Various error handling improvements and user feedback

Directory integration

.gitignore

@@ -7,4 +7,7 @@ out/
 .idea/
 
 # Local dev config
-application.yaml
+/application.yaml
+
+# Local dev storage
+/mxisd.db

README.md

@@ -1,168 +1,259 @@
-mxisd
+mxisd - Federated Matrix Identity Server Daemon
 -----
 ![Travis-CI build status](https://travis-ci.org/kamax-io/mxisd.svg?branch=master)  
 
-[Overview](#overview) | [Lookup process](#lookup-process) | [Packages](#packages) | [From source](#from-source) | [Network Discovery](#network-discovery) | [Integration](#integration) | [Support](#support)
+- [Overview](#overview)
+- [Features](#features)
+- [Why use mxisd](#why-use-mxisd)
+- [Quick start](#quick-start)
+- [Support](#support)
+- [Contribute](#contribute)
+- [FAQ](#faq)
+- [Contact](#contact)
 
 # Overview
-mxisd is an implementation of the [Matrix Identity Service specification](https://matrix.org/docs/spec/identity_service/unstable.html) 
-which provides an alternative to the vector.im and matrix.org Identity servers.
+mxisd is a Federated Matrix Identity server for self-hosted Matrix infrastructures with enhanced features.
   
-mxisd is federated and uses a cascading lookup model which performs lookup from a more authoritative to a less authoritative source, usually doing:
-- Local identity stores: LDAP, etc.
-- Federated identity stores: another Identity Server in charge of a specific domain, if applicable
-- Configured identity stores: another Identiy Server specifically configured, if part of some sort of group trust
-- Root identity store: vector.im/matrix.org central Identity Server
+It is specifically designed to connect to an Identity store (AD/Samba/LDAP, SQL Database, Web services/application, ...)
+and ease the integration of the Matrix ecosystem with an existing infrastructure, or to build a new one using lasting
+tools.
 
-mxisd only aims to support workflow that does NOT break federation or basic lookup process of the Matrix ecosystem.
+The core principle of mxisd is to map between Matrix IDs and 3PIDs (Thrid-party Identifiers) for the Homeserver and its
+users. 3PIDs can be anything that identify a user, like:
+- Full name
+- Email address
+- Phone number
+- Employee number
+- Skype/Live ID
+- Twitter handle
+- Facebook ID
+- ...
 
-**NOTE:** mxisd is **NOT** an authenticator module for homeservers. Identity servers are opaque public directories for those who publish their data on it.  
-For more details, please read the [Identity Service specification](https://matrix.org/docs/spec/identity_service/unstable.html).
+mxisd is an enhanced Identity service, which implements the [Matrix Identity service API](https://matrix.org/docs/spec/identity_service/unstable.html)
+but also several other features that greatly enhance user experience within Matrix.
 
-# Lookup Process
-Default Lookup strategy will use a priority order and a configurable recursive/local type of request.
+mxisd is the one stop shop for anything regarding Authentication, Directory and Identity management in Matrix built as a
+single coherent product.
 
-## E-mail
-Given the 3PID `john.doe@example.org`, the following will be performed until a mapping is found:
-- LDAP: lookup the Matrix ID (partial or complete) from a configurable attribute using a dedicated query.
-- DNS: lookup another Identity Server using the domain part of an e-mail and:
-  - Look for a SRV record under `_matrix-identity._tcp.example.org`
-  - Lookup using the base domain name `example.org`
-- Forwarder: Proxy the request to other configurable identity servers.
+# Features
+As a [regular Matrix Identity service](docs/features/identity.md):
+- Search for people by 3PID using its own Identity stores (LDAP, SQL, etc.)
+- Invite people to rooms by 3PID using its own Identity stores, with [notifications](docs/README.md)
+to the invitee (Email, SMS, etc.)
+- Allow users to add 3PIDs to their settings/profile
 
-## Phone number
-Given the phone number `+123456789`, the following lookup logic will be performed:
-- LDAP: lookup the Matrix ID (partial or complete) from a configurable attribute using a dedicated query.
-- Forwarder: Proxy the request to other configurable identity servers.
+As an enhanced Identity service:
+- Use a recursive lookup mechanism when searching and inviting people by 3PID, allowing to fetch data from:
+  - Own Identity store
+  - Federated Identity servers, if applicable to the 3PID
+  - Arbitrary Identity servers
+  - Central Matrix Identity servers
+- [Extensive control of where 3PIDs are transmited](docs/sessions/3pid.md), so they are not leaked publicly by users
+- [Authentication support](docs/features/authentication.md) for [synapse](https://github.com/matrix-org/synapse) via the
+[REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth)
+- [Directory integration](docs/features/directory-users.md) which allows you to search for users within your
+organisation, even without prior Matrix contact
+- [Auto-fill of user profile](docs/features/authentication.md) (Display name, 3PIDs) via the
+[REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth)
 
-# Packages
-See [releases]((https://github.com/kamax-io/mxisd/releases)) for native installers of supported systems.  
-If none is available, please use other packages or build from source.
+# Why use mxisd
+- Use your existing Identity store, do not duplicate information
+- Auto-fill user profiles with relevant information
+- As an organisation, stay in control of 3PIDs so they are not published to the central Matrix.org servers where they
+currently **cannot be removed**
+- Users can directly find each other using whatever attribute is relevant within your Identity store
+- Federate your Identity lookups so you can discover others and/or others can discover you, all with extensive ACLs
 
-## Docker
-### From source
-Build the image:
-```
-docker build -t your-org/mxisd:$(git describe --tags --always --dirty) .
-```
-You can run a container of the given image and test it with the following command (adapt volumes host paths):
-```
-docker run -v /data/mxisd/etc:/etc/mxisd -v /data/mxisd/var:/var/mxisd -p 8090:8090 -t your-org/mxisd:$(git describe --tags --always --dirty)
-```
+# Quick Start
+1. [Preparation](#preparation)
+2. [Install](#install)
+3. [Configure](#configure)
+4. [Integrate](#integrate)
+5. [Validate](#validate)
 
-## Debian
-### Download
-See the [releases section](https://github.com/kamax-io/mxisd/releases).
+Following these quick start instructions, you will have a basic setup that can perform recursive/federated lookups and
+talk to the central Matrix.org Identity service.  
+This will be a good ground work for further integration with your existing Identity stores.
 
-### From source
-Requirements:
-- fakeroot
-- dpkg-deb
+## Preparation
+You will need:
+- Homeserver
+- Reverse proxy with regular TLS/SSL certificate (Let's encrypt) for your mxisd domain
 
-Run:
-```
-./gradlew buildDeb 
-```
+As synapse requires an HTTPS connection when talking to an Identity service, a reverse proxy is required as mxisd does
+not support HTTPS listener at this time.
 
-You will find the debian package in `build/dist`
+For maximum integration, it is best to have your Homeserver and mxisd reachable via the same hostname.  
+You can also use a dedicated domain for mxisd, but will not have access to some features.
 
-# From Source
-## Requirements
-- JDK 1.8
+Be aware of a [NAT/Reverse proxy gotcha](https://github.com/kamax-io/mxisd/wiki/Gotchas#nating) if you use the same
+hostname.
 
-## Build
-```
-git clone https://github.com/kamax-io/mxisd.git
-cd mxisd
-./gradlew build
-```
-
-## Configure
-1. Create a new local config: `cp application.example.yaml application.yaml`
-2. Set the `server.name` value to the domain value used in your Home Server configuration
-3. Set an absolute location for the signing keys using `key.path`
-4. Provide the LDAP attributes you want to use for lookup, if you want to use one
-5. Edit an entity in your LDAP database and set the configure attribute with a Matrix ID (e.g. `@john.doe:example.org`)
-
-## Test build and configuration
-Start the server in foreground to validate the build:
-```
-java -jar build/libs/mxisd.jar
-```
-
-Ensure the signing key is available:
-```
-curl http://localhost:8090/_matrix/identity/api/v1/pubkey/ed25519:0
-```
-
-Validate your LDAP config and binding info (replace the e-mail):
-```
-curl "http://localhost:8090/_matrix/identity/api/v1/lookup?medium=email&address=john.doe@example.org"
-```
-
-If you plan on testing the integration with a homeserver, you will need to run an HTTPS reverse proxy in front of it
-as the reference Home Server implementation [synapse](https://github.com/matrix-org/synapse) requires a HTTPS connection
-to an ID server.  
-See the [Integration section](https://github.com/kamax-io/mxisd#integration) for more details.
+The following Quick Start guide assumes you will host the Homeserver and mxisd under the same hostname.  
+If you would like a high-level view of the infrastructure and how each feature is integrated, see the
+[dedicated document](docs/architecture.md)
 
 ## Install
-After [building](#build) the software, run all the following commands as `root` or using `sudo`
-1. Prepare files and directories:
+Install via:
+- [Debian package](docs/install/debian.md)
+- [Docker image](docs/install/docker.md)
+- [Sources](docs/build.md)
+
+See the [Latest release](https://github.com/kamax-io/mxisd/releases/latest) for links to each.
+
+## Configure
+Create/edit a minimal configuration (see installer doc for the location):
 ```
-# Create a dedicated user
-useradd -r mxisd
+matrix.domain: 'MyMatrixDomain.org'
+key.path: '/path/to/signing.key.file'
+storage.provider.sqlite.database: '/path/to/mxisd.db'
+```  
+- `matrix.domain` should be set to your Homeserver domain
+- `key.path` will store the signing keys, which must be kept safe!
+- `storage.provider.sqlite.database` is the location of the SQLite Database file which will hold state (invites, etc.)
 
-# Create bin directory
-mkdir /opt/mxisd
+If your HS/mxisd hostname is not the same as your Matrix domain, configure `server.name`.  
+Complete configuration guide is available [here](docs/configure.md).
 
-# Create config directory and set ownership
-mkdir /etc/mxisd
-chown mxisd /etc/mxisd
-
-# Create data directory and set ownership
-mkdir /var/opt/mxisd
-chown mxisd /var/opt/mxisd
-
-# Copy <repo root>/build/libs/mxisd.jar to bin directory
-cp ./build/libs/mxisd.jar /opt/mxisd/
-chown mxisd /opt/mxisd/mxisd.jar
-chmod a+x /opt/mxisd/mxisd.jar
-
-# Create symlink for easy exec
-ln -s /opt/mxisd/mxisd.jar /usr/bin/mxisd
+## Integrate
+For an overview of a typical mxisd infrastructure, see the [dedicated document](docs/architecture.md)
+### Reverse proxy
+#### Apache2
+In the VirtualHost handling the domain with SSL, add the following line and replace `0.0.0.0` by the right address/host.  
+**This line MUST be present before the one for the homeserver!**
+```
+ProxyPass /_matrix/identity/ http://0.0.0.0:8090/_matrix/identity/
 ```
 
-2. Copy the config file created earlier `./application.yaml` to `/etc/mxisd/mxisd.yaml`
-3. Configure `/etc/mxisd/mxisd.yaml` with production value, `key.path` being the most important - `/var/opt/mxisd/signing.key` is recommended
-4. Copy `<repo root>/src/systemd/mxisd.service` to `/etc/systemd/system/` and edit if needed
-5. Manage service for auto-startup
+Typical VirtualHost configuration would be:
 ```
-# Enable service
-systemctl enable mxisd
+<VirtualHost *:443>
+    ServerName example.org
     
-# Start service
-systemctl start mxisd
+    ...
+    
+    ProxyPreserveHost on
+    ProxyPass /_matrix/identity/ http://10.1.2.3:8090/_matrix/identity/
+    ProxyPass /_matrix/ http://10.1.2.3:8008/_matrix/
+</VirtualHost>
 ```
 
-# Network Discovery
-To allow other federated Identity Server to reach yours, configure the following DNS SRV entry (adapt to your values):
+### Synapse
+Add your mxisd domain into the `homeserver.yaml` at `trusted_third_party_id_servers` and restart synapse.  
+In a typical configuration, you would end up with something similair to:
 ```
-_matrix-identity._tcp.example.com. 3600 IN SRV 10 0 443 matrix.example.com.
+trusted_third_party_id_servers:
+    - matrix.org
+    - vector.im
+    - example.org
 ```
-This would only apply for 3PID that are DNS-based, like e-mails. For anything else, like phone numbers, no federation is currently possible.  
+It is recommended to remove `matrix.org` and `vector.im` so only your own Identity server is allowed by synapse. 
 
-The port must be HTTPS capable. Typically, the port `8090` of mxisd should be behind a reverse proxy which does HTTPS.
-See the [integration section](#integration) for more details.
+### Federation and network discovery
+See the [dedicated document](docs/features/federation.md).
 
-# Integration
-- [HTTPS and Reverse proxy](https://github.com/kamax-io/mxisd/wiki/HTTPS)
-- [synapse](https://github.com/kamax-io/mxisd/wiki/Homeserver-Integration)
+## Validate
+Log in using your Matrix client and set `https://example.org` as your Identity server URL, replacing `example.org` by
+the relevant hostname which you configured in your reverse proxy.  
+Invite `mxisd-lookup-test@kamax.io` to a room, which should be turned into a Matrix invite to `@mxisd-lookup-test:kamax.io`.  
+**NOTE:** you might not see a Matrix suggestion for the e-mail address, which is normal. Still proceed with the invite.
+  
+If it worked, it means you are up and running and can enjoy mxisd in its basic mode! Congratulations!  
+If it did not work, [get in touch](#support) and we'll do our best to get you started.
+
+You can now integrate mxisd further with your infrastructure using the various [features](docs/README.md) guides.
 
