))
+        }

+        lookupReq.setUserAgent(req.getHeader("USER-AGENT"))
+    }
+
+    @RequestMapping(value = "/lookup", method = GET)
+    String lookup(HttpServletRequest request, @RequestParam String medium, @RequestParam String address) {
        SingleLookupRequest lookupRequest = new SingleLookupRequest()
-        lookupRequest.setRequester(remote)
+        setRequesterInfo(lookupRequest, request)
        lookupRequest.setType(medium)
        lookupRequest.setThreePid(address)

-        Optional<?> lookupOpt = strategy.find(lookupRequest)
+        log.info("Got single lookup request from {} with client {} - Is recursive? {}", lookupRequest.getRequester(), lookupRequest.getUserAgent(), lookupRequest.isRecursive())
+
+        Optional<SingleLookupReply> lookupOpt = strategy.find(lookupRequest)
        if (!lookupOpt.isPresent()) {
            log.info("No mapping was found, return empty JSON object")
            return JsonOutput.toJson([])
        }

-        def lookup = lookupOpt.get()
-        if (lookup['signatures'] == null) {
-            log.info("lookup is not signed yet, we sign it")
-            lookup['signatures'] = signMgr.signMessage(JsonOutput.toJson(lookup))
+        SingleLookupReply lookup = lookupOpt.get()
+        if (lookup.isSigned()) {
+            log.info("Lookup is already signed, sending as-is")
+            return lookup.getBody();
+        } else {
+            log.info("Lookup is not signed, signing")
+            JsonObject obj = new Gson().toJsonTree(new SingeLookupReplyJson(lookup)).getAsJsonObject()
+            obj.add("signatures", signMgr.signMessageGson(gson.toJson(obj)))
+
+            return gson.toJson(obj)
+        }
    }

-        return JsonOutput.toJson(lookup)
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/bulk_lookup", method = POST)
+    @RequestMapping(value = "/bulk_lookup", method = POST)
    String bulkLookup(HttpServletRequest request) {
-        String remote = StringUtils.defaultIfBlank(request.getHeader("X-FORWARDED-FOR"), request.getRemoteAddr())
-        log.info("Got request from {}", remote)
-
        BulkLookupRequest lookupRequest = new BulkLookupRequest()
-        lookupRequest.setRequester(remote)
+        setRequesterInfo(lookupRequest, request)
+        log.info("Got single lookup request from {} with client {} - Is recursive? {}", lookupRequest.getRequester(), lookupRequest.getUserAgent(), lookupRequest.isRecursive())

        ClientBulkLookupRequest input = (ClientBulkLookupRequest) json.parseText(request.getInputStream().getText())
        List<ThreePidMapping> mappings = new ArrayList<>()
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy
@@ -25,7 +25,7 @@ import com.google.gson.JsonObject
 import io.kamax.mxisd.controller.v1.io.SessionEmailTokenRequestJson
 import io.kamax.mxisd.controller.v1.io.SessionPhoneTokenRequestJson
 import io.kamax.mxisd.exception.BadRequestException
-import io.kamax.mxisd.lookup.ThreePid
+import io.kamax.mxisd.lookup.ThreePidValidation
 import io.kamax.mxisd.mapping.MappingManager
 import org.apache.commons.io.IOUtils
 import org.apache.commons.lang.StringUtils
@@ -33,16 +33,16 @@ import org.apache.http.HttpStatus
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
 import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.web.bind.annotation.PathVariable
-import org.springframework.web.bind.annotation.RequestMapping
-import org.springframework.web.bind.annotation.RequestParam
-import org.springframework.web.bind.annotation.RestController
+import org.springframework.http.MediaType
+import org.springframework.web.bind.annotation.*

 import javax.servlet.http.HttpServletRequest
 import javax.servlet.http.HttpServletResponse
 import java.nio.charset.StandardCharsets

@RestController
+@CrossOrigin
+@RequestMapping(path = "/_matrix/identity/api/v1", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
 class SessionController {

    @Autowired
@@ -56,7 +56,7 @@ class SessionController {
        gson.fromJson(new InputStreamReader(req.getInputStream(), StandardCharsets.UTF_8), obj)
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/validate/{medium}/requestToken")
+    @RequestMapping(value = "/validate/{medium}/requestToken")
    String init(HttpServletRequest request, HttpServletResponse response, @PathVariable String medium) {
        log.info("Requested: {}", request.getRequestURL(), request.getQueryString())

@@ -77,7 +77,7 @@ class SessionController {
        return gson.toJson(obj)
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/validate/{medium}/submitToken")
+    @RequestMapping(value = "/validate/{medium}/submitToken")
    String validate(HttpServletRequest request,
                    @RequestParam String sid,
                    @RequestParam("client_secret") String secret, @RequestParam String token) {
@@ -88,15 +88,15 @@ class SessionController {
        return "{}"
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/3pid/getValidated3pid")
+    @RequestMapping(value = "/3pid/getValidated3pid")
    String check(HttpServletRequest request, HttpServletResponse response,
                 @RequestParam String sid, @RequestParam("client_secret") String secret) {
        log.info("Requested: {}?{}", request.getRequestURL(), request.getQueryString())

-        Optional<ThreePid> result = mgr.getValidated(sid, secret)
+        Optional<ThreePidValidation> result = mgr.getValidated(sid, secret)
        if (result.isPresent()) {
            log.info("requested session was validated")
-            ThreePid pid = result.get()
+            ThreePidValidation pid = result.get()

            JsonObject obj = new JsonObject()
            obj.addProperty("medium", pid.getMedium())
@@ -115,7 +115,7 @@ class SessionController {
        }
    }

-    @RequestMapping(value = "/_matrix/identity/api/v1/3pid/bind")
+    @RequestMapping(value = "/3pid/bind")
    String bind(HttpServletRequest request, HttpServletResponse response,
                @RequestParam String sid, @RequestParam("client_secret") String secret, @RequestParam String mxid) {
        String data = IOUtils.toString(request.getReader())
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/StatusController.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/StatusController.java
@@ -0,0 +1,39 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller.v1;
+
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@CrossOrigin
+@RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
+public class StatusController {
+
+    @RequestMapping(value = "/_matrix/identity/status")
+    public String getStatus() {
+        // TODO link to backend
+        return "{\"status\":{\"health\":\"OK\"}}";
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/GenericTokenRequestJson.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/GenericTokenRequestJson.java
@@ -1,3 +1,23 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.controller.v1.io;

 import io.kamax.mxisd.mapping.MappingSession;
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionEmailTokenRequestJson.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionEmailTokenRequestJson.java
@@ -1,3 +1,23 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.controller.v1.io;

 public class SessionEmailTokenRequestJson extends GenericTokenRequestJson {
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java
@@ -1,3 +1,23 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.controller.v1.io;