 # Support
 ## Community
-If you need help, want to report a bug or just say hi, you can reach us on Matrix at [#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io)  
-For more high-level discussion about the Identity Server architecture/API, go to [#matrix-identity:matrix.org](https://matrix.to/#/#matrix-identity:matrix.org)
+If you need help, want to report a bug or just say hi, you can reach us on Matrix at 
+[#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io) or [directly peek anonymously](https://view.matrix.org/room/!NPRUEisLjcaMtHIzDr:kamax.io/).
+For more high-level discussion about the Identity Server architecture/API, go to 
+[#matrix-identity:matrix.org](https://matrix.to/#/#matrix-identity:matrix.org)
 
 ## Professional
 If you would prefer professional support/custom development for mxisd and/or for Matrix in general, including other open source technologies/products, 
 please visit [our website](https://www.kamax.io/) to get in touch with us and get a quote.
+
+We offer affordable monthly/yearly support plans for mxisd, synapse or your full Matrix infrastructure.
+
+# Contribute
+First and foremost, the best way to contribute is to use mxisd and tell us about it!  
+We would love to hear about your experience and get your feedback on how to make it an awesome product. 
+
+You can contribute as a community member by:
+- Opening issues for any weird behaviour or bug. mxisd should feel natural, let us know if it does not!
+- Helping us improve the documentation: tell us what is good or not good (in an issue or in Matrix), or make a PR with
+changes you feel improve the doc.
+- Contribute code directly: we love contributors! All your contributions will be licensed under AGPLv3.
+- Donate! any donation is welcome, regardless how small or big. This will directly be used for the fixed costs and
+developer time.
+
+You can contribute as an organisation/corporation by:
+- Get a [support contract](#support-professional). This is the best way you can help us as it ensures mxisd is
+maintained regularly and you get direct access to the support team.
+- Sponsoring new features or bug fixes. [Get in touch](#contact) so we can discuss it further.
+
+# FAQ
+### Do I need to use mxisd if I run a Homeserver?
+No, but it is recommended, even if you don't use any backends or integration.
+
+mxisd in its default configuration will use federation and involve the central Matrix.org Identity servers when
+performing queries, giving you access to at least the same information as if you were not running it.
+
+It will also give your users a choice to make their 3PIDs available publicly, ensuring they are made aware of the
+privacy consequences, which is not the case with the central Matrix.org servers.
+
+So mxisd is like your gatekeeper and guardian angel. It does not change what you already know, just adds some nice
+simple features on top of it.
+
+### I already use the synapse LDAP3 auth provider, why should I care about mxisd?
+The [synapse LDAP3 auth provider](https://github.com/matrix-org/matrix-synapse-ldap3) only handles on specific flow:
+validate credentials at login.
+
+It does not:
+- Auto-provision user profiles
+- Integrate with Identity management
+- Integrate with Directory searches
+- Protect you against the username case sensitivites issues in synapse
+
+mxisd is a replacement and enhancement of it, and also offers coherent results in all areas, which LDAP3 auth provider
+does not.
+
+### I saw that sydent is the official Identity server implemenation of the Matrix team, I should use that!
+You can, but [sydent](https://github.com/matrix-org/sydent):
+- [should not be used and/or self-hosted](https://github.com/matrix-org/sydent/issues/22)
+- is not meant to be linked to a specific Homeserver / domain
+- cannot handle federation or proxy lookups, effectively isolating your users from the rest of the network
+- forces you to duplicate all your identity data, so people can be found by 3PIDs
+- forces users to enter all their emails and phone numbers manually in their profile
+
+So really, you should go with mxisd.
+
+### I'm not sure I understand what an "Identity server" is supposed to be or do
+The current Identity service API is more a placeholder, as the Matrix devs did not have time so far to really work on
+what they want to do with that part of the ecosystem. Therefore, "Identity" is a misleading word currently.  
+Given the scope of the current Identity Service API, it would be best called "Invitation service".
+
+Because the current scope is so limited and no integration is done with the Homeserver, there was a big lack of features
+for groups/corporations/organisation. This is where mxisd comes in.
+
+mxisd implements the Identity Service API and also a set of features which are expected by regular users, truly living
+up to its "Identity server" name.
+
+### So mxisd is just a big hack! I don't want to use non-official features!
+mxisd primary concern is to always be compatible with the Matrix ecosystem and the Identity service API.  
+Whenever the API will be updated and/or enhanced, mxisd will follow, remaining 100% compatible with the ecosystem.
+
+We also directly talk with the Matrix developers to ensure all features we implement have their approval, and that we
+are in line with their vision of Identity management within the Matrix ecosystem.
+
+Therefore, using mxisd is a safe choice. It will be like using the central Matrix.org Identity servers, yet not closing
+the door to very nice enhancements and integrations.
+
+### Should I use mxisd if I don't host my own Homeserver?
+No
+
+# Contact
+Get in touch via:
+- Matrix at [#mxisd:kamax.io](https://matrix.to/#/#mxisd:kamax.io)
+- Email, see our website: [Kamax.io](https://www.kamax.io)

application.example.yaml

@@ -1,148 +1,96 @@
-server:
+# Sample configuration file explaining the minimum required keys to be set to run mxisd
+#
+# For a complete list of options, see https://github.com/kamax-io/mxisd
 
-  # Indicate on which port the Identity Server will listen.
-  #
-  # This is be default an unencrypted port.
-  # HTTPS can be configured using Tomcat configuration properties.
-  port: 8090
-
-  # Realm under which this Identity Server is authoritative, required.
-  #
-  # This is used to avoid unnecessary connections and endless recursive lookup.
-  # e.g. domain name in e-mails.
-  name: 'example.org'
+#######################
+# Matrix config items #
+#######################
+# Matrix domain, same as the domain configure in your Homeserver configuration.
+#
+# This is used to build the various identifiers for identity, auth and directory.
+matrix.domain: ''
 
 
-
-key:
-
-  # Absolute path for the Identity Server signing key, required.
-  # During testing, /var/tmp/mxisd.key is a possible value
-  #
-  # For production, use a stable location like:
-  #   - /var/opt/mxisd/sign.key
-  #   - /var/local/mxisd/sign.key
-  #   - /var/lib/mxisd/sign.key
-  path: '%SIGNING_KEYS_PATH%'
+################
+# Signing keys #
+################
+# Absolute path for the Identity Server signing key.
+# During testing, /var/tmp/mxisd.key is a possible value
+#
+# For production, use a stable location like:
+#   - /var/opt/mxisd/sign.key
+#   - /var/local/mxisd/sign.key
+#   - /var/lib/mxisd/sign.key
+key.path: ''
 
 
+############################
+# Persistence config items #
+############################
 
-# This element contains all the configuration item for lookup strategies
-lookup:
+# Configure the storage backend, usually a DB
+# Possible built-in values:
+#   sqlite                      SQLite backend, default
+#
+#storage.backend: 'sqlite'
 
-  # Configuration items for recursion-type of lookup
-  #
-  # Lookup access are divided into two types:
-  # - Local
-  # - Remote
-  #
-  # This is similar to DNS lookup and recursion and is therefore prone to the same vulnerabilities.
-  # By default, only non-public hosts are allowed to perform recursive lookup.
-  #
-  # This will also prevent very basic endless loops where host A ask host B, which in turn is configured to ask host A,
-  # which would then ask host B again, etc.
-  recursive:
-
-    # Enable recursive lookup globally
-    enabled: true
-
-    # Whitelist of CIDR that will trigger a recursive lookup.
-    # The default list includes all private IPv4 address and the IPv6 loopback.
-    allowedCidr:
-      - '127.0.0.0/8'
-      - '10.0.0.0/8'
-      - '172.16.0.0/12'
-      - '192.168.0.0/16'
-      - '::1/128'
-
-    # In case no binding is found, query an application server which implements the single lookup end-point
-    # to return bridge virtual user that would allow the user to be contacted directly by the said bridge.
-    #
-    # If a binding is returned, the application server is not expected to sign the message as it is not meant to be
-    # reachable from the outside.
-    # If a signature is provided, it will be discarded/replaced by this IS implementation (to be implemented).
-    #
-    # IMPORTANT: This bypass the regular Invite system of the Homeserver. It will be up to the Application Server
-    # to handle such invite. Also, if the bridged user were to actually join Matrix later, or if a 3PID binding is found
-    # room rights and history would not be transferred, as it would appear as a regular Matrix user to the Homeserver.
-    #
-    # This configuration is only helpful for Application Services that want to overwrite bridging for 3PID that are
-    # handled by the Homeserver. Do not enable unless the Application Server specifically supports it!
-    bridge:
-
-      # Enable unknown 3PID bridging globally
-      enabled: false
-
-      # Enable unknown 3PID bridging for hosts that are allowed to perform recursive lookups.
-      # Leaving this setting to true is highly recommended in a standard setup, unless this Identity Server
-      # is meant to always return a virtual user MXID even for the outside world.
-      recursiveOnly: true
-
-      # This mechanism can handle the following scenarios:
-      #
-      # - Single Application Server for all 3PID types: only configure the server value, comment out the rest.
-      #
-      # - Specific Application Server for some 3PID types, default server for the rest: configure the server value and
-      #          each specific 3PID type.
-      #
-      # - Only specific 3PID types: do not configure the server value or leave it empty/blank, configure each specific
-      #          3PID type.
-
-      # Default application server to use for all 3PID types. Remove config item or leave empty/blank to disable.
-      server: ''
-
-      # Configure each 3PID type with a specific application server. Remove config item or leave empty/blank to disable.
-      mappings:
-        email: 'http://localhost:8091'
-        msisdn: ''
+# Path to the SQLite DB file
+#
+# Examples:
+#  - /var/opt/mxisd/mxisd.db
+#  - /var/local/mxisd/mxisd.db
+#  - /var/lib/mxisd/mxisd.db
+#
+storage.provider.sqlite.database: '/path/to/mxisd.db'
 
 
+################
+# LDAP Backend #
+################
+# If you would like to integrate with your AD/Samba/LDAP server,
+# see https://github.com/kamax-io/mxisd/blob/master/docs/backends/ldap.md
 
-ldap:
-  enabled: false
-  tls: false
-  host: 'localhost'
-  port: 389
-  bindDn: 'CN=Matrix Identity Server,CN=Users,DC=example,DC=org'
-  bindPassword: 'password'
-  baseDn: 'CN=Users,DC=example,DC=org'
+###############
+# SQL Backend #
+###############
+# If you would like to integrate with a MySQL/MariaDB/PostgreQL/SQLite DB,
+# see https://github.com/kamax-io/mxisd/blob/master/docs/backends/sql.md
 
-  # How should we resolve the Matrix ID in case of a match using the attribute.
-  #
-  # The following type are supported:
-  # - uid : the attribute only contains the UID part of the Matrix ID. e.g. 'john.doe' in @john.doe:example.org
-  # - mxid : the attribute contains the full Matrix ID - e.g. '@john.doe:example.org'
-  type: 'uid'
-
-  # The attribute containing the binding itself. This value will be used differently depending on the type.
-  #
-  # /!\ This should match the synapse LDAP Authenticator 'uid' configuration /!\
-  #
-  # Typical values:
-  # - For type 'uid': 'userPrincipalName' or 'uid' or 'saMAccountName'
-  # - For type 'mxid', regardless of the directory type, we recommend using 'pager' as it is a standard attribute and
-  #   is typically not used.
-  attribute: 'userPrincipalName'
-
-  # Configure each 3PID type with a dedicated query.
-  mappings:
-    email: "(|(mailPrimaryAddress=%3pid)(mail=%3pid)(otherMailbox=%3pid))"
-
-    # Phone numbers query.
-    #
-    # Phone numbers use the MSISDN format: https://en.wikipedia.org/wiki/MSISDN
-    # This format does not include international prefix (+ or 00) and therefore has to be put in the query.
-    # Adapt this to your needs for each attribute.
-    msisdn: "(|(telephoneNumber=+%3pid)(mobile=+%3pid)(homePhone=+%3pid)(otherTelephone=+%3pid)(otherMobile=+%3pid)(otherHomePhone=+%3pid))"
+################
+# REST Backend #
+################
+# If you would like to integrate with an existing web service/webapp,
+# see https://github.com/kamax-io/mxisd/blob/master/docs/backends/rest.md
 
 
+#################################################
+# Notifications for invites/addition to profile #
+#################################################
+# If you would like to change the content,
+# see https://github.com/kamax-io/mxisd/blob/master/docs/threepids/notifications/template-generator.md
+#
+#### E-mail invite sender
+#
+# SMTP host
+threepid.medium.email.connectors.smtp.host: "smtp.example.org"
 
-forward:
+# SMTP port
+threepid.medium.email.connectors.smtp.port: 587
 
-  # List of forwarders to use to try to match a 3PID.
-  #
-  # Each server will be tried in the given order, going to the next if no binding was found or an error occurred.
-  # These are the current root Identity Servers of the Matrix network.
-  servers:
-    - "https://matrix.org"
-    - "https://vector.im"
+# TLS mode for the connection.
+#
+# Possible values:
+#  0    Disable TLS entirely
+#  1    Enable TLS if supported by server (default)
+#  2    Force TLS and fail if not available
+#
+#threepid.medium.email.connectors.smtp.tls: 1
+
+# Login for SMTP
+threepid.medium.email.connectors.smtp.login: "matrix-identity@example.org"
+
+# Password for the account
+threepid.medium.email.connectors.smtp.password: "ThePassword"
+
+# The e-mail to send as. If empty, will be the same as login
+threepid.medium.email.identity.from: "matrix-identity@example.org"

build.gradle

@@ -1,5 +1,3 @@
-import java.util.regex.Pattern
-
 /*
  * mxisd - Matrix Identity Server Daemon
  * Copyright (C) 2017 Maxime Dor
@@ -20,7 +18,9 @@ import java.util.regex.Pattern
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-apply plugin: 'groovy'
+import java.util.regex.Pattern
+
+apply plugin: 'java'
 apply plugin: 'org.springframework.boot'
 
 def confFileName = "application.example.yaml"
@@ -40,11 +40,14 @@ def debBuildConfPath = "${debBuildBasePath}${debConfPath}"
 def debBuildDataPath = "${debBuildBasePath}${debDataPath}"
 def debBuildSystemdPath = "${debBuildBasePath}${debSystemdPath}"
 
+def dockerImageName = "kamax/mxisd"
+def dockerImageTag = "${dockerImageName}:${gitVersion()}"
+
 String gitVersion() {
     def versionPattern = Pattern.compile("v(\\d+\\.)?(\\d+\\.)?(\\d+)(-.*)?")
     ByteArrayOutputStream out = new ByteArrayOutputStream()
     exec {
-        commandLine = [ 'git', 'describe', '--always', '--dirty' ]
+        commandLine = ['git', 'describe', '--always', '--dirty']
         standardOutput = out
     }
     def v = out.toString().replace(System.lineSeparator(), '')
@@ -62,24 +65,28 @@ buildscript {
 }
 
 repositories {
+    maven { url "https://kamax.io/maven/releases/" }
     mavenCentral()
 }
 
 dependencies {
-    // We are a groovy project
-    compile 'org.codehaus.groovy:groovy-all:2.4.7'
-
     // Easy file management
     compile 'commons-io:commons-io:2.5'
 