 import com.google.i18n.phonenumbers.NumberParseException;
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/SingeLookupReplyJson.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/SingeLookupReplyJson.java
@@ -0,0 +1,75 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller.v1.io;
+
+import io.kamax.mxisd.lookup.SingleLookupReply;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class SingeLookupReplyJson {
+
+    private String address;
+    private String medium;
+    private String mxid;
+    private long not_after;
+    private long not_before;
+    private long ts;
+    private Map<String, Map<String, String>> signatures = new HashMap<>();
+
+    public SingeLookupReplyJson(SingleLookupReply reply) {
+        this.address = reply.getRequest().getThreePid();
+        this.medium = reply.getRequest().getType();
+        this.mxid = reply.getMxid().getId();
+        this.not_after = reply.getNotAfter().toEpochMilli();
+        this.not_before = reply.getNotBefore().toEpochMilli();
+        this.ts = reply.getTimestamp().toEpochMilli();
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    public String getMedium() {
+        return medium;
+    }
+
+    public String getMxid() {
+        return mxid;
+    }
+
+    public long getNot_after() {
+        return not_after;
+    }
+
+    public long getNot_before() {
+        return not_before;
+    }
+
+    public long getTs() {
+        return ts;
+    }
+
+    public boolean isSigned() {
+        return signatures != null && !signatures.isEmpty();
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/ThreePidInviteReplyIO.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/ThreePidInviteReplyIO.java
@@ -0,0 +1,70 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.controller.v1.io;
+
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+
+import java.util.Collections;
+import java.util.List;
+
+public class ThreePidInviteReplyIO {
+
+    private String token;
+    private List<Key> public_keys;
+    private String display_name;
+
+    public ThreePidInviteReplyIO(IThreePidInviteReply reply, String pubKey, String publicUrl) {
+        this.token = reply.getToken();
+        this.public_keys = Collections.singletonList(new Key(pubKey, publicUrl));
+        this.display_name = reply.getDisplayName();
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public List<Key> getPublic_keys() {
+        return public_keys;
+    }
+
+    public String getDisplay_name() {
+        return display_name;
+    }
+
+    public class Key {
+        private String key_validity_url;
+        private String public_key;
+
+        public Key(String key, String publicUrl) {
+            this.key_validity_url = publicUrl + "/_matrix/identity/api/v1/pubkey/isvalid";
+            this.public_key = key;
+        }
+
+        public String getKey_validity_url() {
+            return key_validity_url;
+        }
+
+        public String getPublic_key() {
+            return public_key;
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/exception/ConfigurationException.java
+++ b/src/main/groovy/io/kamax/mxisd/exception/ConfigurationException.java
@@ -0,0 +1,47 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.exception;
+
+import java.util.Optional;
+
+public class ConfigurationException extends RuntimeException {
+
+    private String key;
+    private String detailedMsg;
+
+    public ConfigurationException(String key) {
+        super("Invalid or empty value for configuration key " + key);
+    }
+
+    public ConfigurationException(Throwable t) {
+        super(t.getMessage(), t);
+    }
+
+    public ConfigurationException(String key, String detailedMsg) {
+        this(key);
+        this.detailedMsg = detailedMsg;
+    }
+
+    public Optional<String> getDetailedMessage() {
+        return Optional.ofNullable(detailedMsg);
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/exception/MappingAlreadyExistsException.java
+++ b/src/main/groovy/io/kamax/mxisd/exception/MappingAlreadyExistsException.java
@@ -0,0 +1,29 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.exception;
+
+public class MappingAlreadyExistsException extends RuntimeException {
+
+    public MappingAlreadyExistsException() {
+        super("A mapping already exists for this 3PID");
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/IThreePidInvite.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/IThreePidInvite.java
@@ -0,0 +1,39 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation;
+
+import io.kamax.matrix._MatrixID;
+
+import java.util.Map;
+
+public interface IThreePidInvite {
+
+    _MatrixID getSender();
+
+    String getMedium();
+
+    String getAddress();
+
+    String getRoomId();
+
+    Map<String, String> getProperties();
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/IThreePidInviteReply.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/IThreePidInviteReply.java
@@ -0,0 +1,33 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation;
+
+public interface IThreePidInviteReply {
+
+    String getId();
+
+    IThreePidInvite getInvite();
+
+    String getToken();
+
+    String getDisplayName();
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/InvitationManager.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/InvitationManager.java
@@ -0,0 +1,325 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation;
+
+import com.google.gson.Gson;
+import io.kamax.matrix.MatrixID;
+import io.kamax.mxisd.exception.BadRequestException;
+import io.kamax.mxisd.exception.MappingAlreadyExistsException;
+import io.kamax.mxisd.invitation.sender.IInviteSender;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import io.kamax.mxisd.lookup.strategy.LookupStrategy;
+import io.kamax.mxisd.signature.SignatureManager;
+import io.kamax.mxisd.storage.IStorage;
+import io.kamax.mxisd.storage.ormlite.ThreePidInviteIO;
+import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang.RandomStringUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.json.JSONArray;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import org.xbill.DNS.*;
+
+import javax.annotation.PostConstruct;
+import javax.annotation.PreDestroy;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ForkJoinPool;
+import java.util.concurrent.TimeUnit;
+
+@Component
+public class InvitationManager {
+
+    private Logger log = LoggerFactory.getLogger(InvitationManager.class);
+
+    private Map<String, IThreePidInviteReply> invitations = new ConcurrentHashMap<>();
+
+    @Autowired
+    private IStorage storage;
+
+    @Autowired
+    private LookupStrategy lookupMgr;
+
+    @Autowired
+    private SignatureManager signMgr;
+
+    private Map<String, IInviteSender> senders;
+
+    private CloseableHttpClient client;
+    private Gson gson;
+    private Timer refreshTimer;
+
+    private String getId(IThreePidInvite invite) {
+        return invite.getSender().getDomain() + invite.getMedium() + invite.getAddress();
+    }
+
+    @PostConstruct
+    private void postConstruct() {
+        gson = new Gson();
+
+        log.info("Loading saved invites");
+        Collection<ThreePidInviteIO> ioList = storage.getInvites();
+        ioList.forEach(io -> {
+            log.info("Processing invite {}", gson.toJson(io));
+            ThreePidInvite invite = new ThreePidInvite(
+                    new MatrixID(io.getSender()),
+                    io.getMedium(),
+                    io.getAddress(),
+                    io.getRoomId(),
+                    io.getProperties()
+            );
+
+            ThreePidInviteReply reply = new ThreePidInviteReply(getId(invite), invite, io.getToken(), "");
+            invitations.put(reply.getId(), reply);
+        });
+
+        // FIXME export such madness into matrix-java-sdk with a nice wrapper to talk to a homeserver
+        try {
+            SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(new TrustSelfSignedStrategy()).build();
+            HostnameVerifier hostnameVerifier = new NoopHostnameVerifier();
+            SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
+            client = HttpClients.custom().setSSLSocketFactory(sslSocketFactory).build();
+        } catch (Exception e) {
+            // FIXME do better...
+            throw new RuntimeException(e);
+        }
+
+        log.info("Setting up invitation mapping refresh timer");
+        refreshTimer = new Timer();
+        refreshTimer.scheduleAtFixedRate(new TimerTask() {
+            @Override
+            public void run() {
+                try {
+                    lookupMappingsForInvites();
+                } catch (Throwable t) {
+                    log.error("Error when running background mapping refresh", t);
+                }
+            }
+        }, 5000L, TimeUnit.MILLISECONDS.convert(1, TimeUnit.MINUTES)); // FIXME make configurable
+    }
+
+    @PreDestroy
+    private void preDestroy() {
+        ForkJoinPool.commonPool().awaitQuiescence(1, TimeUnit.MINUTES);
+    }
+
+    private String getIdForLog(IThreePidInviteReply reply) {
+        return reply.getInvite().getSender().getId() + ":" + reply.getInvite().getRoomId() + ":" + reply.getInvite().getMedium() + ":" + reply.getInvite().getAddress();
+    }
+
+    String getSrvRecordName(String domain) {
+        return "_matrix._tcp." + domain;
+    }
+
+    // TODO use caching mechanism
+    // TODO export in matrix-java-sdk
+    String findHomeserverForDomain(String domain) {
+        log.debug("Performing SRV lookup for {}", domain);
+        String lookupDns = getSrvRecordName(domain);
+        log.info("Lookup name: {}", lookupDns);
+
+        try {
+            List<SRVRecord> srvRecords = new ArrayList<>();
+            Record[] rawRecords = new Lookup(lookupDns, Type.SRV).run();
+            if (rawRecords != null && rawRecords.length > 0) {
+                for (Record record : rawRecords) {
+                    if (Type.SRV == record.getType()) {
+                        srvRecords.add((SRVRecord) record);
+                    } else {
+                        log.info("Got non-SRV record: {}", record.toString());
+                    }
+                }
+
+                srvRecords.sort(Comparator.comparingInt(SRVRecord::getPriority));
+                for (SRVRecord record : srvRecords) {
+                    log.info("Found SRV record: {}", record.toString());
+                    return "https://" + record.getTarget().toString(true) + ":" + record.getPort();
+                }
+            } else {
+                log.info("No SRV record for {}", lookupDns);
+            }
+        } catch (TextParseException e) {
+            log.warn("Unable to perform DNS SRV query for {}: {}", lookupDns, e.getMessage());
+        }
+
+        log.info("Performing basic lookup using domain name {}", domain);
+        return "https://" + domain + ":8448";
+    }
+
+    @Autowired
+    public InvitationManager(List<IInviteSender> senderList) {
+        senders = new HashMap<>();
+        senderList.forEach(sender -> senders.put(sender.getMedium(), sender));
+    }
+
+    public synchronized IThreePidInviteReply storeInvite(IThreePidInvite invitation) { // TODO better sync
+        IInviteSender sender = senders.get(invitation.getMedium());
+        if (sender == null) {
+            throw new BadRequestException("Medium type " + invitation.getMedium() + " is not supported");
+        }
+
+        String invId = getId(invitation);
+        log.info("Handling invite for {}:{} from {} in room {}", invitation.getMedium(), invitation.getAddress(), invitation.getSender(), invitation.getRoomId());
+        if (invitations.containsKey(invId)) { // FIXME we need to lookup using the HS domain too!!
+            log.info("Invite is already pending for {}:{}, returning data", invitation.getMedium(), invitation.getAddress());
+            return invitations.get(invId);
+        }
+
+        Optional<?> result = lookupMgr.find(invitation.getMedium(), invitation.getAddress(), true);
+        if (result.isPresent()) {
+            log.info("Mapping for {}:{} already exists, refusing to store invite", invitation.getMedium(), invitation.getAddress());
+            throw new MappingAlreadyExistsException();
+        }
+
+        String token = RandomStringUtils.randomAlphanumeric(64);
+        String displayName = invitation.getAddress().substring(0, 3) + "...";
+
+        IThreePidInviteReply reply = new ThreePidInviteReply(invId, invitation, token, displayName);
+
+        log.info("Performing invite to {}:{}", invitation.getMedium(), invitation.getAddress());
+        sender.send(reply);
+
+        log.info("Storing invite under ID {}", invId);
+        storage.insertInvite(reply);
+        invitations.put(invId, reply);
+        log.info("A new invite has been created for {}:{} on HS {}", invitation.getMedium(), invitation.getAddress(), invitation.getSender().getDomain());
+
+        return reply;
+    }
+
+    public void lookupMappingsForInvites() {
+        log.info("Checking for existing mapping for pending invites");
+        for (IThreePidInviteReply reply : invitations.values()) {
+            log.info("Processing invite {}", getIdForLog(reply));
+            ForkJoinPool.commonPool().submit(new MappingChecker(reply));
+        }
+    }
+
+    public void publishMappingIfInvited(ThreePidMapping threePid) {
+        log.info("Looking up possible pending invites for {}:{}", threePid.getMedium(), threePid.getValue());
+        for (IThreePidInviteReply reply : invitations.values()) {
+            if (StringUtils.equals(reply.getInvite().getMedium(), threePid.getMedium()) && StringUtils.equals(reply.getInvite().getAddress(), threePid.getValue())) {
+                log.info("{}:{} has an invite pending on HS {}, publishing mapping", threePid.getMedium(), threePid.getValue(), reply.getInvite().getSender().getDomain());
+                publishMapping(reply, threePid.getMxid());
+            }
+        }
+    }
+
+    private void publishMapping(IThreePidInviteReply reply, String mxid) {
+        String medium = reply.getInvite().getMedium();
+        String address = reply.getInvite().getAddress();
+        String domain = reply.getInvite().getSender().getDomain();
+        log.info("Discovering HS for domain {}", domain);
+        String hsUrlOpt = findHomeserverForDomain(domain);
+
+        // TODO this is needed as this will block if called during authentication cycle due to synapse implementation
+        new Thread(() -> { // FIXME need to make this retry-able and within a general background working pool
+            HttpPost req = new HttpPost(hsUrlOpt + "/_matrix/federation/v1/3pid/onbind");
+            // Expected body: https://matrix.to/#/!HUeDbmFUsWAhxHHvFG:matrix.org/$150469846739DCLWc:matrix.trancendances.fr
+            JSONObject obj = new JSONObject(); // TODO use Gson instead
+            obj.put("mxid", mxid);
+            obj.put("token", reply.getToken());
+            obj.put("signatures", signMgr.signMessageJson(obj.toString()));
+
+            JSONObject objUp = new JSONObject();
+            objUp.put("mxid", mxid);
+            objUp.put("medium", medium);
+            objUp.put("address", address);
+            objUp.put("sender", reply.getInvite().getSender().getId());
+            objUp.put("room_id", reply.getInvite().getRoomId());
+            objUp.put("signed", obj);
+
+            JSONObject content = new JSONObject(); // TODO use Gson instead
+            JSONArray invites = new JSONArray();
+            invites.put(objUp);
+            content.put("invites", invites);
+            content.put("medium", medium);
+            content.put("address", address);
+            content.put("mxid", mxid);
+
+            content.put("signatures", signMgr.signMessageJson(content.toString()));
+
+            StringEntity entity = new StringEntity(content.toString(), StandardCharsets.UTF_8);
+            entity.setContentType("application/json");
+            req.setEntity(entity);
+            try {
+                log.info("Posting onBind event to {}", req.getURI());
+                CloseableHttpResponse response = client.execute(req);
+                int statusCode = response.getStatusLine().getStatusCode();
+                log.info("Answer code: {}", statusCode);
+                if (statusCode >= 300) {
+                    log.warn("Answer body: {}", IOUtils.toString(response.getEntity().getContent(), StandardCharsets.UTF_8));
+                } else {
+                    invitations.remove(getId(reply.getInvite()));
+                    storage.deleteInvite(reply.getId());
+                    log.info("Removed invite from internal store");
+                }
+                response.close();
+            } catch (IOException e) {
+                log.warn("Unable to tell HS {} about invite being mapped", domain, e);
+            }
+        }).start();
+    }
+
+    private class MappingChecker implements Runnable {
+
+        private IThreePidInviteReply reply;
+
+        public MappingChecker(IThreePidInviteReply reply) {
+            this.reply = reply;
+        }
+
+        @Override
+        public void run() {
+            try {
+                log.info("Searching for mapping created since invite {} was created", getIdForLog(reply));
+                Optional<SingleLookupReply> result = lookupMgr.find(reply.getInvite().getMedium(), reply.getInvite().getAddress(), true);
+                if (result.isPresent()) {
+                    SingleLookupReply lookup = result.get();
+                    log.info("Found mapping for pending invite {}", getIdForLog(reply));
+                    publishMapping(reply, lookup.getMxid().getId());
+                } else {
+                    log.info("No mapping for pending invite {}", getIdForLog(reply));
+                }
+            } catch (Throwable t) {
+                log.error("Unable to process invite", t);
+            }
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/ThreePidInvite.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/ThreePidInvite.java
@@ -0,0 +1,74 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation;
+
+import io.kamax.matrix._MatrixID;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class ThreePidInvite implements IThreePidInvite {
+
+    private _MatrixID sender;
+    private String medium;
+    private String address;
+    private String roomId;
+    private Map<String, String> properties;
+
+    public ThreePidInvite(_MatrixID sender, String medium, String address, String roomId) {
+        this.sender = sender;
+        this.medium = medium;
+        this.address = address;
+        this.roomId = roomId;
+        this.properties = new HashMap<>();
+    }
+
+    public ThreePidInvite(_MatrixID sender, String medium, String address, String roomId, Map<String, String> properties) {
+        this(sender, medium, address, roomId);
+        this.properties = properties;
+    }
+
+    @Override
+    public _MatrixID getSender() {
+        return sender;
+    }
+
+    @Override
+    public String getMedium() {
+        return medium;
+    }
+
+    @Override
+    public String getAddress() {
+        return address;
+    }
+
+    @Override
+    public String getRoomId() {
+        return roomId;
+    }
+
+    @Override
+    public Map<String, String> getProperties() {
+        return properties;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/ThreePidInviteReply.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/ThreePidInviteReply.java
@@ -0,0 +1,57 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation;
+
+public class ThreePidInviteReply implements IThreePidInviteReply {
+
+    private String id;
+    private IThreePidInvite invite;
+    private String token;
+    private String displayName;
+
+    public ThreePidInviteReply(String id, IThreePidInvite invite, String token, String displayName) {
+        this.id = id;
+        this.invite = invite;
+        this.token = token;
+        this.displayName = displayName;
+    }
+
+    @Override
+    public String getId() {
+        return id;
+    }
+
+    @Override
+    public IThreePidInvite getInvite() {
+        return invite;
+    }
+
+    @Override
+    public String getToken() {
+        return token;
+    }
+
+    @Override
+    public String getDisplayName() {
+        return displayName;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/sender/EmailInviteSender.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/sender/EmailInviteSender.java
@@ -0,0 +1,138 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation.sender;
+
+import com.sun.mail.smtp.SMTPTransport;
+import io.kamax.matrix.ThreePidMedium;
+import io.kamax.mxisd.config.ServerConfig;
+import io.kamax.mxisd.config.invite.sender.EmailSenderConfig;
+import io.kamax.mxisd.exception.ConfigurationException;
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang.WordUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.stereotype.Component;
+
+import javax.annotation.PostConstruct;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Session;
+import javax.mail.internet.InternetAddress;
+import javax.mail.internet.MimeMessage;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+
+@Component
+public class EmailInviteSender implements IInviteSender {
+
+    private Logger log = LoggerFactory.getLogger(EmailInviteSender.class);
+
+    @Autowired
+    private EmailSenderConfig cfg;
+
+    @Autowired
+    private ServerConfig srvCfg;
+
+    @Autowired
+    private ApplicationContext app;
+
+    private Session session;
+    private InternetAddress sender;
+
+    @PostConstruct
+    private void postConstruct() {
+        try {
+            session = Session.getInstance(System.getProperties());
+            sender = new InternetAddress(cfg.getEmail(), cfg.getName());
+        } catch (UnsupportedEncodingException e) {
+            // What are we supposed to do with this?!
+            throw new ConfigurationException(e);
+        }
+    }
+
+    @Override
+    public String getMedium() {
+        return ThreePidMedium.Email.getId();
+    }
+
+    @Override
+    public void send(IThreePidInviteReply invite) {
+        if (!ThreePidMedium.Email.is(invite.getInvite().getMedium())) {
+            throw new IllegalArgumentException(invite.getInvite().getMedium() + " is not a supported 3PID type");
+        }
+
+        try {
+            String domainPretty = WordUtils.capitalizeFully(srvCfg.getName());
+            String senderName = invite.getInvite().getProperties().getOrDefault("sender_display_name", "");
+            String senderNameOrId = StringUtils.defaultIfBlank(senderName, invite.getInvite().getSender().getId());
+            String roomName = invite.getInvite().getProperties().getOrDefault("room_name", "");
+            String roomNameOrId = StringUtils.defaultIfBlank(roomName, invite.getInvite().getRoomId());
+
+            String templateBody = IOUtils.toString(
+                    StringUtils.startsWith(cfg.getTemplate(), "classpath:") ?
+                            app.getResource(cfg.getTemplate()).getInputStream() : new FileInputStream(cfg.getTemplate()),
+                    StandardCharsets.UTF_8);
+            templateBody = templateBody.replace("%DOMAIN%", srvCfg.getName());
+            templateBody = templateBody.replace("%DOMAIN_PRETTY%", domainPretty);
+            templateBody = templateBody.replace("%FROM_EMAIL%", cfg.getEmail());
+            templateBody = templateBody.replace("%FROM_NAME%", cfg.getName());
+            templateBody = templateBody.replace("%SENDER_ID%", invite.getInvite().getSender().getId());
+            templateBody = templateBody.replace("%SENDER_NAME%", senderName);
+            templateBody = templateBody.replace("%SENDER_NAME_OR_ID%", senderNameOrId);
+            templateBody = templateBody.replace("%INVITE_MEDIUM%", invite.getInvite().getMedium());
+            templateBody = templateBody.replace("%INVITE_ADDRESS%", invite.getInvite().getAddress());
+            templateBody = templateBody.replace("%ROOM_ID%", invite.getInvite().getRoomId());
+            templateBody = templateBody.replace("%ROOM_NAME%", roomName);
+            templateBody = templateBody.replace("%ROOM_NAME_OR_ID%", roomNameOrId);
+
+            MimeMessage msg = new MimeMessage(session, IOUtils.toInputStream(templateBody, StandardCharsets.UTF_8));
+            msg.setHeader("X-Mailer", "mxisd"); // TODO set version
+            msg.setSentDate(new Date());
+            msg.setFrom(sender);
+            msg.setRecipients(Message.RecipientType.TO, invite.getInvite().getAddress());
+            msg.saveChanges();
+
+            log.info("Sending invite to {} via SMTP using {}:{}", invite.getInvite().getAddress(), cfg.getHost(), cfg.getPort());
+            SMTPTransport transport = (SMTPTransport) session.getTransport("smtp");
+            transport.setStartTLS(cfg.getTls() > 0);
+            transport.setRequireStartTLS(cfg.getTls() > 1);
+
+            log.info("Connecting to {}:{}", cfg.getHost(), cfg.getPort());
+            transport.connect(cfg.getHost(), cfg.getPort(), cfg.getLogin(), cfg.getPassword());
+            try {
+                transport.sendMessage(msg, InternetAddress.parse(invite.getInvite().getAddress()));
+                log.info("Invite to {} was sent", invite.getInvite().getAddress());
+            } finally {
+                transport.close();
+            }
+        } catch (IOException | MessagingException e) {
+            throw new RuntimeException("Unable to send e-mail invite to " + invite.getInvite().getAddress(), e);
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/invitation/sender/IInviteSender.java
+++ b/src/main/groovy/io/kamax/mxisd/invitation/sender/IInviteSender.java
@@ -0,0 +1,31 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.invitation.sender;
+
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+
+public interface IInviteSender {
+
+    String getMedium();
+
+    void send(IThreePidInviteReply invite);
+
+}
--- a/src/main/groovy/io/kamax/mxisd/lookup/ALookupRequest.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/ALookupRequest.java
@@ -20,9 +20,23 @@