     // Spring Boot - standalone app
     compile 'org.springframework.boot:spring-boot-starter-web:1.5.3.RELEASE'
 
+    // Thymeleaf for HTML templates
+    compile "org.springframework.boot:spring-boot-starter-thymeleaf:1.5.3.RELEASE"
+
+    // Matrix Java SDK
+    compile 'io.kamax:matrix-java-sdk:0.0.2'
+
     // ed25519 handling
     compile 'net.i2p.crypto:eddsa:0.1.0'
 
     // LDAP connector
-    compile 'org.apache.directory.api:api-all:1.0.0-RC2'
+    compile 'org.apache.directory.api:api-all:1.0.0'
 
     // DNS lookups
     compile 'dnsjava:dnsjava:2.1.8'
@@ -93,7 +100,33 @@ dependencies {
     // Phone numbers validation
     compile 'com.googlecode.libphonenumber:libphonenumber:8.7.1'
 
+    // E-mail sending
+    compile 'com.sun.mail:javax.mail:1.5.6'
+    compile 'javax.mail:javax.mail-api:1.5.6'
+
+    // Google Firebase Authentication backend
+    compile 'com.google.firebase:firebase-admin:5.3.0'
+
+    // ORMLite
+    compile 'com.j256.ormlite:ormlite-jdbc:5.0'
+
+    // Connection Pool
+    compile 'com.mchange:c3p0:0.9.5.2'
+
+    // SQLite
+    compile 'org.xerial:sqlite-jdbc:3.20.0'
+
+    // PostgreSQL
+    compile 'org.postgresql:postgresql:42.1.4'
+
+    // Twilio SDK for SMS
+    compile 'com.twilio.sdk:twilio:7.14.5'
+
+    // SendGrid SDK to send emails from GCE
+    compile 'com.sendgrid:sendgrid-java:2.2.2'
+
     testCompile 'junit:junit:4.12'
+    testCompile 'com.github.tomakehurst:wiremock:2.8.0'
 }
 
 springBoot {
@@ -104,6 +137,17 @@ springBoot {
     ]
 }
 
+processResources {
+    doLast {
+        copy {
+            from('build/resources/main/application.yaml') {
+                rename 'application.yaml', 'mxisd.yaml'
+            }
+            into 'build/resources/main'
+        }
+    }
+}
+
 task buildDeb(dependsOn: build) {
     doLast {
         def v = gitVersion()
@@ -133,10 +177,16 @@ task buildDeb(dependsOn: build) {
             into debBuildConfPath
         }
 
-        ant.replace(
+        ant.replaceregexp(
                 file: "${debBuildConfPath}/${debConfFileName}",
-            token: '%SIGNING_KEYS_PATH%',
-            value: "${debDataPath}/signing.key"
+                match: "key.path:(.*)",
+                replace: "key.path: '${debDataPath}/signing.key'"
+        )
+
+        ant.replaceregexp(
+                file: "${debBuildConfPath}/${debConfFileName}",
+                match: "storage.provider.sqlite.database:(.*)",
+                replace: "storage.provider.sqlite.database: '${debDataPath}/mxisd.db'"
         )
 
         copy {
@@ -182,3 +232,23 @@ task buildDeb(dependsOn: build) {
         }
     }
 }
+
+task dockerBuild(type: Exec, dependsOn: build) {
+    commandLine 'docker', 'build', '-t', dockerImageTag, project.rootDir
+
+    doLast {
+        exec {
+            commandLine 'docker', 'tag', dockerImageTag, "${dockerImageName}:latest-dev"
+        }
+    }
+}
+
+task dockerPush(type: Exec) {
+    commandLine 'docker', 'push', dockerImageTag
+
+    doLast {
+        exec {
+            commandLine 'docker', 'push', "${dockerImageName}:latest-dev"
+        }
+    }
+}

docs/README.md

@@ -0,0 +1,25 @@
+# Table of Contents
+
+- Installation
+  - [Debian package](install/debian.md)
+  - [Docker](install/docker.md)
+- [Build from source](build.md)
+- [Architecture overview](architecture.md)
+- [Configuration](configure.md)
+- Features
+  - [Matrix Identity Service](features/identity.md)
+  - [Homeserver Authentication](features/authentication.md)
+  - [Directory seach](features/directory-users.md)
+  - [Identity server Federation](features/federation.md)
+  - [Bridge integration](features/bridge-integration.md)
+- Backends
+  - [LDAP](backends/ldap.md)
+  - [SQL](backends/sql.md)
+  - [REST](backends/rest.md)
+  - [Google Firebase](backends/firebase.md)
+- Notifications
+  - Handlers
+    - [Basic](threepids/notifications/basic-handler.md)
+    - [SendGrid](threepids/notifications/sendgrid-handler.md)
+- [Sessions](sessions/3pid.md)
+  - [Views](sessions/3pid-views.md)

docs/architecture.md

@@ -0,0 +1,43 @@
+# Architecture
+## Overview
+### Basic setup without integration or federation
+```
+ Client
+   |
+TCP 443
+   |   +---------------------+            +---------------------------+
+   +-> | Reverse proxy       |            | Homeserver                |
+       |                     | TCP 8008   |                           |
+       |  /_matrix/* -------------------> | - 3PID invite from client |
+       |                     |            |   |                       |
+       |  /_matrix/identity/ |            |   |                       |
+       +--|------------------+            +---|-----------------------+
+          |                                   |
+          +<---------------------------------<+
+          |                                          Backends
+          |   +-------------------+                  +------+    +--------+
+ TCP 8090 +-> | mxisd             |          +-----> | LDAP | -> | SQL DB |
+              |                   |          |       +------+    +--------+ ....
+              | - Profile's 3PIDs >----+     |
+              | - 3PID Invites    |    |     |
+              +-|-----------------+    +>----+
+                |                      |     |       +--------------------------+
+                |                      |     |       | Central Identity service |
+                +>-------------------->+     +-----> | Matrix.org / Vector.im   |
+                |                            TCP 443 +--------------------------+
+             TCP 443
+                |  +------------------------+
+                |  | Remote Federated       |
+                |  | mxisd servers          |
+                |  |                        |
+                +--> - 3PID Invites         |
+                   +------------------------+
+```
+### With Authentication
+See the [dedicated document](features/authentication.md).
+
+### With Directory
+See the [dedicated document](features/directory-users.md).
+
+### With Federation
+See the [dedicated document](features/federation.md).

docs/backends/firebase.md

@@ -0,0 +1,9 @@
+# Google Firebase
+## Configuration
+To be completed. For now, see default structure and values:
+```
+firebase:
+  enabled: false
+  credentials: '/path/to/firebase/credentials.json'
+  database: 'https://my-project.firebaseio.com/'
+```

docs/backends/ldap.md

@@ -0,0 +1,86 @@
+# AD/Samba/LDAP backend
+## Configuration
+### Structure and default values
+```
+ldap:
+  enabled: false
+  filter: ''
+  connection:
+    host: ''
+    tls: false
+    port: 389
+    bindDn: ''
+    bindPassword: ''
+    baseDn: ''
+  attribute:
+    uid:
+      type: 'uid'
+      value: 'userPrincipalName'
+    name: 'displayName'
+    threepid:
+      email:
+        - 'mailPrimaryAddress'
+        - 'mail'
+        - 'otherMailbox'
+      msisdn:
+        - 'telephoneNumber'
+        - 'mobile'
+        - 'homePhone'
+        - 'otherTelephone'
+        - 'otherMobile'
+        - 'otherHomePhone'
+  auth:
+    filter: ''
+  directory:
+    attribute:
+      other: []
+    filter: ''
+  identity:
+    filter: ''
+    medium:
+      email: ''
+      msisdn: ''
+```
+### General
+| Item      | Description                                                                               |
+|-----------|-------------------------------------------------------------------------------------------|
+| `enabled` | Globaly enable/disable the LDAP backend                                                   |
+| `filter`  | Global filter to apply on all LDAP queries. Can be overwritten in each applicable section |
+
+### Connection
+| Item           | Description                                          |
+|----------------|------------------------------------------------------|
+| `host`         | Host to connect to                                   |
+| `port`         | Port to use                                          |
+| `tls`          | boolean to use TLS or not (STARTLS is not supported) |
+| `bindDn`       | Bind DN for authentication                           |
+| `bindPassword` | Bind password                                        |
+| `baseDn`       | Base DN for queries                                  |
+
+### Attributes
+| Item        | Description                                                                                                            |
+|-------------|------------------------------------------------------------------------------------------------------------------------|
+| `uid.type`  | Indicate how to process the User ID (UID) attribute:                                                                   |
+|             |   - `uid` will consider the value as the [Localpart](https://matrix.org/docs/spec/intro.html#user-identifiers)         |
+|             |   - `mxid` will consider the value as a complete [Matrix ID](https://matrix.org/docs/spec/intro.html#user-identifiers) |
+| `uid.value` | Attribute name refering to the User ID. This is typically `userPrincipalName` on AD/Samba setups and `uid` in LDAP     |
+| `name`      | Attribute name that contains the [Display Name](https://matrix.org/docs/spec/intro.html#profiles) of the user          |
+| `threepid`  | Namespace where each key is a 3PID type and contains a list of attributes                                              |
+
+### Authentication
+| Item     | Description                                                                                      |
+|----------|--------------------------------------------------------------------------------------------------|
+| `filter` | Specific user filter applied during authentication. Global filter is used if empty/blank/not set |
+
+### Directory
+| Item              | Description                                                         |
+|-------------------|---------------------------------------------------------------------|
+| `attribute.other` | Additional attributes to be used when performing directory searches |
+| `filter`          | Specific user filter applied during directory search.               |
+|                   | Global filter is used if empty/blank/not set                        |
+
+### Identity
+| Item     | Description                                                                                       |
+|----------|---------------------------------------------------------------------------------------------------|
+| `filter` | Specific user filter applied during identity search. Global filter is used if empty/blank/not set | 
+| `medium` | Namespace to overwrite generated queries from the list of attributes for each 3PID medium         |

docs/backends/rest.md

@@ -0,0 +1,215 @@
+# REST backend
+The REST backend allows you to query identity data in existing webapps, like:
+- Forums (phpBB, Discourse, etc.)
+- Custom Identity stores (Keycloak, ...)
+- CRMs (Wordpress, ...)
+- self-hosted clouds (Nextcloud, ownCloud, ...)
+
+It supports the following mxisd flows:
+- [Authentication](#authentication)
+- [Directory](#directory)
+- [Identity](#identity)
+
+To integrate this backend with your webapp, you will need to implement three specific REST endpoints detailed below.
+
+
+## Configuration
+| Key                            | Default                                      | Description                                          |
+---------------------------------|----------------------------------------------|------------------------------------------------------|
+| rest.enabled                   | false                                        | Globally enable/disable the REST backend             |
+| rest.host                      | *empty*                                      | Default base URL to use for the different endpoints. |
+| rest.endpoints.auth            | /_mxisd/backend/api/v1/auth/login            | Validate credentials and get user profile            |
+| rest.endpoints.directory       | /_mxisd/backend/api/v1/directory/user/search | Search for users by arbitrary input                  |
+| rest.endpoints.identity.single | /_mxisd/backend/api/v1/identity/single       | Endpoint to query a single 3PID                      |
+| rest.endpoints.identity.bulk   | /_mxisd/backend/api/v1/identity/bulk         | Endpoint to query a list of 3PID                     |
+
+Endpoint values can handle two formats:
+- URL Path starting with `/` that gets happened to the `rest.host`
+- Full URL, if you want each endpoint to go to a specific server/protocol/port
+
+`rest.host` is mandatory if at least one endpoint is not a full URL.
+
+## Endpoints
+### Authentication
+HTTP method: `POST`  
+Content-type: JSON UTF-8
+  
+#### Request Body
+```
+{
+  "auth": {
+    "mxid": "@john.doe:example.org",
+    "localpart": "john.doe",
+    "domain": "example.org",
+    "password": "passwordOfTheUser"
+  }
+}
+```
+
+#### Response Body
+If the authentication fails:
+```
+{
+  "auth": {
+    "success": false
+  }
+}
+```
+
+If the authentication succeed:
+- `auth.id` supported values: `localpart`, `mxid`
+- `auth.profile` and any sub-member are all optional
+```
+{
+  "auth": {
+    "success": true,
+    "id": {
+      "type": "localpart",
+      "value": "john"
+    },
+    "profile": {
+      "display_name": "John Doe",
+      "three_pids": [
+        {
+          "medium": "email",
+          "address": "john.doe@example.org"
+        },
+        {
+          "medium": "msisdn",
+          "address": "123456789"
+        }
+      ]
+    }
+  }
+}
+```
+
+### Directory
+HTTP method: `POST`
+Content-type: JSON UTF-8
+
+#### Request Body
+```
+{
+  "by": "<search type>",
+  "search_term": "doe"
+}
+```
+`by` can be:
+- `name`
+- `threepid`
+
+#### Response Body:
+If users found:
+```
+{
+  "limited": false,
+  "results": [
+    {
+      "avatar_url": "http://domain.tld/path/to/avatar.png",
+      "display_name": "John Doe",
+      "user_id": "UserIdLocalpart"
+    },
+    {
+      ...
+    }
+  ]
+}
+```
+
+If no user found:
+```
+{
+  "limited": false,
+  "results": []
+}
+```
+
+### Identity
+#### Single 3PID lookup
+HTTP method: `POST`  
+Content-type: JSON UTF-8  
+  
+#### Request Body
+```
+{
+  "lookup": {
+    "medium": "email",
+    "address": "john.doe@example.org"
+  }
+}
+```
+
+#### Response Body
+If a match was found:
+- `lookup.id.type` supported values: `localpart`, `mxid`
+```
+{
+  "lookup": {
+    "medium": "email",
+    "address": "john.doe@example.org",
+    "id": {
+      "type": "mxid",
+      "value": "@john:example.org"
+    }
+  }
+}
+```
+
+If no match was found:
+```
+{}
+```
+
+#### Bulk 3PID lookup
+HTTP method: `POST`  
+Content-type: JSON UTF-8  
+  
+#### Request Body
+```
+{
+  "lookup": [
+    {
+      "medium": "email",
+      "address": "john.doe@example.org"
+    },
+    {
+      "medium": "msisdn",
+      "address": "123456789"
+    }
+  ]
+}
+```
+
+#### Response Body
+For all entries where a match was found:
+- `lookup[].id.type` supported values: `localpart`, `mxid`
+```
+{
+  "lookup": [
+    {
+      "medium": "email",
+      "address": "john.doe@example.org",
+      "id": {
+        "type": "localpart",
+        "value": "john"
+      }
+    },
+    {
+      "medium": "msisdn",
+      "address": "123456789",
+      "id": {
+        "type": "mxid",
+        "value": "@jane:example.org"
+      }
+    }
+  ]
+}
+```
+
+If no match was found:
+```
+{
+  "lookup": []
+}
+```