 package io.kamax.mxisd.lookup;

+import java.util.List;
+
 public abstract class ALookupRequest {

+    private String id;
    private String requester;
+    private String userAgent;
+    private boolean isRecursive;
+    private List<String> recurseHosts;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }

    public String getRequester() {
        return requester;
@@ -32,4 +46,28 @@ public abstract class ALookupRequest {
        this.requester = requester;
    }

+    public String getUserAgent() {
+        return userAgent;
+    }
+
+    public void setUserAgent(String userAgent) {
+        this.userAgent = userAgent;
+    }
+
+    public boolean isRecursive() {
+        return isRecursive;
+    }
+
+    public void setRecursive(boolean recursive) {
+        isRecursive = recursive;
+    }
+
+    public List<String> getRecurseHosts() {
+        return recurseHosts;
+    }
+
+    public void setRecurseHosts(List<String> recurseHosts) {
+        this.recurseHosts = recurseHosts;
+    }
+
 }
--- a/src/main/groovy/io/kamax/mxisd/lookup/SingleLookupReply.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/SingleLookupReply.java
@@ -0,0 +1,116 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.lookup;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonSyntaxException;
+import io.kamax.matrix.MatrixID;
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.controller.v1.io.SingeLookupReplyJson;
+
+import java.time.Instant;
+
+public class SingleLookupReply {
+
+    private static Gson gson = new Gson();
+
+    private boolean isRecursive;
+    private boolean isSigned;
+    private String body;
+    private SingleLookupRequest request;
+    private _MatrixID mxid;
+    private Instant notBefore;
+    private Instant notAfter;
+    private Instant timestamp;
+
+    public static SingleLookupReply fromRecursive(SingleLookupRequest request, String body) {
+        SingleLookupReply reply = new SingleLookupReply();
+        reply.isRecursive = true;
+        reply.request = request;
+        reply.body = body;
+
+        try {
+            SingeLookupReplyJson json = gson.fromJson(body, SingeLookupReplyJson.class);
+            reply.mxid = new MatrixID(json.getMxid());
+            reply.notAfter = Instant.ofEpochMilli(json.getNot_after());
+            reply.notBefore = Instant.ofEpochMilli(json.getNot_before());
+            reply.timestamp = Instant.ofEpochMilli(json.getTs());
+            reply.isSigned = json.isSigned();
+        } catch (JsonSyntaxException e) {
+            // stub - we only want to try, nothing more
+        }
+
+        return reply;
+    }
+
+    private SingleLookupReply() {
+        // stub
+    }
+
+    public SingleLookupReply(SingleLookupRequest request, String mxid) {
+        this(request, new MatrixID(mxid));
+    }
+
+    public SingleLookupReply(SingleLookupRequest request, _MatrixID mxid) {
+        this(request, mxid, Instant.now(), Instant.ofEpochMilli(0), Instant.ofEpochMilli(253402300799000L));
+    }
+
+    public SingleLookupReply(SingleLookupRequest request, _MatrixID mxid, Instant timestamp, Instant notBefore, Instant notAfter) {
+        this.request = request;
+        this.mxid = mxid;
+        this.timestamp = timestamp;
+        this.notBefore = notBefore;
+        this.notAfter = notAfter;
+    }
+
+    public boolean isRecursive() {
+        return isRecursive;
+    }
+
+    public boolean isSigned() {
+        return isSigned;
+    }
+
+    public String getBody() {
+        return body;
+    }
+
+    public SingleLookupRequest getRequest() {
+        return request;
+    }
+
+    public _MatrixID getMxid() {
+        return mxid;
+    }
+
+    public Instant getNotBefore() {
+        return notBefore;
+    }
+
+    public Instant getNotAfter() {
+        return notAfter;
+    }
+
+    public Instant getTimestamp() {
+        return timestamp;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/lookup/ThreePid.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/ThreePid.java
@@ -1,29 +0,0 @@
-package io.kamax.mxisd.lookup;
-
-import java.time.Instant;
-
-public class ThreePid {
-
-    private String medium;
-    private String address;
-    private Instant validation;
-
-    public ThreePid(String medium, String address, Instant validation) {
-        this.medium = medium;
-        this.address = address;
-        this.validation = validation;
-    }
-
-    public String getMedium() {
-        return medium;
-    }
-
-    public String getAddress() {
-        return address;
-    }
-
-    public Instant getValidation() {
-        return validation;
-    }
-
-}
--- a/src/main/groovy/io/kamax/mxisd/lookup/ThreePidMapping.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/ThreePidMapping.java
@@ -21,6 +21,7 @@
 package io.kamax.mxisd.lookup;

 import groovy.json.JsonOutput;
+import io.kamax.mxisd.ThreePid;

 public class ThreePidMapping {

@@ -28,6 +29,20 @@ public class ThreePidMapping {
    private String value;
    private String mxid;

+    public ThreePidMapping() {
+        // stub
+    }
+
+    public ThreePidMapping(ThreePid threePid, String mxid) {
+        this(threePid.getMedium(), threePid.getAddress(), mxid);
+    }
+
+    public ThreePidMapping(String medium, String value, String mxid) {
+        setMedium(medium);
+        setValue(value);
+        setMxid(mxid);
+    }
+
    public String getMedium() {
        return medium;
    }
--- a/src/main/groovy/io/kamax/mxisd/lookup/ThreePidValidation.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/ThreePidValidation.java
@@ -0,0 +1,40 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.lookup;
+
+import io.kamax.mxisd.ThreePid;
+
+import java.time.Instant;
+
+public class ThreePidValidation extends ThreePid {
+
+    private Instant validation;
+
+    public ThreePidValidation(String medium, String address, Instant validation) {
+        super(medium, address);
+        this.validation = validation;
+    }
+
+    public Instant getValidation() {
+        return validation;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/lookup/fetcher/IBridgeFetcher.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/fetcher/IBridgeFetcher.groovy
@@ -20,12 +20,13 @@

 package io.kamax.mxisd.lookup.fetcher

+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping

 interface IBridgeFetcher {

-    Optional<?> find(SingleLookupRequest request)
+    Optional<SingleLookupReply> find(SingleLookupRequest request)

    List<ThreePidMapping> populate(List<ThreePidMapping> mappings)

--- a/src/main/groovy/io/kamax/mxisd/lookup/fetcher/IRemoteIdentityServerFetcher.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/fetcher/IRemoteIdentityServerFetcher.groovy
@@ -20,13 +20,15 @@

 package io.kamax.mxisd.lookup.fetcher

+import io.kamax.mxisd.lookup.SingleLookupReply
+import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping

 interface IRemoteIdentityServerFetcher {

    boolean isUsable(String remote)

-    Optional<?> find(String remote, String type, String threePid)
+    Optional<SingleLookupReply> find(String remote, SingleLookupRequest request)

    List<ThreePidMapping> find(String remote, List<ThreePidMapping> mappings)

--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/BridgeFetcher.java
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/BridgeFetcher.java
@@ -21,6 +21,7 @@
 package io.kamax.mxisd.lookup.provider;

 import io.kamax.mxisd.config.RecursiveLookupBridgeConfig;
+import io.kamax.mxisd.lookup.SingleLookupReply;
 import io.kamax.mxisd.lookup.SingleLookupRequest;
 import io.kamax.mxisd.lookup.ThreePidMapping;
 import io.kamax.mxisd.lookup.fetcher.IBridgeFetcher;
@@ -46,16 +47,16 @@ public class BridgeFetcher implements IBridgeFetcher {
    private RemoteIdentityServerFetcher fetcher;

    @Override
-    public Optional<?> find(SingleLookupRequest request) {
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
        Optional<String> mediumUrl = Optional.ofNullable(cfg.getMappings().get(request.getType()));
        if (mediumUrl.isPresent() && !StringUtils.isBlank(mediumUrl.get())) {
            log.info("Using specific medium bridge lookup URL {}", mediumUrl.get());

-            return fetcher.find(mediumUrl.get(), request.getType(), request.getThreePid());
+            return fetcher.find(mediumUrl.get(), request);
        } else if (!StringUtils.isBlank(cfg.getServer())) {
            log.info("Using generic bridge lookup URL {}", cfg.getServer());

-            return fetcher.find(cfg.getServer(), request.getType(), request.getThreePid());
+            return fetcher.find(cfg.getServer(), request);
        } else {
            log.info("No bridge lookup URL found/configured, skipping");

--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/DnsLookupProvider.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/DnsLookupProvider.groovy
@@ -21,6 +21,7 @@
 package io.kamax.mxisd.lookup.provider

 import io.kamax.mxisd.config.ServerConfig
+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping
 import io.kamax.mxisd.lookup.fetcher.IRemoteIdentityServerFetcher
@@ -124,7 +125,7 @@ class DnsLookupProvider implements IThreePidProvider {
    }

    @Override
-    Optional<?> find(SingleLookupRequest request) {
+    Optional<SingleLookupReply> find(SingleLookupRequest request) {
        if (!StringUtils.equals("email", request.getType())) { // TODO use enum
            log.info("Skipping unsupported type {} for {}", request.getType(), request.getThreePid())
            return Optional.empty()
@@ -137,7 +138,7 @@ class DnsLookupProvider implements IThreePidProvider {
        Optional<String> baseUrl = findIdentityServerForDomain(domain)

        if (baseUrl.isPresent()) {
-            return fetcher.find(baseUrl.get(), request.getType().toString(), request.getThreePid())
+            return fetcher.find(baseUrl.get(), request)
        }

        return Optional.empty()
--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/ForwarderProvider.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/ForwarderProvider.groovy
@@ -21,6 +21,7 @@
 package io.kamax.mxisd.lookup.provider

 import io.kamax.mxisd.config.ForwardConfig
+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping
 import io.kamax.mxisd.lookup.fetcher.IRemoteIdentityServerFetcher
@@ -56,9 +57,9 @@ class ForwarderProvider implements IThreePidProvider {
    }

    @Override
-    Optional<?> find(SingleLookupRequest request) {
+    Optional<SingleLookupReply> find(SingleLookupRequest request) {
        for (String root : cfg.getServers()) {
-            Optional<?> answer = fetcher.find(root, request.getType(), request.getThreePid())
+            Optional<SingleLookupReply> answer = fetcher.find(root, request)
            if (answer.isPresent()) {
                return answer
            }
--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/GoogleFirebaseProvider.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/GoogleFirebaseProvider.groovy
@@ -0,0 +1,190 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.lookup.provider
+
+import com.google.firebase.FirebaseApp
+import com.google.firebase.FirebaseOptions
+import com.google.firebase.auth.FirebaseAuth
+import com.google.firebase.auth.FirebaseCredential
+import com.google.firebase.auth.FirebaseCredentials
+import com.google.firebase.auth.UserRecord
+import com.google.firebase.internal.NonNull
+import com.google.firebase.tasks.OnFailureListener
+import com.google.firebase.tasks.OnSuccessListener
+import io.kamax.matrix.ThreePidMedium
+import io.kamax.mxisd.lookup.SingleLookupReply
+import io.kamax.mxisd.lookup.SingleLookupRequest
+import io.kamax.mxisd.lookup.ThreePidMapping
+import org.apache.commons.lang.StringUtils
+import org.slf4j.Logger
+import org.slf4j.LoggerFactory
+
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.function.Consumer
+import java.util.regex.Pattern
+
+public class GoogleFirebaseProvider implements IThreePidProvider {
+
+    private Logger log = LoggerFactory.getLogger(GoogleFirebaseProvider.class);
+
+    private static final Pattern matrixIdLaxPattern = Pattern.compile("@(.*):(.+)");
+
+    private boolean isEnabled;
+    private String domain;
+    private FirebaseApp fbApp;
+    private FirebaseAuth fbAuth;
+
+    public GoogleFirebaseProvider(boolean isEnabled) {
+        this.isEnabled = isEnabled;
+    }
+
+    public GoogleFirebaseProvider(String credsPath, String db, String domain) {
+        this(true);
+        this.domain = domain;
+        try {
+            fbApp = FirebaseApp.initializeApp(getOpts(credsPath, db), "ThreePidProvider");
+            fbAuth = FirebaseAuth.getInstance(fbApp);
+
+            log.info("Google Firebase Authentication is ready");
+        } catch (IOException e) {
+            throw new RuntimeException("Error when initializing Firebase", e);
+        }
+    }
+
+    private FirebaseCredential getCreds(String credsPath) throws IOException {
+        if (StringUtils.isNotBlank(credsPath)) {
+            return FirebaseCredentials.fromCertificate(new FileInputStream(credsPath));
+        } else {
+            return FirebaseCredentials.applicationDefault();
+        }
+    }
+
+    private FirebaseOptions getOpts(String credsPath, String db) throws IOException {
+        if (StringUtils.isBlank(db)) {
+            throw new IllegalArgumentException("Firebase database is not configured");
+        }
+
+        return new FirebaseOptions.Builder()
+                .setCredential(getCreds(credsPath))
+                .setDatabaseUrl(db)
+                .build();
+    }
+
+    private String getMxid(UserRecord record) {
+        return "@${record.getUid()}:${domain}";
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return isEnabled;
+    }
+
+    @Override
+    public boolean isLocal() {
+        return true;
+    }
+
+    @Override
+    public int getPriority() {
+        return 25;
+    }
+
+    private void waitOnLatch(CountDownLatch l) {
+        try {
+            l.await(30, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for Firebase auth check");
+        }
+    }
+
+    private Optional<UserRecord> findInternal(String medium, String address) {
+        UserRecord r;
+        CountDownLatch l = new CountDownLatch(1);
+
+        OnSuccessListener<UserRecord> success = new OnSuccessListener<UserRecord>() {
+            @Override
+            void onSuccess(UserRecord result) {
+                log.info("Found 3PID match for {}:{} - UID is {}", medium, address, result.getUid())
+                r = result;
+                l.countDown()
+            }
+        };
+
+        OnFailureListener failure = new OnFailureListener() {
+            @Override
+            void onFailure(@NonNull Exception e) {
+                log.info("No 3PID match for {}:{} - {}", medium, address, e.getMessage())
+                r = null;
+                l.countDown()
+            }
+        };
+
+        if (ThreePidMedium.Email.is(medium)) {
+            log.info("Performing E-mail 3PID lookup for {}", address)
+            fbAuth.getUserByEmail(address)
+                    .addOnSuccessListener(success)
+                    .addOnFailureListener(failure);
+            waitOnLatch(l);
+        } else if (ThreePidMedium.PhoneNumber.is(medium)) {
+            log.info("Performing msisdn 3PID lookup for {}", address)
+            fbAuth.getUserByPhoneNumber(address)
+                    .addOnSuccessListener(success)
+                    .addOnFailureListener(failure);
+            waitOnLatch(l);
+        } else {
+            log.info("{} is not a supported 3PID medium", medium);
+            r = null;
+        }
+
+        return Optional.ofNullable(r);
+    }
+
+    @Override
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        Optional<UserRecord> urOpt = findInternal(request.getType(), request.getThreePid())
+        if (urOpt.isPresent()) {
+            return Optional.of(new SingleLookupReply(request, getMxid(urOpt.get())));
+        }
+
+        return Optional.empty();
+    }
+
+    @Override
+    public List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
+        List<ThreePidMapping> results = new ArrayList<>();
+        mappings.parallelStream().forEach(new Consumer<ThreePidMapping>() {
+            @Override
+            void accept(ThreePidMapping o) {
+                Optional<UserRecord> urOpt = findInternal(o.getMedium(), o.getValue());
+                if (urOpt.isPresent()) {
+                    ThreePidMapping result = new ThreePidMapping();
+                    result.setMedium(o.getMedium())
+                    result.setValue(o.getValue())
+                    result.setMxid(getMxid(urOpt.get()))
+                    results.add(result)
+                }
+            }
+        });
+        return results;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/IThreePidProvider.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/IThreePidProvider.groovy
@@ -20,6 +20,7 @@

 package io.kamax.mxisd.lookup.provider

+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping

@@ -34,7 +35,7 @@ interface IThreePidProvider {
     */
    int getPriority() // Should not be here but let's KISS for now

-    Optional<?> find(SingleLookupRequest request)
+    Optional<SingleLookupReply> find(SingleLookupRequest request)

    List<ThreePidMapping> populate(List<ThreePidMapping> mappings)

--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/LdapProvider.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/LdapProvider.groovy
@@ -20,8 +20,9 @@

 package io.kamax.mxisd.lookup.provider

-import io.kamax.mxisd.config.LdapConfig
 import io.kamax.mxisd.config.ServerConfig
+import io.kamax.mxisd.config.ldap.LdapConfig
+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping
 import org.apache.commons.lang.StringUtils
@@ -53,7 +54,19 @@ class LdapProvider implements IThreePidProvider {

    @Override
    boolean isEnabled() {
-        return ldapCfg.getEnabled()
+        return ldapCfg.isEnabled()
+    }
+
+    private LdapConnection getConn() {
+        return new LdapNetworkConnection(ldapCfg.getConn().getHost(), ldapCfg.getConn().getPort(), ldapCfg.getConn().isTls())
+    }
+
+    private void bind(LdapConnection conn) {
+        conn.bind(ldapCfg.getConn().getBindDn(), ldapCfg.getConn().getBindPassword())
+    }
+
+    private String getUidAttribute() {
+        return ldapCfg.getAttribute().getUid().getValue();
    }

    @Override
@@ -67,20 +80,22 @@ class LdapProvider implements IThreePidProvider {
    }

    Optional<String> lookup(LdapConnection conn, String medium, String value) {
-        Optional<String> queryOpt = ldapCfg.getMapping(medium)
+        String uidAttribute = getUidAttribute()
+
+        Optional<String> queryOpt = ldapCfg.getIdentity().getQuery(medium)
        if (!queryOpt.isPresent()) {
            log.warn("{} is not a configured 3PID type for LDAP lookup", medium)
            return Optional.empty()
        }

        String searchQuery = queryOpt.get().replaceAll("%3pid", value)
-        EntryCursor cursor = conn.search(ldapCfg.getBaseDn(), searchQuery, SearchScope.SUBTREE, ldapCfg.getAttribute())
+        EntryCursor cursor = conn.search(ldapCfg.getConn().getBaseDn(), searchQuery, SearchScope.SUBTREE, uidAttribute)
        try {
            while (cursor.next()) {
                Entry entry = cursor.get()
                log.info("Found possible match, DN: {}", entry.getDn().getName())

-                Attribute attribute = entry.get(ldapCfg.getAttribute())
+                Attribute attribute = entry.get(uidAttribute)
                if (attribute == null) {
                    log.info("DN {}: no attribute {}, skpping", entry.getDn(), ldapCfg.getAttribute())
                    continue
@@ -94,12 +109,13 @@ class LdapProvider implements IThreePidProvider {

                StringBuilder matrixId = new StringBuilder()
                // TODO Should we turn this block into a map of functions?
-                if (StringUtils.equals(UID, ldapCfg.getType())) {
+                String uidType = ldapCfg.getAttribute().getUid().getType()
+                if (StringUtils.equals(UID, uidType)) {
                    matrixId.append("@").append(data).append(":").append(srvCfg.getName())
-                } else if (StringUtils.equals(MATRIX_ID, ldapCfg.getType())) {
+                } else if (StringUtils.equals(MATRIX_ID, uidType)) {
                    matrixId.append(data)
                } else {
-                    log.warn("Bind was found but type {} is not supported", ldapCfg.getType())
+                    log.warn("Bind was found but type {} is not supported", uidType)
                    continue
                }

@@ -116,23 +132,16 @@ class LdapProvider implements IThreePidProvider {
    }

    @Override
-    Optional<?> find(SingleLookupRequest request) {
+    Optional<SingleLookupReply> find(SingleLookupRequest request) {
        log.info("Performing LDAP lookup ${request.getThreePid()} of type ${request.getType()}")

-        LdapConnection conn = new LdapNetworkConnection(ldapCfg.getHost(), ldapCfg.getPort(), ldapCfg.getTls())
+        LdapConnection conn = getConn()
        try {
-            conn.bind(ldapCfg.getBindDn(), ldapCfg.getBindPassword())
+            bind(conn)