docs/backends/sql.md

@@ -0,0 +1,23 @@
+# SQL Backend
+## Configuration
+To be completed. For now, see default structure and values:
+```
+sql:
+  enabled: false
+  type: 'sqlite' or 'postgresql'
+  connection: ''
+  auth:
+    enabled: false
+  directory:
+    enabled: false
+    query:
+      name:
+        type: 'localpart'
+        value: 'SELECT 1'
+      threepid:
+        type: 'localpart'
+        value: 'SELECT 1'
+  identity:
+    type: 'localpart'
+    query: 'SELECT user_id AS uid FROM user_threepids WHERE medium = ? AND address = ?'
+```

docs/build.md

@@ -0,0 +1,105 @@
+# From source
+- [Binaries](#binaries)
+- [Debian package](#debian-package)
+- [Docker image](#docker-image)
+
+## Binaries
+### Requirements
+- JDK 1.8
+
+### Build
+```
+git clone https://github.com/kamax-io/mxisd.git
+cd mxisd
+./gradlew build
+```
+
+Create a new configuration file by coping `application.example.yaml` to `application.yaml` and edit to your needs.  
+For advanced configuration, see the [Configure section](configure.md).
+
+Start the server in foreground to validate the build and configuration:
+```
+java -jar build/libs/mxisd.jar
+```
+
+Ensure the signing key is available:
+```
+$ curl 'http://localhost:8090/_matrix/identity/api/v1/pubkey/ed25519:0'
+{"public_key":"..."}
+```
+
+Test basic recursive lookup (requires Internet connection with access to TCP 443):
+```
+$ curl 'http://localhost:8090/_matrix/identity/api/v1/lookup?medium=email&address=mxisd-lookup-test@kamax.io'
+{"address":"mxisd-lookup-test@kamax.io","medium":"email","mxid":"@mxisd-lookup-test:kamax.io",...}
+```
+
+If you enabled LDAP, you can also validate your config with a similar request after replacing the `address` value with
+something present within your LDAP
+```
+curl 'http://localhost:8090/_matrix/identity/api/v1/lookup?medium=email&address=john.doe@example.org'
+```
+
+If you plan on testing the integration with a homeserver, you will need to run an HTTPS reverse proxy in front of it
+as the reference Home Server implementation [synapse](https://github.com/matrix-org/synapse) requires a HTTPS connection
+to an ID server.  
+See the [Integration section](#integration) for more details.
+
+### Install
+1. Prepare files and directories:
+```
+# Create a dedicated user
+useradd -r mxisd
+
+# Create bin directory
+mkdir /opt/mxisd
+
+# Create config directory and set ownership
+mkdir /etc/opt/mxisd
+chown mxisd /etc/opt/mxisd
+
+# Create data directory and set ownership
+mkdir /var/opt/mxisd
+chown mxisd /var/opt/mxisd
+
+# Copy <repo root>/build/libs/mxisd.jar to bin directory
+cp ./build/libs/mxisd.jar /opt/mxisd/
+chown mxisd /opt/mxisd/mxisd.jar
+chmod a+x /opt/mxisd/mxisd.jar
+
+# Create symlink for easy exec
+ln -s /opt/mxisd/mxisd.jar /usr/bin/mxisd
+```
+
+2. Copy the sample config file `./application.example.yaml` to `/etc/opt/mxisd/mxisd.yaml`, edit to your needs
+4. Copy `<repo root>/src/systemd/mxisd.service` to `/etc/systemd/system/` and edit if needed
+5. Enable service for auto-startup
+```
+systemctl enable mxisd
+```
+6. Start mxisd
+```
+systemctl start mxisd
+```
+
+## Debian package
+### Requirements
+- fakeroot
+- dpkg-deb
+
+### Build
+[Build mxisd](#build) then:
+```
+./gradlew buildDeb 
+```
+You will find the debian package in `build/dist`
+
+## Docker image
+[Build mxisd](#build) then:
+```
+./gradlew dockerBuild
+```
+You can run a container of the given image and test it with the following command (adapt volumes host paths):
+```
+docker run -v /data/mxisd/etc:/etc/mxisd -v /data/mxisd/var:/var/mxisd -p 8090:8090 -t kamax/mxisd:latest-dev
+```

docs/configure.md

@@ -0,0 +1,183 @@
+# Configuration
+- [Syntax](#syntax)
+- [Variables](#variables)
+- [Categories](#categories)
+
+## Syntax
+The configuration file is YAML based, allowing two types of syntax.
+
+Properties-like:
+```
+my.config.item: 'value'
+```
+
+Object-like:
+```
+my:
+  config:
+    item: 'value'
+
+```
+These can also be combined within the same file.  
+Both syntax will be used interchangeably in these documents.
+
+Default values for each possible option are documented [here](../src/main/resources/application.yaml)
+
+## Variables
+It is possible to copy the value of a configuration item into another using the syntax `${config.key.item}`.  
+Example that will copy the value of `matrix.domain` into `server.name`:
+```
+matrix:
+  domain: 'example.org'
+
+server:
+  name: '${matrix.domain}'
+```
+
+**WARNING:** mxisd might overwrite/adapt some values during launch. Those changes will not be reflected into copied keys.
+
+## Categories
+For each category below, the base configuration path will be given, which needs to be appened to every configuration
+item described.
+
+Example: if the base path was `basePath` and the following table was given:
+
+| Name | Purpose |
+|------|---------|
+| item1 | To give an example |
+| item2 | To give another example |
+
+The following configurations could be used, all being equivalent:
+```
+basePath.item1: 'myValue'
+basePath.item2: 'myOtherValue'
+```
+```
+basePath:
+  item1: 'myValue'
+  item2: 'myOtherValue'
+```
+```
+basePath.item1: 'myValue'
+basePath:
+  item2: 'myOtherValue'
+```
+
+---
+
+In case a relative base path is given, it is appended to the one above.
+
+Example: With base path `basePath`, the relative base `relativeBasePath` and the following table:
+  
+| Name | Purpose |
+|------|---------|
+| item1 | To give an example |
+| item2 | To give another example |
+
+The following configurations could be used, all being equivalent:
+```
+basePath.relativeBasePath.item1: 'myValue'
+basePath.relativeBasePath.item2: 'myOtherValue'
+```
+```
+basePath:
+  relativeBasePath:
+    item1: 'myValue'
+    item2: 'myOtherValue'
+```
+```
+basePath.relativeBasePath.item1: 'myValue'
+basePath:
+  relativeBasePath:
+    item2: 'myOtherValue'
+```
+
+### Matrix
+Base path: `matrix`
+
+| Name | Purpose |
+|------|---------|
+| `domain` | Matrix domain name, same as the Homeserver, used to build appropriate Matrix IDs |
+
+---
+
+Relative base path: `identity`
+
+| Name | Purpose |
+|------|---------|
+| `servers` | Namespace to create arbitrary list of Identity servers, usable in other parts of the configuration |
+
+Example:
+```
+matrix.identity.servers:
+  root:
+    - 'https://matrix.org'
+```
+Create a list under the label `root` containing a single Identity server, `https://matrix.org`
+### Server
+| Name | Purpose |
+|------|---------|
+| `name` | Public hostname of mxisd, if different from the Matrix domain |
+| `port` | HTTP port to listen on (unencrypted) |
+| `publicUrl` | Defaults to `https://${server.name}` |
+
+### Storage
+Base path: `storage`
+
+| Name | Purpose |
+|------|---------|
+| `backend` | Specify which SQL backend to use. only `sqlite` is currently supported. |
+
+---
+Relative base path: `provider.sqlite`
+
+| Name | Purpose |
+|------|---------|
+| `database` | Absolute location of the SQLite database |
+
+### Backends
+- [LDAP](backends/ldap.md)
+- [SQL](backends/sql.md)
+- [REST](backends/rest.md)
+- [Google Firebase](backends/firebase.md)
+
+### Lookups
+work in progress, should not be configured.
+
+### Sessions
+See the [dedicated document](sessions/3pid.md)
+
+### Notifications
+Base path: `notification`
+
+| Name | Purpose |
+|------|---------|
+| handler | Namespace to specify the handler to use for each 3PID |
+| handlers | Namespace used by individual handlers for their own configuration |
+
+Example:
+```
+notification:
+  handler:
+    email: 'sendgrid'
+    msisdn: 'raw'
+  handlers:
+    raw:
+      ...
+    sendgrid:
+      ...
+```
+- Emails notifications would use the `sendgrid` handler, which define its own configuration user `handlers.sendgrid`
+- Phone notification would use the `raw` handler, basic default built-in handler of mxisd
+#### Handlers
+Relative base path: `handlers`
+
+Built-in:
+- [Basic](threepids/notifications/basic-handler.md)
+- [SendGrid](threepids/notifications/sendgrid-handler.md)
+
+### Views
+See the [dedicated document](sessions/3pid-views.md)
+
+### DNS Overwite
+Specific to other features.

docs/features/authentication.md

@@ -0,0 +1,28 @@
+# Authentication
+Performed via [synapse with REST auth module](https://github.com/kamax-io/matrix-synapse-rest-auth/blob/master/README.md)  
+Point the `endpoint` to mxisd internal IP on port 8090
+
+## Overview
+```
+                                                                                    Backends
+ Client                                                                             +------+
+   |                                            +-------------------------+    +--> | LDAP |
+   |   +---------------+  /_matrix/identity     | mxisd                   |    |    +------+
+   +-> | Reverse proxy | >------------------+   |                         |    |
+       +--|------------+                    |   |                         |    |    +--------+
+          |                                 +-----> Check wiht backends >------+--> | SQL DB |
+     Login request                          |   |                         |    |    +--------+
+          |                                 |   |     |                   |    |
+          |   +--------------------------+  |   +-----|-------------------+    +-->  Others
+          +-> | Homeserver               |  |         |
+              |                          |  |         |
+              | - Validate credentials >----+         |
+              |   Using REST auth module |            |
+              |                          |            |
+              | - Auto-provision <-------------------<+
+              |   user profiles          |    If valid credentials and supported by backend
+              +--------------------------+
+```
+
+## Profile auto-fill
+To be documented