            Optional<String> mxid = lookup(conn, request.getType(), request.getThreePid())
            if (mxid.isPresent()) {
-                return Optional.of([
-                        address   : request.getThreePid(),
-                        medium    : request.getType(),
-                        mxid      : mxid.get(),
-                        not_before: 0,
-                        not_after : 9223372036854775807,
-                        ts        : 0
-                ])
+                return Optional.of(new SingleLookupReply(request, mxid.get()));
            }
        } finally {
            conn.close()
@@ -147,9 +156,9 @@ class LdapProvider implements IThreePidProvider {
        log.info("Looking up {} mappings", mappings.size())
        List<ThreePidMapping> mappingsFound = new ArrayList<>()

-        LdapConnection conn = new LdapNetworkConnection(ldapCfg.getHost(), ldapCfg.getPort())
+        LdapConnection conn = getConn()
        try {
-            conn.bind(ldapCfg.getBindDn(), ldapCfg.getBindPassword())
+            bind(conn)

            for (ThreePidMapping mapping : mappings) {
                try {
--- a/src/main/groovy/io/kamax/mxisd/lookup/provider/RemoteIdentityServerFetcher.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/provider/RemoteIdentityServerFetcher.groovy
@@ -24,6 +24,8 @@ import groovy.json.JsonException
 import groovy.json.JsonOutput
 import groovy.json.JsonSlurper
 import io.kamax.mxisd.controller.v1.ClientBulkLookupRequest
+import io.kamax.mxisd.lookup.SingleLookupReply
+import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping
 import io.kamax.mxisd.lookup.fetcher.IRemoteIdentityServerFetcher
 import org.apache.http.HttpEntity
@@ -77,24 +79,26 @@ public class RemoteIdentityServerFetcher implements IRemoteIdentityServerFetcher
    }

    @Override
-    Optional<?> find(String remote, String type, String threePid) {
-        log.info("Looking up {} 3PID {} using {}", type, threePid, remote)
+    Optional<SingleLookupReply> find(String remote, SingleLookupRequest request) {
+        log.info("Looking up {} 3PID {} using {}", request.getType(), request.getThreePid(), remote)

        HttpURLConnection rootSrvConn = (HttpURLConnection) new URL(
-                "${remote}/_matrix/identity/api/v1/lookup?medium=${type}&address=${threePid}"
+                "${remote}/_matrix/identity/api/v1/lookup?medium=${request.getType()}&address=${request.getThreePid()}"
        ).openConnection()

        try {
-            def output = json.parseText(rootSrvConn.getInputStream().getText())
+            String outputRaw = rootSrvConn.getInputStream().getText()
+            def output = json.parseText(outputRaw)
            if (output['address']) {
                log.info("Found 3PID mapping: {}", output)
-                return Optional.of(output)
+
+                return Optional.of(SingleLookupReply.fromRecursive(request, outputRaw))
            }

            log.info("Empty 3PID mapping from {}", remote)
            return Optional.empty()
        } catch (IOException e) {
-            log.warn("Error looking up 3PID mapping {}: {}", threePid, e.getMessage())
+            log.warn("Error looking up 3PID mapping {}: {}", request.getThreePid(), e.getMessage())
            return Optional.empty()
        } catch (JsonException e) {
            log.warn("Invalid JSON answer from {}", remote)
--- a/src/main/groovy/io/kamax/mxisd/lookup/strategy/LookupStrategy.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/strategy/LookupStrategy.groovy
@@ -21,6 +21,7 @@
 package io.kamax.mxisd.lookup.strategy

 import io.kamax.mxisd.lookup.BulkLookupRequest
+import io.kamax.mxisd.lookup.SingleLookupReply
 import io.kamax.mxisd.lookup.SingleLookupRequest
 import io.kamax.mxisd.lookup.ThreePidMapping
 import io.kamax.mxisd.lookup.provider.IThreePidProvider
@@ -29,7 +30,11 @@ interface LookupStrategy {

    List<IThreePidProvider> getLocalProviders()

-    Optional<?> find(SingleLookupRequest request)
+    Optional<SingleLookupReply> find(String medium, String address, boolean recursive)
+
+    Optional<SingleLookupReply> find(SingleLookupRequest request)
+
+    Optional<SingleLookupReply> findRecursive(SingleLookupRequest request)

    List<ThreePidMapping> find(BulkLookupRequest requests)

--- a/src/main/groovy/io/kamax/mxisd/lookup/strategy/RecursivePriorityLookupStrategy.groovy
+++ b/src/main/groovy/io/kamax/mxisd/lookup/strategy/RecursivePriorityLookupStrategy.groovy
@@ -22,10 +22,7 @@ package io.kamax.mxisd.lookup.strategy

 import edazdarevic.commons.net.CIDRUtils
 import io.kamax.mxisd.config.RecursiveLookupConfig
-import io.kamax.mxisd.lookup.ALookupRequest
-import io.kamax.mxisd.lookup.BulkLookupRequest
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
+import io.kamax.mxisd.lookup.*
 import io.kamax.mxisd.lookup.fetcher.IBridgeFetcher
 import io.kamax.mxisd.lookup.provider.IThreePidProvider
 import org.slf4j.Logger
@@ -93,13 +90,17 @@ class RecursivePriorityLookupStrategy implements LookupStrategy, InitializingBea
    }

    List<IThreePidProvider> listUsableProviders(ALookupRequest request) {
+        return listUsableProviders(request, false);
+    }
+
+    List<IThreePidProvider> listUsableProviders(ALookupRequest request, boolean forceRecursive) {
        List<IThreePidProvider> usableProviders = new ArrayList<>()

-        boolean canRecurse = isAllowedForRecursive(request.getRequester())
+        boolean canRecurse = forceRecursive || isAllowedForRecursive(request.getRequester())

        log.info("Host {} allowed for recursion: {}", request.getRequester(), canRecurse)
        for (IThreePidProvider provider : providers) {
-            if (provider.isEnabled() && (provider.isLocal() || canRecurse)) {
+            if (provider.isEnabled() && (provider.isLocal() || canRecurse || forceRecursive)) {
                usableProviders.add(provider)
            }
        }
@@ -118,15 +119,27 @@ class RecursivePriorityLookupStrategy implements LookupStrategy, InitializingBea
    }

    @Override
-    Optional<?> find(SingleLookupRequest request) {
-        for (IThreePidProvider provider : listUsableProviders(request)) {
-            Optional<?> lookupDataOpt = provider.find(request)
+    Optional<SingleLookupReply> find(String medium, String address, boolean recursive) {
+        SingleLookupRequest req = new SingleLookupRequest();
+        req.setType(medium)
+        req.setThreePid(address)
+        req.setRequester("Internal")
+        return find(req, recursive)
+    }
+
+    Optional<SingleLookupReply> find(SingleLookupRequest request, boolean forceRecursive) {
+        for (IThreePidProvider provider : listUsableProviders(request, forceRecursive)) {
+            Optional<SingleLookupReply> lookupDataOpt = provider.find(request)
            if (lookupDataOpt.isPresent()) {
                return lookupDataOpt
            }
        }

-        if (recursiveCfg.getBridge().getEnabled() && (!recursiveCfg.getBridge().getRecursiveOnly() || isAllowedForRecursive(request.getRequester()))) {
+        if (
+        recursiveCfg.getBridge() != null &&
+                recursiveCfg.getBridge().getEnabled() &&
+                (!recursiveCfg.getBridge().getRecursiveOnly() || isAllowedForRecursive(request.getRequester()))
+        ) {
            log.info("Using bridge failover for lookup")
            return bridge.find(request)
        }
@@ -134,6 +147,16 @@ class RecursivePriorityLookupStrategy implements LookupStrategy, InitializingBea
        return Optional.empty()
    }

+    @Override
+    Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        return find(request, false)
+    }
+
+    @Override
+    Optional<SingleLookupReply> findRecursive(SingleLookupRequest request) {
+        return find(request, true)
+    }
+
    @Override
    List<ThreePidMapping> find(BulkLookupRequest request) {
        List<ThreePidMapping> mapToDo = new ArrayList<>(request.getMappings())
--- a/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java
+++ b/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java
@@ -1,7 +1,27 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.mapping;

 import io.kamax.mxisd.exception.BadRequestException;
-import io.kamax.mxisd.lookup.ThreePid;
+import io.kamax.mxisd.lookup.ThreePidValidation;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -72,10 +92,10 @@ public class MappingManager {
        s.validationTimestamp = Instant.now();
    }

-    public Optional<ThreePid> getValidated(String sid, String secret) {
+    public Optional<ThreePidValidation> getValidated(String sid, String secret) {
        Session s = sessions.get(sid);
        if (s != null && StringUtils.equals(s.secret, secret)) {
-            return Optional.of(new ThreePid(s.medium, s.address, s.validationTimestamp));
+            return Optional.of(new ThreePidValidation(s.medium, s.address, s.validationTimestamp));
        }

        return Optional.empty();
--- a/src/main/groovy/io/kamax/mxisd/mapping/MappingSession.java
+++ b/src/main/groovy/io/kamax/mxisd/mapping/MappingSession.java
@@ -1,3 +1,23 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 package io.kamax.mxisd.mapping;

 public interface MappingSession {
--- a/src/main/groovy/io/kamax/mxisd/signature/SignatureManager.groovy
+++ b/src/main/groovy/io/kamax/mxisd/signature/SignatureManager.groovy
@@ -20,9 +20,11 @@

 package io.kamax.mxisd.signature

+import com.google.gson.JsonObject
 import io.kamax.mxisd.config.ServerConfig
 import io.kamax.mxisd.key.KeyManager
 import net.i2p.crypto.eddsa.EdDSAEngine
+import org.json.JSONObject
 import org.springframework.beans.factory.InitializingBean
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.stereotype.Component
@@ -40,14 +42,31 @@ class SignatureManager implements InitializingBean {

    private EdDSAEngine signEngine

-    Map<?, ?> signMessage(String message) {
+    private String sign(String message) {
        byte[] signRaw = signEngine.signOneShot(message.getBytes())
-        String sign = Base64.getEncoder().encodeToString(signRaw)
-        return [
-                "${srvCfg.getName()}": [
-                        "ed25519:${keyMgr.getCurrentIndex()}": sign
-                ]
-        ]
+        return Base64.getEncoder().encodeToString(signRaw)
+    }
+
+    JSONObject signMessageJson(String message) {
+        String sign = sign(message)
+
+        JSONObject keySignature = new JSONObject()
+        keySignature.put("ed25519:${keyMgr.getCurrentIndex()}", sign)
+        JSONObject signature = new JSONObject()
+        signature.put("${srvCfg.getName()}", keySignature)
+
+        return signature
+    }
+
+    JsonObject signMessageGson(String message) {
+        String sign = sign(message)
+
+        JsonObject keySignature = new JsonObject()
+        keySignature.addProperty("ed25519:${keyMgr.getCurrentIndex()}", sign)
+        JsonObject signature = new JsonObject()
+        signature.add("${srvCfg.getName()}", keySignature);
+
+        return signature
    }

    @Override
--- a/src/main/groovy/io/kamax/mxisd/spring/ConfigurationFailureAnalyzer.java
+++ b/src/main/groovy/io/kamax/mxisd/spring/ConfigurationFailureAnalyzer.java
@@ -0,0 +1,38 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.spring;
+
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.springframework.boot.diagnostics.AbstractFailureAnalyzer;
+import org.springframework.boot.diagnostics.FailureAnalysis;
+
+public class ConfigurationFailureAnalyzer extends AbstractFailureAnalyzer<ConfigurationException> {
+
+    @Override
+    protected FailureAnalysis analyze(Throwable rootFailure, ConfigurationException cause) {
+        String message = cause.getMessage();
+        if (cause.getDetailedMessage().isPresent()) {
+            message += " - " + cause.getDetailedMessage().get();
+        }
+        return new FailureAnalysis(message, "Double check the key value", cause);
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/storage/IStorage.java
+++ b/src/main/groovy/io/kamax/mxisd/storage/IStorage.java
@@ -0,0 +1,36 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.storage;
+
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+import io.kamax.mxisd.storage.ormlite.ThreePidInviteIO;
+
+import java.util.Collection;
+
+public interface IStorage {
+
+    Collection<ThreePidInviteIO> getInvites();
+
+    void insertInvite(IThreePidInviteReply data);
+
+    void deleteInvite(String id);
+
+}
--- a/src/main/groovy/io/kamax/mxisd/storage/ormlite/OrmLiteSqliteStorage.java
+++ b/src/main/groovy/io/kamax/mxisd/storage/ormlite/OrmLiteSqliteStorage.java
@@ -0,0 +1,93 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.storage.ormlite;
+
+import com.j256.ormlite.dao.CloseableWrappedIterable;
+import com.j256.ormlite.dao.Dao;
+import com.j256.ormlite.dao.DaoManager;
+import com.j256.ormlite.jdbc.JdbcConnectionSource;
+import com.j256.ormlite.support.ConnectionSource;
+import com.j256.ormlite.table.TableUtils;
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+import io.kamax.mxisd.storage.IStorage;
+
+import java.io.File;
+import java.io.IOException;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+public class OrmLiteSqliteStorage implements IStorage {
+
+    private Dao<ThreePidInviteIO, String> invDao;
+
+    OrmLiteSqliteStorage(String path) {
+        try {
+            File parent = new File(path).getParentFile();
+            if (!parent.mkdirs() && !parent.isDirectory()) {
+                throw new RuntimeException("Unable to create DB parent directory: " + parent);
+            }
+
+            ConnectionSource connPool = new JdbcConnectionSource("jdbc:sqlite:" + path);
+            invDao = DaoManager.createDao(connPool, ThreePidInviteIO.class);
+            TableUtils.createTableIfNotExists(connPool, ThreePidInviteIO.class);
+        } catch (SQLException e) {
+            throw new RuntimeException(e); // FIXME do better
+        }
+    }
+
+    @Override
+    public Collection<ThreePidInviteIO> getInvites() {
+        try (CloseableWrappedIterable<ThreePidInviteIO> t = invDao.getWrappedIterable()) {
+            List<ThreePidInviteIO> ioList = new ArrayList<>();
+            t.forEach(ioList::add);
+            return ioList;
+        } catch (IOException e) {
+            throw new RuntimeException(e); // FIXME do better
+        }
+    }
+
+    @Override
+    public void insertInvite(IThreePidInviteReply data) {
+        try {
+            int updated = invDao.create(new ThreePidInviteIO(data));
+            if (updated != 1) {
+                throw new RuntimeException("Unexpected row count after DB action: " + updated);
+            }
+        } catch (SQLException e) {
+            throw new RuntimeException(e); // FIXME do better
+        }
+    }
+
+    @Override
+    public void deleteInvite(String id) {
+        try {
+            int updated = invDao.deleteById(id);
+            if (updated != 1) {
+                throw new RuntimeException("Unexpected row count after DB action: " + updated);
+            }
+        } catch (SQLException e) {
+            throw new RuntimeException(e); // FIXME do better
+        }
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/storage/ormlite/OrmLiteSqliteStorageBeanFactory.java
+++ b/src/main/groovy/io/kamax/mxisd/storage/ormlite/OrmLiteSqliteStorageBeanFactory.java
@@ -0,0 +1,76 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.storage.ormlite;
+
+import io.kamax.mxisd.config.SQLiteStorageConfig;
+import io.kamax.mxisd.config.StorageConfig;
+import io.kamax.mxisd.exception.ConfigurationException;
+import io.kamax.mxisd.storage.IStorage;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.beans.factory.FactoryBeanNotInitializedException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import javax.annotation.PostConstruct;
+
+@Component
+public class OrmLiteSqliteStorageBeanFactory implements FactoryBean<IStorage> {
+
+    @Autowired
+    private StorageConfig storagecfg;
+
+    @Autowired
+    private SQLiteStorageConfig cfg;
+
+    private OrmLiteSqliteStorage storage;
+
+    @PostConstruct
+    private void postConstruct() {
+        if (StringUtils.equals("sqlite", storagecfg.getBackend())) {
+            if (StringUtils.isBlank(cfg.getDatabase())) {
+                throw new ConfigurationException("storage.provider.sqlite.database");
+            }
+
+            storage = new OrmLiteSqliteStorage(cfg.getDatabase());
+        }
+    }
+
+    @Override
+    public IStorage getObject() throws Exception {
+        if (storage == null) {
+            throw new FactoryBeanNotInitializedException();
+        }
+
+        return storage;
+    }
+
+    @Override
+    public Class<?> getObjectType() {
+        return OrmLiteSqliteStorage.class;
+    }
+
+    @Override
+    public boolean isSingleton() {
+        return true;
+    }
+
+}
--- a/src/main/groovy/io/kamax/mxisd/storage/ormlite/ThreePidInviteIO.java
+++ b/src/main/groovy/io/kamax/mxisd/storage/ormlite/ThreePidInviteIO.java
@@ -0,0 +1,106 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.storage.ormlite;
+
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
+import com.j256.ormlite.field.DatabaseField;
+import com.j256.ormlite.table.DatabaseTable;
+import io.kamax.mxisd.invitation.IThreePidInviteReply;
+import org.apache.commons.lang.StringUtils;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@DatabaseTable(tableName = "invite_3pid")
+public class ThreePidInviteIO {
+
+    private static Gson gson = new Gson();
+
+    @DatabaseField(id = true)
+    private String id;
+
+    @DatabaseField(canBeNull = false)
+    private String token;
+
+    @DatabaseField(canBeNull = false)
+    private String sender;
+
+    @DatabaseField(canBeNull = false)
+    private String medium;
+
+    @DatabaseField(canBeNull = false)
+    private String address;
+
+    @DatabaseField(canBeNull = false)
+    private String roomId;
+
+    @DatabaseField
+    private String properties;
+
+    public ThreePidInviteIO() {
+        // needed for ORMlite
+    }
+
+    public ThreePidInviteIO(IThreePidInviteReply data) {
+        this.id = data.getId();
+        this.token = data.getToken();
+        this.sender = data.getInvite().getSender().getId();
+        this.medium = data.getInvite().getMedium();
+        this.address = data.getInvite().getAddress();
+        this.roomId = data.getInvite().getRoomId();
+        this.properties = gson.toJson(data.getInvite().getProperties());
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public String getSender() {
+        return sender;
+    }
+
+    public String getMedium() {
+        return medium;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    public String getRoomId() {
+        return roomId;
+    }
+
+    public Map<String, String> getProperties() {
+        if (StringUtils.isBlank(properties)) {
+            return new HashMap<>();
+        }
+
+        return gson.fromJson(properties, new TypeToken<Map<String, String>>() {
+        }.getType());
+    }
+
+}
--- a/src/main/resources/META-INF/spring.factories
+++ b/src/main/resources/META-INF/spring.factories
@@ -0,0 +1,2 @@
+org.springframework.boot.diagnostics.FailureAnalyzer=\
+io.kamax.mxisd.spring.ConfigurationFailureAnalyzer
--- a/src/main/resources/application.yaml
+++ b/src/main/resources/application.yaml
@@ -0,0 +1,57 @@
+logging:
+  level:
+    org:
+      springframework: "WARN"
+      apache:
+        catalina: "WARN"
+        directory: "WARN"
+
+server:
+  port: 8090
+
+lookup:
+  recursive:
+    enabled: true
+    allowedCidr:
+      - '127.0.0.0/8'