docs/features/bridge-integration.md

@@ -0,0 +1 @@
+To be documented

docs/features/directory-users.md

@@ -0,0 +1,167 @@
+# User Directory
+- [Description](#description)
+- [Overview](#overview)
+- [Requirements](#requirements)
+- [Configuration](#configuration)
+  - [Reverse Proxy](#reverse-proxy)
+  - [DNS Overwrite](#dns-overwrite)
+  - [Backends](#backends)
+    - [LDAP](#ldap)
+    - [SQL](#sql)
+    - [REST](#rest)
+
+## Description
+This feature allows you to search for existing and/or potential users that are already present in your Identity backend
+or that already share a room with you on the Homeserver.
+
+Without any integration, synapse:
+- Only search within the users **already** known to you
+- Only search on the Display Name and the Matrix ID
+
+With mxisd integration, you can:
+- Search on Matrix ID, Display name and 3PIDs (Email, phone numbers) of any users already in your configured backend
+- Search for users which you are not in contact with yet. Super useful for corporations who want to give Matrix access
+internally, so users can just find themselves **prior** to having any common room(s)
+- Use any attribute of your backend to extend the search!
+- Include your homeserver search results to those found by mxisd (default behaviour, no configuration required)
+
+By integrating mxisd, you get the default behaviour with all the extras, ensuring your users will always find each other.
+
+## Overview
+This is performed by intercepting the Homeserver endpoint `/_matrix/client/r0/user_directory/search` like so:
+```
+           +----------------------------------------------+
+Client --> | Reverse proxy                                                                         Step 2
+           |                                              Step 1    +-------------------------+
+           |   /_matrix/client/r0/user_directory/search ----------> |                         |  Search in   +---------+
+           |                        /\                              | mxisd - Identity server | -----------> | Backend |
+           |   /_matrix/*            \----------------------------- |                         |  all users   +---------+
+           |        |            Step 4: Send back merged results   +-------------------------+
+           +        |                                                            |
+                    |                                                          Step 3
+                    |                                                            |
+                    |    +------------+                                Search in known users
+                    \--> | Homeserver | <----------------------------------------/
+                         +------------+   /_matrix/client/r0/user_directory/search
+```
+Steps:
+1. The intercepted request is directly sent to mxisd instead of the Homeserver.
+2. Enabled backends are queried for any match on the search value sent by the client.
+3. The Homeserver, from which the request was intercepted, is queried using the same request as the client.
+Its address is resolved using the DNS Overwrite feature to reach its internal address on a non-encrypted port.
+4. Results from backends and the Homeserver are merged together and sent back to the client, believing it was the HS
+which directly answered the request.
+
+## Requirements
+- Reverse proxy setup, which you should already have in place if you use mxisd
+- Compatible backends:
+  - LDAP
+  - SQL
+  - REST
+  
+## Configuration
+### Reverse Proxy
+Apache2 configuration to put under the relevant virtual domain:
+```
+ProxyPreserveHost on
+ProxyPass /_matrix/identity/ http://mxisdInternalIpAddress:8090/_matrix/identity/
+ProxyPass /_matrix/client/r0/user_directory/ http://mxisdInternalIpAddress:8090/_matrix/client/r0/user_directory/
+ProxyPass /_matrix/ http://HomeserverInternalIpAddress:8008/_matrix/
+```
+`ProxyPreserveHost` or equivalent must be enabled to detect to which Homeserver mxisd should talk to when building
+results.
+
+### DNS Overwrite
+Just like you need to configure a reverse proxy to send client requests to mxisd, you also need to configure mxisd with
+the internal IP of the Homeserver so it can talk to it directly to integrate its directory search.
+
+To do so, use the following configuration:
+```
+dns.overwrite.homeserver.client:
+  - name: 'example.org'
+    value: 'http://localhost:8008'
+```
+`name` must be the hostname of the URL that clients use when connecting to the Homeserver.  
+In case the hostname is the same as your Matrix domain, you can use `${matrix.domain}` to auto-populate the value using
+the `matrix.domain` configuration option and avoid duplicating it.
+
+`value` is the base intenral URL of the Homeserver, without any `/_matrix/..` or trailing `/`.
+
+### Backends
+#### LDAP
+To ensure Directory feature works, here's how the LDAP configuration should look like:
+```
+ldap:
+  enabled: false
+  filter: '(memberOf=CN=Matrix Users,OU=Groups,DC=example,DC=org)'
+  connection:
+    host: 'ldapIpOrDomain'
+    bindDn: 'CN=Matrix Identity Server,OU=Accounts,DC=example,DC=org'
+    bindPassword: 'mxisd'
+    baseDn: 'OU=Accounts,DC=example,DC=org'
+  attribute:
+    uid:
+      type: 'uid'
+      value: 'userPrincipalName'
+    name: 'displayName'
+    threepid:
+      email:
+        - 'mailPrimaryAddress'
+        - 'mail'
+        - 'otherMailbox'
+      msisdn:
+        - 'telephoneNumber'
+        - 'mobile'
+        - 'homePhone'
+        - 'otherTelephone'
+        - 'otherMobile'
+        - 'otherHomePhone'
+  directory:
+    attribute:
+      other:
+        - 'employeeNumber'
+        - 'someOtherAttribute'
+```
+Only include the `attribute` sub-sections if you would like to set another value. Else, it is best not to include them
+to inherit the default values.
+
+If you would like to include an attribute which is not a display name or a 3PID, you can use the
+`directory.attribute.other` to list any extra attributes you want included in searches. If you do not want to include
+any extra attribute, that configuration section can be skipped. 
+
+#### SQL
+If you plan to integrate directory search directly with synapse, use the `synapseSql` provider, based on the following
+config:
+```
+synapseSql:
+  enabled: true
+  type: <database ID>
+  connection: '<connection info>'
+```
+`type` and `connection`, including any other configuration item, follow the same values as the regular [SQL backend](../backends/sql.md).
+
+---
+
+For the regular SQL backend, the following configuration items are available:
+```
+sql:
+  directory:
+    enabled: true
+    query:
+      name:
+        type: 'localpart'
+        value: 'SELECT idColumn, displayNameColumn FROM table WHERE displayNameColumn LIKE ?'
+      threepid:
+        type: 'localpart'
+        value: 'SELECT idColumn, displayNameColumn FROM table WHERE threepidColumn LIKE ?'
+```
+For each query, `type` can be used to tell mxisd how to process the ID column:
+- `localpart` will append the `matrix.domain` to it
+- `mxid` will use the ID as-is. If it is not a valid Matrix ID, the search will fail.
+
+`value` is the SQL query and must return two columns:
+- The first being the User ID
+- The second being its display name
+
+#### REST
+See the [dedicated document](../backends/rest.md)

docs/features/federation.md

@@ -0,0 +1,33 @@
+# Identity service Federation
+## Overview
+```
+              +-------------------+   +-------------> +----------+
+              | mxisd             |   |               | Backends |
+              |                   |   |      +------> +----------+
+              |                   |   |      |
+              | Invites / Lookups |   |      |
+ Federated    | +--------+        |   |      |        +-------------------+
+ Identity  ---->| Remote |>-----------+      +------> | Remote Federated  |
+ Server       | +--------+        |          |        | mxisd servers     |
+              |                   |          |        +-------------------+
+              | +--------+        |          |
+ Homeserver --->| Local  |>------------------+
+ and clients  | +--------+        |          |        +--------------------------+ 
+              +-------------------+          +------> | Central Identity service |
+                                                      | Matrix.org / Vector.im   |
+                                                      +--------------------------+
+```
+To allow other federated Identity Server to reach yours, the same algorithm used for Homeservers takes place:
+1. Check for the appropriate DNS SRV record
+2. If not found, use the base domain
+
+## Configuration
+If your Identity Server public hostname does not match your Matrix domain, configure the following DNS SRV entry 
+and replace `matrix.example.com` by your Identity server public hostname - **Make sure to end with a final dot!**
+```
+_matrix-identity._tcp.example.com. 3600 IN SRV 10 0 443 matrix.example.com.
+``` 
+This would only apply for 3PID that are DNS-based, like e-mails. For anything else, like phone numbers, no federation 
+is currently possible.  
+
+The port must be HTTPS capable which is what you get in a regular setup with a reverse proxy from 443 to TCP 8090 of mxisd.

docs/features/identity.md

@@ -0,0 +1,3 @@
+To be documented.
+
+Implementation of the [Matrix Identity service API](https://matrix.org/docs/spec/identity_service/unstable.html)

docs/install/debian.md

@@ -0,0 +1,39 @@
+# Debian package
+## Install
+1. Donwload the [latest release](https://github.com/kamax-io/mxisd/releases/latest)
+2. Run:
+```
+dpkg -i /path/to/downloaded/mxisd.deb
+```
+## Files
+| Location                          | Purpose                                      |
+|-----------------------------------|----------------------------------------------|
+| /etc/mxisd                        | Configuration directory                      |
+| /etc/mxisd/mxisd.yaml             | Main configuration file                      |
+| /etc/mxisd/signing.key            | Default location for mxisd signing keys      |
+| /etc/systemd/system/mxisd.service | Systemd configuration file for mxisd service |
+| /usr/lib/mxisd                    | Binairies                                    |
+| /var/lib/mxisd                    | Data                                         |
+
+## Control
+Start mxisd using:
+```
+sudo systemctl start mxisd
+```
+
+Stop mxisd using:
+```
+sudo systemctl stop mxisd
+```
+
+## Troubleshoot
+All logs are sent to `STDOUT` which are saved in `/var/log/syslog` by default.  
+You can:
+- grep & tail using `mxisd`:
+```
+tail -n 99 -f /var/log/syslog | grep mxisd
+```
+- use Systemd's journal:
+```
+journalctl -f n 99 -u mxisd
+```

docs/install/docker.md

@@ -0,0 +1,14 @@
+# Docker
+## Fetch
+Pull the latest stable image:
+```
+docker pull kamax/mxisd
+```
+
+## Run
+Run it (adapt volume paths to your host):
+```
+docker run --rm -v /data/mxisd/etc:/etc/mxisd -v /data/mxisd/var:/var/mxisd -p 8090:8090 -t kamax/mxisd
+```
+
+For more info, including the list of possible tags, see [the public repository](https://hub.docker.com/r/kamax/mxisd/)

docs/sessions/3pid-views.md

@@ -0,0 +1,82 @@
+# Web pages for the 3PID session processes
+You can customize the various pages used during a 3PID validation using [Thymeleaf templates](http://www.thymeleaf.org/).
+
+## Configuration
+```
+view:
+  session:
+    local:
+      onTokenSubmit:
+        success: '/path/to/session/local/tokenSubmitSuccess-page.html'
+        failure: '/path/to/session/local/tokenSubmitFailure-page.html'
+    localRemote:
+      onTokenSubmit:
+        success: '/path/to/session/localRemote/tokenSubmitSuccess-page.html'
+        failure: '/path/to/session/local/tokenSubmitFailure-page.html'
+    remote:
+      onRequest:
+        success: '/path/to/session/remote/requestSuccess-page.html'
+        failure: '/path/to/session/remote/requestFailure-page.html'
+      onCheck:
+        success: '/path/to/session/remote/checkSuccess-page.html'
+        failure: '/path/to/session/remote/checkFailure-page.html'
+```
+3PID session are divided into three config sections:
+- `local` for local-only 3PID sessions
+- `localRemote` for local 3PID sessions that can also be turned into remote sessions, if the user so desires
+- `remote` for remote-only 3PID sessions
+
+Each section contains a sub-key per support event. Finally, a `success` and `failure` key is available depending on the
+outcome of the request.
+
+## Local
+### onTokenSubmit
+This is triggered when a user submit a validation token for a 3PID session. It is typically visited when clicking the
+link in a validation email.
+
+The template should typically inform the user that the validation was successful and to go back in their Matrix client
+to finish the validation process.
+
+#### Placeholders
+No object/placeholder are currently available.
+
+## Local & Remote
+### onTokenSubmit
+This is triggered when a user submit a validation token for a 3PID session. It is typically visited when clicking the
+link in a validation email.
+
+The template should typically inform the user that their 3PID address will not yet be publicly/globally usable. In case
+they want to make it, they should start a Remote 3PID session with a given link or that they can go back to their Matrix
+client if they do not wish to proceed any further.
+
+#### Placeholders
+##### Success
+`<a th:href="${remoteSessionLink}">text</a>` can be used to display the link to start a Remote 3PID session.
+
+##### Failure
+No object/placeholder are currently available.
+
+## Remote
+### onRequest
+This is triggered when a user starts a Remote 3PID session, usually from a link produced in the `local.onTokenSubmit`
+view or in a remote-only 3PID notification.
+
+The template should typically inform the user that the remote creation was successful, followed the instructions sent by
+the remote Identity server and, once that is done, click a link to validate the session.
+
+#### Placeholders
+##### Success
+`<a th:href="${checkLink}">text</a>` can be used to display the link to validate the Remote 3PID session.
+
+##### Failure
+No object/placeholder are currently available.
+
+### onCheck
+This is triggered when a user attempts to inform the Identity server that the Remote 3PID session has been validated
+with the remote Identity server.
+
+The template should typically inform the user that the validation was successful and to go back in their Matrix client
+to finish the validation process.
+
+#### Placeholders
+No object/placeholder are currently available.