+      - '10.0.0.0/8'
+      - '172.16.0.0/12'
+      - '192.168.0.0/16'
+      - '::1/128'
+
+    bridge:
+      enabled: false
+      recursiveOnly: true
+
+ldap:
+  enabled: false
+  connection:
+    tls: false
+    port: 389
+  attribute:
+    uid:
+      type: 'uid'
+      value: 'userPrincipalName'
+    name: 'displayName'
+  identity:
+    medium:
+      email: "(|(mailPrimaryAddress=%3pid)(mail=%3pid)(otherMailbox=%3pid))"
+      msisdn: "(|(telephoneNumber=+%3pid)(mobile=+%3pid)(homePhone=+%3pid)(otherTelephone=+%3pid)(otherMobile=+%3pid)(otherHomePhone=+%3pid))"
+
+firebase:
+  enabled: false
+
+forward:
+  servers:
+    - "https://matrix.org"
+    - "https://vector.im"
+
+invite:
+  sender:
+    email:
+      tls: 1
+      name: "mxisd Identity Server"
+      template: "classpath:email/invite-template.eml"
+
+storage:
+  backend: 'sqlite'
--- a/src/main/resources/email/invite-template.eml
+++ b/src/main/resources/email/invite-template.eml
@@ -0,0 +1,97 @@
+Subject: You have been invited to %DOMAIN%
+MIME-Version: 1.0
+Content-Type: multipart/alternative;
+	boundary="7REaIwWQCioQ6NaBlAQlg8ztbUQj6PKJ"
+
+--7REaIwWQCioQ6NaBlAQlg8ztbUQj6PKJ
+Content-Type: text/plain; charset=UTF-8
+Content-Disposition: inline
+
+Hi,
+
+%SENDER_NAME_OR_ID% has invited you into a room [%ROOM_NAME_OR_ID%] on
+Matrix. To join the conversation, register an account on http://%DOMAIN%
+
+You can also register an account on a public server, like Matrix.org, by going to
+https://riot.im/app/#/register?%INVITE_MEDIUM%=%INVITE_ADDRESS%
+
+
+About Matrix:
+
+Matrix is an open standard for interoperable, decentralised, real-time communication
+over IP, supporting group chat, file transfer, voice and video calling, integrations to
+other apps, bridges to other communication systems and much more. It can be used to power
+Instant Messaging, VoIP/WebRTC signalling, Internet of Things communication.
+
+Thanks,
+
+%DOMAIN_PRETTY% Admins
+
+--7REaIwWQCioQ6NaBlAQlg8ztbUQj6PKJ
+Content-Type: multipart/related;
+	boundary="M3yzHl5YZehm9v4bAM8sKEdcOoVnRnKR";
+	type="text/html"
+
+--M3yzHl5YZehm9v4bAM8sKEdcOoVnRnKR
+Content-Type: text/html; charset=UTF-8
+Content-Disposition: inline
+
+<!doctype html>
+<html lang="en">
+    <head>
+        <style type="text/css">
+body {
+    margin: 0px;
+}
+
+pre, code {
+    word-break: break-word;
+    white-space: pre-wrap;
+}
+
+#page {
+    font-family: 'Open Sans', Helvetica, Arial, Sans-Serif;
+    font-color: #454545;
+    font-size: 12pt;
+    width: 100%%;
+    padding: 20px;
+}
+
+#inner {
+    width: 640px;
+}
+        </style>
+    </head>
+    <body>
+        <table id="page">
+            <tr>
+                <td> </td>
+                <td id="inner">
+<p>Hi,</p>
+
+<p>%SENDER_NAME_OR_ID% has invited you into a room [%ROOM_NAME_OR_ID%] on
+Matrix. To join the conversation, register an account on <a href="http://%DOMAIN%">%DOMAIN%</a>.</p>
+
+<p>You can also register an account on a public server, like Matrix.org, by following
+<a href="https://riot.im/app/#/register?%INVITE_MEDIUM%=%INVITE_ADDRESS%">this link</a>.</p>
+
+<br>
+<p>About Matrix:</p>
+
+<p>Matrix is an open standard for interoperable, decentralised, real-time communication
+   over IP, supporting group chat, file transfer, voice and video calling, integrations to
+   other apps, bridges to other communication systems and much more. It can be used to power
+   Instant Messaging, VoIP/WebRTC signalling, Internet of Things communication.</p>
+
+<p>Thanks,</p>
+
+<p>%DOMAIN_PRETTY% Admins</p>
+                </td>
+                <td> </td>
+            </tr>
+        </table>
+    </body>
+</html>
+--M3yzHl5YZehm9v4bAM8sKEdcOoVnRnKR--
+
+--7REaIwWQCioQ6NaBlAQlg8ztbUQj6PKJ--
Author	SHA1	Message	Date
Maxime Dor	9a90d846e6	Improve README - List current features - List features to come - Improve wording at various places - Centralise configuration directions - Improve layout to make it easier for new users (hopefully)	2017-09-14 04:54:01 +02:00
Maxime Dor	16efe93920	Use proper ID when clearing invites from memory	2017-09-14 03:56:21 +02:00
Maxime Dor	8fbb45037c	Create SQLite DB file parent directory if necessary	2017-09-14 03:38:14 +02:00
Maxime Dor	f1196d5b72	Revamp example config for better handling by users and build tools	2017-09-14 03:31:56 +02:00
Max Dor	3b4736b00f	Merge pull request #28 from kamax-io/invite-support Invite support	2017-09-14 02:49:24 +02:00
Maxime Dor	5796982f2d	Add persistence storage for invites	2017-09-14 02:36:08 +02:00
Maxime Dor	9e6d3ab5dd	Build error json object properly	2017-09-13 21:27:29 +02:00
Maxime Dor	571506d1d2	Add new placeholders for e-mail to access invited address and medium type	2017-09-13 19:15:39 +02:00
Maxime Dor	c00adcf575	Be consistent with annotations	2017-09-13 16:25:21 +02:00
Maxime Dor	808aed2bc3	log user agent for lookup requests	2017-09-13 16:21:09 +02:00
Maxime Dor	ec0a9c7b80	log user agent for lookup requests	2017-09-13 16:20:46 +02:00
Maxime Dor	84afb86b77	Properly handle default config file when running as systemd/sysv daemon	2017-09-13 02:47:25 +02:00
Maxime Dor	02c5523d6d	Handle bundled and external e-mail template properly	2017-09-13 02:29:58 +02:00
Maxime Dor	d7cf31fb9a	Remove debug log statement	2017-09-13 02:28:37 +02:00
Maxime Dor	d7258cd3c6	Fix DNS lookup	2017-09-13 02:28:22 +02:00
Maxime Dor	222f7f104a	Add regular pending invite mapping checks	2017-09-13 01:35:11 +02:00
Maxime Dor	548dace78c	Properly handle invites with LDAP backend	2017-09-13 01:16:02 +02:00
Maxime Dor	001de470ca	Fix invalid add of @Override	2017-09-12 19:48:39 +02:00
Maxime Dor	09b789dfc2	Refactor logic, preparing to generalize post-login publish of mappings	2017-09-12 19:47:01 +02:00
Maxime Dor	55b759a31c	Enhance e-mail invitations - Built-in e-mail template - More template placeholders	2017-09-12 02:24:58 +02:00
Maxime Dor	cb0ffe0575	Remove debug log	2017-09-07 17:45:48 +02:00
Maxime Dor	3cde0b9c23	Fix typo	2017-09-07 17:44:37 +02:00
Maxime Dor	2ce3bab3b6	Properly handle force recursive lookup during invite	2017-09-07 02:04:48 +02:00
Maxime Dor	ba723f8523	Don't fail on non-existing config key	2017-09-07 01:53:42 +02:00
Maxime Dor	d2d5f80b44	Don't fail if template is not found and hope for the best	2017-09-07 01:21:49 +02:00
Maxime Dor	e2a097b2d0	Avoid header that could be considered as a profile	2017-09-07 01:16:43 +02:00
Maxime Dor	45a81e5979	Add sane defaults	2017-09-07 00:07:49 +02:00
Maxime Dor	158060a3b0	Add some placeholders handling for e-mail template	2017-09-06 23:08:47 +02:00
Maxime Dor	1e3b832186	Fix example data	2017-09-06 15:56:45 +02:00
Maxime Dor	8294990b1f	Cosmetic changes - Add missing license headers - Remove unused class	2017-09-06 15:04:17 +02:00
Maxime Dor	a704ba2e6c	Working prototype	2017-09-06 15:00:43 +02:00
Maxime Dor	a7303fef15	Add icons	2017-09-06 10:52:57 +02:00
Maxime Dor	cd6960fa80	Attempt to support invites, working in progress	2017-09-06 04:17:46 +02:00
Maxime Dor	c05ca68de4	Keep LDAP disabled by default	2017-09-05 21:37:43 +02:00
Maxime Dor	a8df386d58	Auth support with synapse REST auth module	2017-09-05 21:36:33 +02:00
Maxime Dor	4b0d549dd6	Add LDAP Auth support with synapse REST Auth module	2017-09-05 21:31:36 +02:00
Maxime Dor	85236793e1	Skeleton to support LDAP Auth	2017-09-04 03:08:19 +02:00
Maxime Dor	954dcf3a5c	Improve startup failures user experience - Be clear about config errors instead of difficult stack traces - Fix default values which should not cause startup failures	2017-09-03 23:26:32 +02:00
Max Dor	466a3d270e	Merge pull request #26 from kamax-io/recursive-enhanced Add properties for enhanced recursive lookup queries	2017-09-03 20:36:30 +02:00
Maxime Dor	a046f9f327	Add Docker public repo	2017-09-03 13:49:00 +02:00
Maxime Dor	c03573b24f	Be clear about building mxisd before building Docker img	2017-09-03 03:18:44 +02:00
Maxime Dor	694e62edee	Firebase UID is case sensitive, must not alter	2017-09-02 03:23:46 +02:00
Maxime Dor	61399c7705	Add status endpoint placeholder	2017-09-01 18:28:40 +02:00
Maxime Dor	05d1594ac2	Fix race condition and add more log statements	2017-08-31 18:52:06 +02:00
Maxime Dor	361596e773	Support 3PID lookups	2017-08-31 16:33:07 +02:00
Maxime Dor	d57aef36ea	Wait for async calls	2017-08-31 03:34:08 +02:00
Maxime Dor	0033d0dc1d	Experimental support for synapse REST auth module - See https://github.com/maxidor/matrix-synapse-rest-auth - Include Google Firebase backend using UID as login and user token as password	2017-08-31 02:10:36 +02:00
Maxime Dor	1c43ca7666	Add properties for enhanced recursive lookup queries	2017-08-29 01:44:33 +02:00