docs/sessions/3pid.md

@@ -0,0 +1,338 @@
+# 3PID Sessions
+- [Overview](#overview)
+- [Purpose](#purpose)
+- [Federation](#federation)
+  - [3PID scope](#3pid-scope)
+  - [Session scope](#session-scope)
+- [Notifications](#notifications)
+  - [Email](#email)
+  - [Phone numbers](#msisdn-phone-numbers)
+- [Usage](#usage)
+  - [Configuration](#configuration)
+  - [Web views](#web-views)
+  - [Scenarios](#scenarios)
+    - [Default](#default)
+    - [Local sessions only](#local-sessions-only)
+    - [Remote sessions only](#remote-sessions-only)
+    - [Sessions disabled](#sessions-disabled)
+
+## Overview
+When adding an email, a phone number or any other kind of 3PID (Third-Party Identifier) in a Matrix client, 
+the identity server is called to validate the 3PID.
+
+Once this 3PID is validated, the Homeserver will publish the user Matrix ID on the Identity Server and
+add this 3PID to the Matrix account which initiated the request.
+
+## Purpose
+This serves two purposes:
+- Add the 3PID as an administrative/login info for the Homeserver directly
+- Publish, or *Bind*, the 3PID so it can be queried from Homeservers and clients when inviting someone in a room
+by a 3PID, allowing it to be resolved to a Matrix ID.
+
+## Federation
+Federation is based on the principle that one can get a domain name and serve services and information within that
+domain namespace in a way which can be discovered following a specific protocol or specification.
+
+In the Matrix eco-system, some 3PID can be federated (e.g. emails) while some others cannot (phone numbers).
+Also, Matrix users might add 3PIDs that would not point to the Identity server that actually holds the 3PID binding.  
+
+Example: a user from Homeserver `example.org` adds an email `john@gmail.com`.  
+If a federated lookup was performed, Identity servers would try to find the 3PID bind at the `gmail.com` server, and
+not `example.org`.
+
+To allow global publishing of 3PID bindings to be found anywhere within the current protocol specification, one would
+perform a *Remote session* and *Remote bind*, effectively starting a new 3PID session with another Identity server on
+behalf of the user.  
+To ensure lookup works consistency within the current Matrix network, the central Matrix.org Identity Server should be
+used to store *remote* sessions and binds.
+
+On the flip side, at the time of writing, the Matrix specification and the central Matrix.org servers do not allow to
+remote a 3PID bind. This means that once a 3PID is published (email, phone number, etc.), it cannot be easily remove
+and would require contacting the Matrix.org administrators for each bind individually.  
+This poses a privacy, control and security concern, especially for groups/corporations that want to keep a tight control
+on where such identifiers can be made publicly visible.
+
+To ensure full control, validation management rely on two concepts:
+- The scope of 3PID being validated
+- The scope of 3PID sessions that should be possible/offered
+
+### 3PID scope
+3PID can either be scoped as local or remote.
+
+Local means that they can looked up using federation and that such federation call would end up on the local
+Identity Server.  
+Remote means that they cannot be lookup using federation or that a federation call would not end up on the local
+Identity Server.
+
+Email addresses can either be local or remote 3PID, depending on the domain. If the address is one from the configured
+domain in the Identity server, it will be scoped as local. If it is from another domain, it will be as remote.
+
+Phone number can only be scoped as remote, since there is currently no way to perform DNS queries that would lead back
+to the Identity server who validated the phone number.
+
+### Session scope
+Sessions can be scoped as:
+- Local only - validate 3PIDs directly, do not allow the creation of 3PID sessions on a remote Identity server.
+- Local and Remote - validate 3PIDs directly, offer users to option to also validate and bind 3PID on another server.
+- Remote only - validate and bind 3PIDs on another server, no validation or bind done locally.
+
+---
+
+**IMPORTANT NOTE:** mxisd does not store bindings directly. While a user can see its email, phone number or any other
+3PID in its settings/profile, it does **NOT** mean it is published anywhere and can be used to invite/search the user.
+Identity backends (LDAP, REST, SQL) are the ones holding such data.  
+If you still want added arbitrary 3PIDs to be discoverable on your local server, you will need to link mxisd to your
+synapse DB to make it an Identity backend.
+
+See the [Scenarios](#scenarios) for more info on how and why.
+
+## Notifications
+3PIDs are validated by sending a pre-formatted message containing a token to that 3PID address, which must be given to the
+Identity server that received the request. This is usually done by means of a URL to visit for email or a short number
+received by SMS for phone numbers.
+
+mxisd use two components for this:
+- Generator which produces the message to be sent with the necessary information the user needs to validate their session.
+- Connector which actually send the notification (e.g. SMTP for email).
+
+Built-in generators and connectors for supported 3PID types:
+
+### Email
+Generators:
+- [Template](../threepids/notifications/template-generator.md)
+
+Connectors:
+- [SMTP](../threepids/medium/email/smtp-connector.md)
+
+#### MSISDN (Phone numbers)
+Generators:
+- [Template](../threepids/notifications/template-generator.md)
+
+Connectors:
+ - [Twilio](../threepids/medium/msisdn/twilio-connector.md) with SMS
+
+## Usage
+### Configuration
+The following example of configuration (incomplete extract) shows which items are relevant for 3PID sessions.
+
+**IMPORTANT:** Most configuration items shown have default values and should not be included in your own configuration
+file unless you want to specifically overwrite them.  
+Please refer to the full example config file to see which keys are mandatory and to be included in your configuration.
+```
+matrix:
+  identity:
+    servers:
+      configExample: # Not to be included in config! Already present in default config!
+        - 'https://example.org'
+
+
+threepid:
+  medium:
+    email:
+      connector: 'example1' # Not to be included in config! Already present in default config! 
+      generator: 'example2' # Not to be included in config! Already present in default config!
+      connectors:
+        example1:
+      generators:
+        example1:
+          key: "value"
+        example2:
+          key: "value"
+
+session:
+  policy:
+    validation:
+      enabled: true
+      forLocal:
+        enabled: true
+        toLocal: true
+        toRemote:
+          enabled: true
+          server: 'configExample'  # Not to be included in config! Already present in default config!
+      forRemote:
+        enabled: true
+        toLocal: false
+        toRemote:
+          enabled: true
+          server: 'configExample'  # Not to be included in config! Already present in default config!
+```
+
+`matrix.identity.servers` is the namespace to configure arbitrary list of Identity servers with a label as parent key.  
+In the above example, the list with label `configExample` contains a single server entry pointing to `https://example.org`.  
+
+**NOTE:** The server list is set to `root` by default and should typically NOT be included in your config.  
+
+Identity server entry can be of two format:
+- URL, bypassing any kind of domain and port discovery
+- Domain name as `string`, allowing federated discovery to take place.
+
+The label can be used in other places of the configuration, allowing you to only declare Identity servers once.
+
+---
+
+`threepid.medium.<3PID>` is the namespace to configure 3PID specific items, not directly tied to any other component of
+mxisd.  
+In the above example, only `email` is defined as 3PID type.
+
+Each 3PID namespace comes with 4 configuration key allowing you to configure generators and connectors for notifications:
+- `connectors` is a configuration namespace to be used for any connector configuration. Child keys represent the unique
+ID for each connector.
+- `generators` is a configuration namespace to be used for any generator configuration. Child keys represent the unique
+ID for each generator.
+- `connector` is given the ID of the connector to be used at runtime.
+- `generator` is given the ID of the generator to be used at runtime.
+
+In the above example, emails notifications are generated by the `example2` module and sent with the `example1` module.  
+By default, `template` is used as generator and `smtp` as connector.
+
+---
+
+`session.policy.validation` is the core configuration to control what users configured to use your Identity server
+are allowed to do in terms of 3PID sessions.
+
+The policy is divided contains a global on/off switch for 3PID sessions using `.enabled`  
+It is also divided into two sections: `forLocal` and `forRemote` which refers to the 3PID scopes.  
+
+Each scope is divided into three parts:
+- global on/off switch for 3PID sessions using `.enabled`
+- `toLocal` allowing or not local 3PID session validations
+- `toRemote` allowing or not remote 3PID session validations and to which server such sessions should be sent. 
+`.server` takes a Matrix Identity server list label. Only the first server in the list is currently used.
+
+If both `toLocal` and `toRemote` are enabled, the user will be offered to initiate a remote session once their 3PID
+locally validated.
+
+### Web views
+Once a user click on a validation link, it is taken to the Identity Server validation page where the token is submited.  
+If the session or token is invalid, an error page is displayed.  
+Workflow pages are also available for the remote 3PID session process.
+
+See [the dedicated document](3pid-views.md)
+on how to configure/customize/brand those pages to your liking.
+
+### Scenarios
+It is important to keep in mind that mxisd does not create bindings, irrelevant if a user added a 3PID to their profile.  
+Instead, when queried for bindings, mxisd will query Identity backends which are responsible to store this kind of information.
+
+This has the side effect that any 3PID added to a user profile which is NOT within a configured and enabled Identity backend
+will simply not be usable for search or invites, **even on the same Homeserver!**  
+mxisd does not store binds on purpose, as one of its primary goal is to ensure maximum compatibility with federation
+and the rest of the Matrix ecosystem is preserved.
+
+Nonetheless, because mxisd also aims at offering support for tight control over identity data, it is possible to have
+such 3PID bindings available for search and invite queries on the local Homeserver by using the `SQL` backend and
+configuring it to use the synapse database. Support for `SQLite` and `PostgreSQL` is available.
+
+See the [Local sessions only](#local-sessions-only) use case for more information on how to configure.
+
+#### Default
+By default, mxisd allows the following:
+
+|  | Local Session | Remote Session |
+|----------------|-------|--------|
+| **Local 3PID** | Yes | Yes, offered |
+| **Remote 3PID** | No, Remote forced | Yes |
+
+This is usually what people expect and will feel natural to users and does not involve further integration.
+
+This allows to stay in control for e-mail addresses which domain matches your Matrix environment, still making them
+discoverable with federation but not recorded in a 3rd party Identity server which is not under your control.  
+Users still get the possibility to publish globally their address if needed.
+
+Other e-mail addresses and phone number will be redirected to remote sessions to ensure full compatibility with the Matrix
+ecosystem and other federated servers.
+
+#### Local sessions only
+**NOTE:** This does not affect 3PID lookups (queries to find Matrix IDs) which will remain public due to limitation
+in the Matrix protocol.
+
+This configuration ensures maximum confidentiality and privacy.
+Typical use cases:
+- Private Homeserver, not federated
+- Internal Homeserver without direct Internet access
+- Custom product based on Matrix which does not federate
+
+No 3PID will be sent to a remote Identity server and all validation will be performed locally.  
+On the flip side, people with *Remote* 3PID scopes will not be found from other servers.
+
+Use the following values:
+```
+session:
+  policy:
+    validation:
+      enabled: true
+      forLocal:
+        enabled: true
+        toLocal: true
+        toRemote:
+          enabled: false
+      forRemote:
+        enabled: true
+        toLocal: true
+        toRemote:
+          enabled: false
+```
+
+**IMPORTANT**: When using local-only mode, you will also need to link mxisd to synapse if you want user searches and invites to work.
+To do so, add/edit the following configuration keys:
+```
+sql:
+  enabled: true
+  type: 'postgresql'
+  connection: ''
+```
+- `sql.enabled` set to `true` to activate the SQL backend.
+- `sql.type` can be set to `sqlite` or `postgresql`, depending on your synapse setup.
+- `sql.connection` use a JDBC format which is appened after the `jdbc:type:` connection URI.
+Example values for each type:
+  - `sqlite`: `/path/to/homeserver.db`
+  - `postgresql`: `//localhost/database?user=synapse&password=synapse`
+
+#### Remote sessions only
+This configuration ensures all 3PID are made public for maximum compatibility and reach within the Matrix ecosystem, at
+the cost of confidentiality and privacy.  
+
+Typical use cases:
+- Public Homeserver
+- Homeserver with registration enabled
+
+Use the following values:
+```
+session:
+  policy:
+    validation:
+      enabled: true
+      forLocal:
+        enabled: true
+        toLocal: false
+        toRemote:
+          enabled: true
+      forRemote:
+        enabled: true
+        toLocal: false
+        toRemote:
+          enabled: true
+```
+
+#### Sessions disabled
+This configuration would disable 3PID session altogether, preventing users from adding emails and/or phone numbers to
+their profiles.  
+This would be used if mxisd is also performing authentication for the Homeserver, typically with synapse and the
+[REST Auth module](https://github.com/kamax-io/matrix-synapse-rest-auth).
+
+While this feature is not yet ready in the REST auth module, you would use this configuration mode to auto-populate 3PID
+at user login and prevent any further add.
+
+**This mode comes with several important restrictions:**
+- This does not prevent users from removing 3PID from their profile. They would be unable to add them back!
+- This prevents users from initiating remote session to make their 3PID binds globally visible
+
+It is therefore recommended to not fully disable sessions but instead restrict specific set of 3PID and Session scopes.
+
+Use the following values to enable this mode:
+```
+session:
+  policy:
+    validation:
+      enabled: false
+```

docs/threepids/medium/email/smtp-connector.md

@@ -0,0 +1,19 @@
+# Email notifications - SMTP connector
+Connector ID: `smtp`
+
+Example configuration:
+```
+threepid:
+  medium:
+    email:
+      identity:
+        from: 'identityServerEmail@example.org'
+        name: 'My Identity Server'
+      connectors:
+        smtp:
+          host: 'smtpHostname'
+          port: 587
+          tls: 1 # 0 = no STARTLS, 1 = try, 2 = force
+          login: 'smtpLogin'
+          password: 'smtpPassword'
+```

docs/threepids/medium/msisdn/twilio-connector.md

@@ -0,0 +1,15 @@
+# SMS notifications - Twilio connector
+Connector ID: `twilio`
+
+Example configuration:
+```
+threepid:
+  medium:
+    msisdn:
+      connectors:
+        twilio:
+          accountSid: 'myAccountSid'
+          authToken: 'myAuthToken'
+          number: '+123456789'
+
+```

docs/threepids/notifications/basic-handler.md

@@ -0,0 +1,66 @@
+# Basic Notification handler
+Basic notification handler which uses two components:
+- Content generator, to produce the notifications
+- Connectors to send the notification content
+
+This handler can be used with the 3PID types:
+- `email`
+- `msisdn` (Phone numbers)
+
+## Generators
+- [Template](template-generator.md)
+## Connectors
+- Email
+  - [SMTP](../medium/email/smtp-connector.md)
+- SMS
+  - [Twilio](../medium/msisdn/twilio-connector.md)
+
+## Configuration
+Enabled by default or with:
+```
+notification:
+  handler:
+    email: 'raw'
+```
+
+**WARNING:** Will be consolidated soon, prone to breaking changes.  
+Structure and default values:
+```
+threepid:
+  medium:
+    email:
+      identity:
+        from: ''
+        name: ''
+      connector: 'smtp'
+      generator: 'template'
+      connectors:
+        smtp:
+          host: ''
+          port: 587
+          tls: 1
+          login: ''
+          password: ''
+      generators:
+        template:
+          invite: 'classpath:threepids/email/invite-template.eml'
+          session:
+            validation:
+              local: 'classpath:threepids/email/validate-local-template.eml'
+              remote: 'classpath:threepids/email/validate-remote-template.eml'
+    msisdn:
+      connector: 'twilio'
+      generator: 'template'
+      connectors:
+        twilio:
+          accountSid: ''
+          authToken: ''
+          number: ''
+      generators:
+        template:
+          invite: 'classpath:threepids/sms/invite-template.txt'
+          session:
+            validation:
+              local: 'classpath:threepids/sms/validate-local-template.txt'
+              remote: 'classpath:threepids/sms/validate-remote-template.txt'
+```

docs/threepids/notifications/sendgrid-handler.md

@@ -0,0 +1,9 @@
+# SendGrid Notification handler
+To be completed. See [raw possible configuration items](https://github.com/kamax-io/mxisd/blob/master/src/main/resources/application.yaml#L172).
+
+Enabled with:
+```
+notification:
+  handler:
+    email: 'sendgrid'
+```

docs/threepids/notifications/template-generator.md

@@ -0,0 +1,73 @@
+# Notifications: Generate from templates
+To create notification content, you can use the `template` generator if supported for the 3PID medium which will read
+content from configured files.
+
+Placeholders can be integrated into the templates to dynamically populate such content with relevant information like
+the 3PID that was requested, the domain of your Identity server, etc.
+
+Templates can be configured for each event that would send a notification to the end user. Events share a set of common
+placeholders and also have their own individual set of placeholders.
+
+## Configuration
+To configure paths to the various templates:
+```
+threepid:
+  medium:
+    <YOUR 3PID MEDIUM HERE>:
+      generators:
+        template:
+          invite: '/path/to/invite-template.eml'
+          session:
+            validation:
+              local: '/path/to/validate-local-template.eml'
+              remote: 'path/to/validate-remote-template.eml'
+```
+The `template` generator is usually the default, so no further configuration is needed.
+
+##  Global placeholders
+| Placeholder           | Purpose                                                                      |
+|-----------------------|------------------------------------------------------------------------------|
+| `%DOMAIN%`            | Identity server authoritative domain, as configured in `matrix.domain`       |
+| `%DOMAIN_PRETTY%`     | Same as `%DOMAIN%` with the first letter upper case and all other lower case |
+| `%FROM_EMAIL%`        | Email address configured in `threepid.medium.<3PID medium>.identity.from`    |
+| `%FROM_NAME%`         | Name configured in `threepid.medium.<3PID medium>.identity.name`             |
+| `%RECIPIENT_MEDIUM%`  | The 3PID medium, like `email` or `msisdn`                                    |
+| `%RECIPIENT_ADDRESS%` | The address to which the notification is sent                                |
+
+## Events
+### Room invitation
+This template is used when someone is invited into a room using an email address which has no known bind to a Matrix ID.
+#### Placeholders
+| Placeholder           | Purpose                                                                                  |
+|-----------------------|------------------------------------------------------------------------------------------|
+| `%SENDER_ID%`         | Matrix ID of the user who made the invite                                                |
+| `%SENDER_NAME%`       | Display name of the user who made the invite, if not available/set, empty                |
+| `%SENDER_NAME_OR_ID%` | Display name of the user who made the invite. If not available/set, its Matrix ID        |
+| `%INVITE_MEDIUM%`     | The 3PID medium for the invite.                                                          |
+| `%INVITE_ADDRESS%`    | The 3PID address for the invite.                                                         |
+| `%ROOM_ID%`           | The Matrix ID of the Room in which the invite took place                                 |
+| `%ROOM_NAME%`         | The Name of the room in which the invite took place. If not available/set, empty         |
+| `%ROOM_NAME_OR_ID%`   | The Name of the room in which the invite took place. If not available/set, its Matrix ID |
+
+### Local validation of 3PID Session
+This template is used when to user which added their 3PID address to their profile/settings and the session policy
+allows at least local sessions.  
+
+#### Placeholders
+| Placeholder          | Purpose                                                                              |
+|----------------------|--------------------------------------------------------------------------------------|
+| `%VALIDATION_LINK%`  | URL, including token, to validate the 3PID session.                                  |
+| `%VALIDATION_TOKEN%` | The token needed to validate the local session, in case the user cannot use the link |
+
+### Remote validation of 3PID Session
+This template is used when to user which added their 3PID address to their profile/settings and the session policy only
+allows remote sessions.
+
+**NOTE:** 3PID session always require local validation of a token, even if a remote session is enforced.  
+One cannot bind a Matrix ID to the session until both local and remote sessions have been validated.
+
+#### Placeholders
+| Placeholder          | Purpose                                                |
+|----------------------|--------------------------------------------------------|
+| `%VALIDATION_TOKEN%` | The token needed to validate the session               |
+| `%NEXT_URL%`         | URL to continue with remote validation of the session. |

src/main/groovy/io/kamax/mxisd/config/LdapConfig.groovy

@@ -1,156 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.config
-
-import org.apache.commons.lang.StringUtils
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
-
-@Configuration
-@ConfigurationProperties(prefix = "ldap")
-class LdapConfig implements InitializingBean {
-
-    private Logger log = LoggerFactory.getLogger(LdapConfig.class)
-
-    private boolean enabled
-    private boolean tls
-    private String host
-    private int port
-    private String baseDn
-    private String type
-    private String attribute
-    private String bindDn
-    private String bindPassword
-    private Map<String, String> mappings
-
-    boolean getEnabled() {
-        return enabled
-    }
-
-    void setEnabled(boolean enabled) {
-        this.enabled = enabled
-    }
-
-    boolean getTls() {
-        return tls
-    }
-
-    void setTls(boolean tls) {
-        this.tls = tls
-    }
-
-    String getHost() {
-        return host
-    }
-
-    void setHost(String host) {
-        this.host = host
-    }
-
-    int getPort() {
-        return port
-    }
-
-    void setPort(int port) {
-        this.port = port
-    }
-
-    String getBaseDn() {
-        return baseDn
-    }
-
-    void setBaseDn(String baseDn) {
-        this.baseDn = baseDn
-    }
-
-    String getType() {
-        return type
-    }
-
-    void setType(String type) {
-        this.type = type
-    }
-
-    String getAttribute() {
-        return attribute
-    }
-
-    void setAttribute(String attribute) {
-        this.attribute = attribute
-    }
-
-    String getBindDn() {
-        return bindDn
-    }
-
-    void setBindDn(String bindDn) {
-        this.bindDn = bindDn
-    }
-
-    String getBindPassword() {
-        return bindPassword
-    }
-
-    void setBindPassword(String bindPassword) {
-        this.bindPassword = bindPassword
-    }
-
-    Map<String, String> getMappings() {
-        return mappings
-    }
-
-    void setMappings(Map<String, String> mappings) {
-        this.mappings = mappings
-    }
-
-    Optional<String> getMapping(String type) {
-        if (mappings == null) {
-            return Optional.empty()
-        }
-
-        return Optional.ofNullable(mappings.get(type))
-    }
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        log.info("LDAP enabled: {}", getEnabled())
-
-        if (!getEnabled()) {
-            return
-        }
-
-        log.info("Matrix ID type: {}", getType())
-        log.info("LDAP Host: {}", getHost())
-        log.info("LDAP Bind DN: {}", getBindDn())
-        log.info("LDAP Attribute: {}", getAttribute())
-
-        if (StringUtils.isBlank(getHost())) {
-            throw new IllegalStateException("LDAP Host must be configured!")
-        }
-        if (StringUtils.isBlank(getAttribute())) {
-            throw new IllegalStateException("LDAP attribute must be configured!")
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/config/RecursiveLookupBridgeConfig.groovy

@@ -1,60 +0,0 @@
-package io.kamax.mxisd.config
-
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
-
-@Configuration
-@ConfigurationProperties(prefix = "lookup.recursive.bridge")
-class RecursiveLookupBridgeConfig implements InitializingBean {
-
-    private Logger log = LoggerFactory.getLogger(RecursiveLookupBridgeConfig.class)
-
-    private boolean enabled
-    private boolean recursiveOnly
-    private String server
-    private Map<String, String> mappings
-
-    boolean getEnabled() {
-        return enabled
-    }
-
-    void setEnabled(boolean enabled) {
-        this.enabled = enabled
-    }
-
-    boolean getRecursiveOnly() {
-        return recursiveOnly
-    }
-
-    void setRecursiveOnly(boolean recursiveOnly) {
-        this.recursiveOnly = recursiveOnly
-    }
-
-    String getServer() {
-        return server
-    }
-
-    void setServer(String server) {
-        this.server = server
-    }
-
-    Map<String, String> getMappings() {
-        return mappings
-    }
-
-    void setMappings(Map<String, String> mappings) {
-        this.mappings = mappings
-    }
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        log.info("Enabled: {}", getEnabled())
-        log.info("Recursive only: {}", getRecursiveOnly())
-        log.info("Server: {}", getServer())
-        log.info("Mappings: {}", mappings.size())
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/KeyController.groovy

@@ -1,71 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.controller.v1
-
-import groovy.json.JsonOutput
-import io.kamax.mxisd.exception.BadRequestException
-import io.kamax.mxisd.exception.NotImplementedException
-import io.kamax.mxisd.key.KeyManager
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.web.bind.annotation.PathVariable
-import org.springframework.web.bind.annotation.RequestMapping
-import org.springframework.web.bind.annotation.RestController
-
-import javax.servlet.http.HttpServletRequest
-
-import static org.springframework.web.bind.annotation.RequestMethod.GET
-
-@RestController
-class KeyController {
-
-    private Logger log = LoggerFactory.getLogger(KeyController.class)
-
-    @Autowired
-    private KeyManager keyMgr
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/{keyType}:{keyId}", method = GET)
-    String getKey(@PathVariable String keyType, @PathVariable int keyId) {
-        if (!"ed25519".contentEquals(keyType)) {
-            throw new BadRequestException("Invalid algorithm: " + keyType)
-        }
-
-        return JsonOutput.toJson([
-                public_key: keyMgr.getPublicKeyBase64(keyId)
-        ])
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/ephemeral/isvalid", method = GET)
-    String checkEphemeralKeyValidity(HttpServletRequest request) {
-        log.error("{} was requested but not implemented", request.getRequestURL())
-
-        throw new NotImplementedException()
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/pubkey/isvalid", method = GET)
-    String checkKeyValidity(HttpServletRequest request) {
-        log.error("{} was requested but not implemented", request.getRequestURL())
-
-        throw new NotImplementedException()
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/MappingController.groovy

@@ -1,103 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.controller.v1
-
-import groovy.json.JsonOutput
-import groovy.json.JsonSlurper
-import io.kamax.mxisd.lookup.BulkLookupRequest
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import io.kamax.mxisd.lookup.strategy.LookupStrategy
-import io.kamax.mxisd.signature.SignatureManager
-import org.apache.commons.lang.StringUtils
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.web.bind.annotation.RequestMapping
-import org.springframework.web.bind.annotation.RequestParam
-import org.springframework.web.bind.annotation.RestController
-
-import javax.servlet.http.HttpServletRequest
-
-import static org.springframework.web.bind.annotation.RequestMethod.GET
-import static org.springframework.web.bind.annotation.RequestMethod.POST
-
-@RestController
-class MappingController {
-
-    private Logger log = LoggerFactory.getLogger(MappingController.class)
-    private JsonSlurper json = new JsonSlurper()
-
-    @Autowired
-    private LookupStrategy strategy
-
-    @Autowired
-    private SignatureManager signMgr
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/lookup", method = GET)
-    String lookup(HttpServletRequest request, @RequestParam String medium, @RequestParam String address) {
-        String remote = StringUtils.defaultIfBlank(request.getHeader("X-FORWARDED-FOR"), request.getRemoteAddr())
-        log.info("Got request from {}", remote)
-
-        SingleLookupRequest lookupRequest = new SingleLookupRequest()
-        lookupRequest.setRequester(remote)
-        lookupRequest.setType(medium)
-        lookupRequest.setThreePid(address)
-
-        Optional<?> lookupOpt = strategy.find(lookupRequest)
-        if (!lookupOpt.isPresent()) {
-            log.info("No mapping was found, return empty JSON object")
-            return JsonOutput.toJson([])
-        }
-
-        def lookup = lookupOpt.get()
-        if (lookup['signatures'] == null) {
-            log.info("lookup is not signed yet, we sign it")
-            lookup['signatures'] = signMgr.signMessage(JsonOutput.toJson(lookup))
-        }
-
-        return JsonOutput.toJson(lookup)
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/bulk_lookup", method = POST)
-    String bulkLookup(HttpServletRequest request) {
-        String remote = StringUtils.defaultIfBlank(request.getHeader("X-FORWARDED-FOR"), request.getRemoteAddr())
-        log.info("Got request from {}", remote)
-
-        BulkLookupRequest lookupRequest = new BulkLookupRequest()
-        lookupRequest.setRequester(remote)
-
-        ClientBulkLookupRequest input = (ClientBulkLookupRequest) json.parseText(request.getInputStream().getText())
-        List<ThreePidMapping> mappings = new ArrayList<>()
-        for (List<String> mappingRaw : input.getThreepids()) {
-            ThreePidMapping mapping = new ThreePidMapping()
-            mapping.setMedium(mappingRaw.get(0))
-            mapping.setValue(mappingRaw.get(1))
-            mappings.add(mapping)
-        }
-        lookupRequest.setMappings(mappings)
-
-        ClientBulkLookupAnswer answer = new ClientBulkLookupAnswer()
-        answer.addAll(strategy.find(lookupRequest))
-        return JsonOutput.toJson(answer)
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy

@@ -1,154 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.controller.v1
-
-import com.google.gson.Gson
-import com.google.gson.JsonObject
-import io.kamax.mxisd.controller.v1.io.SessionEmailTokenRequestJson
-import io.kamax.mxisd.controller.v1.io.SessionPhoneTokenRequestJson
-import io.kamax.mxisd.exception.BadRequestException
-import io.kamax.mxisd.lookup.ThreePid
-import io.kamax.mxisd.mapping.MappingManager
-import org.apache.commons.io.IOUtils
-import org.apache.commons.lang.StringUtils
-import org.apache.http.HttpStatus
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.web.bind.annotation.PathVariable
-import org.springframework.web.bind.annotation.RequestMapping
-import org.springframework.web.bind.annotation.RequestParam
-import org.springframework.web.bind.annotation.RestController
-
-import javax.servlet.http.HttpServletRequest
-import javax.servlet.http.HttpServletResponse
-import java.nio.charset.StandardCharsets
-
-@RestController
-class SessionController {
-
-    @Autowired
-    private MappingManager mgr
-
-    private Gson gson = new Gson()
-
-    private Logger log = LoggerFactory.getLogger(SessionController.class)
-
-    private <T> T fromJson(HttpServletRequest req, Class<T> obj) {
-        gson.fromJson(new InputStreamReader(req.getInputStream(), StandardCharsets.UTF_8), obj)
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/validate/{medium}/requestToken")
-    String init(HttpServletRequest request, HttpServletResponse response, @PathVariable String medium) {
-        log.info("Requested: {}", request.getRequestURL(), request.getQueryString())
-
-        if (StringUtils.equals("email", medium)) {
-            SessionEmailTokenRequestJson req = fromJson(request, SessionEmailTokenRequestJson.class)
-            return gson.toJson(new Sid(mgr.create(req)))
-        }
-
-        if (StringUtils.equals("msisdn", medium)) {
-            SessionPhoneTokenRequestJson req = fromJson(request, SessionPhoneTokenRequestJson.class)
-            return gson.toJson(new Sid(mgr.create(req)))
-        }
-
-        JsonObject obj = new JsonObject();
-        obj.addProperty("errcode", "M_INVALID_3PID_TYPE")
-        obj.addProperty("error", medium + " is not supported as a 3PID type")
-        response.setStatus(HttpStatus.SC_BAD_REQUEST)
-        return gson.toJson(obj)
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/validate/{medium}/submitToken")
-    String validate(HttpServletRequest request,
-                    @RequestParam String sid,
-                    @RequestParam("client_secret") String secret, @RequestParam String token) {
-        log.info("Requested: {}?{}", request.getRequestURL(), request.getQueryString())
-
-        mgr.validate(sid, secret, token)
-
-        return "{}"
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/3pid/getValidated3pid")
-    String check(HttpServletRequest request, HttpServletResponse response,
-                 @RequestParam String sid, @RequestParam("client_secret") String secret) {
-        log.info("Requested: {}?{}", request.getRequestURL(), request.getQueryString())
-
-        Optional<ThreePid> result = mgr.getValidated(sid, secret)
-        if (result.isPresent()) {
-            log.info("requested session was validated")
-            ThreePid pid = result.get()
-
-            JsonObject obj = new JsonObject()
-            obj.addProperty("medium", pid.getMedium())
-            obj.addProperty("address", pid.getAddress())
-            obj.addProperty("validated_at", pid.getValidation().toEpochMilli())
-
-            return gson.toJson(obj);
-        } else {
-            log.info("requested session was not validated")
-
-            JsonObject obj = new JsonObject()
-            obj.addProperty("errcode", "M_SESSION_NOT_VALIDATED")
-            obj.addProperty("error", "sid, secret or session not valid")
-            response.setStatus(HttpStatus.SC_BAD_REQUEST)
-            return gson.toJson(obj)
-        }
-    }
-
-    @RequestMapping(value = "/_matrix/identity/api/v1/3pid/bind")
-    String bind(HttpServletRequest request, HttpServletResponse response,
-                @RequestParam String sid, @RequestParam("client_secret") String secret, @RequestParam String mxid) {
-        String data = IOUtils.toString(request.getReader())
-        log.info("Requested: {}", request.getRequestURL(), request.getQueryString())
-        try {
-            mgr.bind(sid, secret, mxid)
-            return "{}"
-        } catch (BadRequestException e) {
-            log.info("requested session was not validated")
-
-            JsonObject obj = new JsonObject()
-            obj.addProperty("errcode", "M_SESSION_NOT_VALIDATED")
-            obj.addProperty("error", e.getMessage())
-            response.setStatus(HttpStatus.SC_BAD_REQUEST)
-            return gson.toJson(obj)
-        }
-    }
-
-    private class Sid {
-
-        private String sid;
-
-        public Sid(String sid) {
-            setSid(sid);
-        }
-
-        String getSid() {
-            return sid
-        }
-
-        void setSid(String sid) {
-            this.sid = sid
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/io/GenericTokenRequestJson.java

@@ -1,23 +0,0 @@
-package io.kamax.mxisd.controller.v1.io;
-
-import io.kamax.mxisd.mapping.MappingSession;
-
-public abstract class GenericTokenRequestJson implements MappingSession {
-
-    private String client_secret;
-    private int send_attempt;
-    private String id_server;
-
-    public String getSecret() {
-        return client_secret;
-    }
-
-    public int getAttempt() {
-        return send_attempt;
-    }
-
-    public String getServer() {
-        return id_server;
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionEmailTokenRequestJson.java

@@ -1,17 +0,0 @@
-package io.kamax.mxisd.controller.v1.io;
-
-public class SessionEmailTokenRequestJson extends GenericTokenRequestJson {
-
-    private String email;
-
-    @Override
-    public String getMedium() {
-        return "email";
-    }
-
-    @Override
-    public String getValue() {
-        return email;
-    }
-
-}

src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java

@@ -1,29 +0,0 @@
-package io.kamax.mxisd.controller.v1.io;
-
-import com.google.i18n.phonenumbers.NumberParseException;
-import com.google.i18n.phonenumbers.PhoneNumberUtil;
-import com.google.i18n.phonenumbers.Phonenumber;
-
-public class SessionPhoneTokenRequestJson extends GenericTokenRequestJson {
-
-    private static PhoneNumberUtil phoneUtil = PhoneNumberUtil.getInstance();
-
-    private String country;
-    private String phone_number;
-
-    @Override
-    public String getMedium() {
-        return "msisdn";
-    }
-
-    @Override
-    public String getValue() {
-        try {
-            Phonenumber.PhoneNumber num = phoneUtil.parse(phone_number, country);
-            return phoneUtil.format(num, PhoneNumberUtil.PhoneNumberFormat.E164).replace("+", "");
-        } catch (NumberParseException e) {
-            throw new IllegalArgumentException("Invalid phone number");
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/key/KeyManager.groovy

@@ -1,106 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.key
-
-import io.kamax.mxisd.config.KeyConfig
-import net.i2p.crypto.eddsa.EdDSAEngine
-import net.i2p.crypto.eddsa.EdDSAPrivateKey
-import net.i2p.crypto.eddsa.EdDSAPublicKey
-import net.i2p.crypto.eddsa.KeyPairGenerator
-import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable
-import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec
-import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec
-import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec
-import org.apache.commons.io.FileUtils
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.stereotype.Component
-
-import java.nio.charset.StandardCharsets
-import java.nio.file.Files
-import java.nio.file.Path
-import java.nio.file.Paths
-import java.security.KeyPair
-import java.security.MessageDigest
-import java.security.PrivateKey
-
-@Component
-class KeyManager implements InitializingBean {
-
-    @Autowired
-    private KeyConfig keyCfg
-
-    private EdDSAParameterSpec keySpecs
-    private EdDSAEngine signEngine
-    private List<KeyPair> keys
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        keySpecs = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.CURVE_ED25519_SHA512)
-        signEngine = new EdDSAEngine(MessageDigest.getInstance(keySpecs.getHashAlgorithm()))
-        keys = new ArrayList<>()
-
-        Path privKey = Paths.get(keyCfg.getPath())
-
-        if (!Files.exists(privKey)) {
-            KeyPair pair = (new KeyPairGenerator()).generateKeyPair()
-            String keyEncoded = Base64.getEncoder().encodeToString(pair.getPrivate().getEncoded())
-            FileUtils.writeStringToFile(privKey.toFile(), keyEncoded, StandardCharsets.ISO_8859_1)
-            keys.add(pair)
-        } else {
-            if (Files.isDirectory(privKey)) {
-                throw new RuntimeException("Invalid path for private key: ${privKey.toString()}")
-            }
-
-            if (Files.isReadable(privKey)) {
-                byte[] seed = Base64.getDecoder().decode(FileUtils.readFileToString(privKey.toFile(), StandardCharsets.ISO_8859_1))
-                EdDSAPrivateKeySpec privKeySpec = new EdDSAPrivateKeySpec(seed, keySpecs)
-                EdDSAPublicKeySpec pubKeySpec = new EdDSAPublicKeySpec(privKeySpec.getA(), keySpecs)
-                keys.add(new KeyPair(new EdDSAPublicKey(pubKeySpec), new EdDSAPrivateKey(privKeySpec)))
-            }
-        }
-    }
-
-    int getCurrentIndex() {
-        return 0
-    }
-
-    KeyPair getKeys(int index) {
-        return keys.get(index)
-    }
-
-    PrivateKey getPrivateKey(int index) {
-        return getKeys(index).getPrivate()
-    }
-
-    EdDSAPublicKey getPublicKey(int index) {
-        return (EdDSAPublicKey) getKeys(index).getPublic()
-    }
-
-    EdDSAParameterSpec getSpecs() {
-        return keySpecs
-    }
-
-    String getPublicKeyBase64(int index) {
-        return Base64.getEncoder().encodeToString(getPublicKey(index).getAbyte())
-    }
-
-}

src/main/groovy/io/kamax/mxisd/lookup/ThreePid.java

@@ -1,29 +0,0 @@
-package io.kamax.mxisd.lookup;
-
-import java.time.Instant;
-
-public class ThreePid {
-
-    private String medium;
-    private String address;
-    private Instant validation;
-
-    public ThreePid(String medium, String address, Instant validation) {
-        this.medium = medium;
-        this.address = address;
-        this.validation = validation;
-    }
-
-    public String getMedium() {
-        return medium;
-    }
-
-    public String getAddress() {
-        return address;
-    }
-
-    public Instant getValidation() {
-        return validation;
-    }
-
-}

src/main/groovy/io/kamax/mxisd/lookup/provider/DnsLookupProvider.groovy

@@ -1,230 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.lookup.provider
-
-import io.kamax.mxisd.config.ServerConfig
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import io.kamax.mxisd.lookup.fetcher.IRemoteIdentityServerFetcher
-import org.apache.commons.lang.StringUtils
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.stereotype.Component
-import org.xbill.DNS.Lookup
-import org.xbill.DNS.SRVRecord
-import org.xbill.DNS.Type
-
-import java.util.concurrent.ForkJoinPool
-import java.util.concurrent.RecursiveTask
-import java.util.function.Function
-
-@Component
-class DnsLookupProvider implements IThreePidProvider {
-
-    private Logger log = LoggerFactory.getLogger(DnsLookupProvider.class)
-
-    @Autowired
-    private ServerConfig srvCfg
-
-    @Autowired
-    private IRemoteIdentityServerFetcher fetcher
-
-    @Override
-    boolean isEnabled() {
-        return true
-    }
-
-    @Override
-    boolean isLocal() {
-        return false
-    }
-
-    @Override
-    int getPriority() {
-        return 10
-    }
-
-    String getSrvRecordName(String domain) {
-        return "_matrix-identity._tcp." + domain
-    }
-
-    Optional<String> getDomain(String email) {
-        int atIndex = email.lastIndexOf("@")
-        if (atIndex == -1) {
-            return Optional.empty()
-        }
-
-        return Optional.of(email.substring(atIndex + 1))
-    }
-
-    // TODO use caching mechanism
-    Optional<String> findIdentityServerForDomain(String domain) {
-        if (StringUtils.equals(srvCfg.getName(), domain)) {
-            log.info("We are authoritative for {}, no remote lookup", domain)
-            return Optional.empty()
-        }
-
-        log.info("Performing SRV lookup")
-        String lookupDns = getSrvRecordName(domain)
-        log.info("Lookup name: {}", lookupDns)
-
-        SRVRecord[] records = (SRVRecord[]) new Lookup(lookupDns, Type.SRV).run()
-        if (records != null) {
-            Arrays.sort(records, new Comparator<SRVRecord>() {
-
-                @Override
-                int compare(SRVRecord o1, SRVRecord o2) {
-                    return Integer.compare(o1.getPriority(), o2.getPriority())
-                }
-
-            })
-
-            for (SRVRecord record : records) {
-                log.info("Found SRV record: {}", record.toString())
-                String baseUrl = "https://${record.getTarget().toString(true)}:${record.getPort()}"
-                if (fetcher.isUsable(baseUrl)) {
-                    log.info("Found Identity Server for domain {} at {}", domain, baseUrl)
-                    return Optional.of(baseUrl)
-                } else {
-                    log.info("{} is not a usable Identity Server", baseUrl)
-                }
-            }
-        } else {
-            log.info("No SRV record for {}", lookupDns)
-        }
-
-        log.info("Performing basic lookup using domain name {}", domain)
-        String baseUrl = "https://" + domain
-        if (fetcher.isUsable(baseUrl)) {
-            log.info("Found Identity Server for domain {} at {}", domain, baseUrl)
-            return Optional.of(baseUrl)
-        } else {
-            log.info("{} is not a usable Identity Server", baseUrl)
-            return Optional.empty()
-        }
-    }
-
-    @Override
-    Optional<?> find(SingleLookupRequest request) {
-        if (!StringUtils.equals("email", request.getType())) { // TODO use enum
-            log.info("Skipping unsupported type {} for {}", request.getType(), request.getThreePid())
-            return Optional.empty()
-        }
-
-        log.info("Performing DNS lookup for {}", request.getThreePid())
-
-        String domain = request.getThreePid().substring(request.getThreePid().lastIndexOf("@") + 1)
-        log.info("Domain name for {}: {}", request.getThreePid(), domain)
-        Optional<String> baseUrl = findIdentityServerForDomain(domain)
-
-        if (baseUrl.isPresent()) {
-            return fetcher.find(baseUrl.get(), request.getType().toString(), request.getThreePid())
-        }
-
-        return Optional.empty()
-    }
-
-    @Override
-    List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
-        Map<String, List<ThreePidMapping>> domains = new HashMap<>()
-
-        for (ThreePidMapping mapping : mappings) {
-            if (!StringUtils.equals("email", mapping.getMedium())) {
-                log.info("Skipping unsupported type {} for {}", mapping.getMedium(), mapping.getValue())
-                continue
-            }
-
-            Optional<String> domainOpt = getDomain(mapping.getValue())
-            if (!domainOpt.isPresent()) {
-                log.warn("No domain for 3PID {}", mapping.getValue())
-                continue
-            }
-
-            String domain = domainOpt.get()
-            List<ThreePidMapping> domainMappings = domains.computeIfAbsent(domain, new Function<String, List<ThreePidMapping>>() {
-
-                @Override
-                List<ThreePidMapping> apply(String s) {
-                    return new ArrayList<>()
-                }
-
-            })
-            domainMappings.add(mapping)
-        }
-
-        log.info("Looking mappings across {} domains", domains.keySet().size())
-        ForkJoinPool pool = new ForkJoinPool()
-        RecursiveTask<List<ThreePidMapping>> task = new RecursiveTask<List<ThreePidMapping>>() {
-
-            @Override
-            protected List<ThreePidMapping> compute() {
-                List<ThreePidMapping> mappingsFound = new ArrayList<>()
-                List<DomainBulkLookupTask> tasks = new ArrayList<>()
-
-                for (String domain : domains.keySet()) {
-                    DomainBulkLookupTask domainTask = new DomainBulkLookupTask(domain, domains.get(domain))
-                    domainTask.fork()
-                    tasks.add(domainTask)
-                }
-
-                for (DomainBulkLookupTask task : tasks) {
-                    mappingsFound.addAll(task.join())
-                }
-
-                return mappingsFound
-            }
-        }
-        pool.submit(task)
-        pool.shutdown()
-
-        List<ThreePidMapping> mappingsFound = task.join()
-        log.info("Found {} mappings overall", mappingsFound.size())
-        return mappingsFound
-    }
-
-    private class DomainBulkLookupTask extends RecursiveTask<List<ThreePidMapping>> {
-
-        private String domain
-        private List<ThreePidMapping> mappings
-
-        DomainBulkLookupTask(String domain, List<ThreePidMapping> mappings) {
-            this.domain = domain
-            this.mappings = mappings
-        }
-
-        @Override
-        protected List<ThreePidMapping> compute() {
-            List<ThreePidMapping> domainMappings = new ArrayList<>()
-
-            Optional<String> baseUrl = findIdentityServerForDomain(domain)
-            if (!baseUrl.isPresent()) {
-                log.info("No usable Identity server for domain {}", domain)
-            } else {
-                domainMappings.addAll(fetcher.find(baseUrl.get(), mappings))
-                log.info("Found {} mappings in domain {}", domainMappings.size(), domain)
-            }
-
-            return domainMappings
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/lookup/provider/LdapProvider.groovy

@@ -1,172 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.lookup.provider
-
-import io.kamax.mxisd.config.LdapConfig
-import io.kamax.mxisd.config.ServerConfig
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import org.apache.commons.lang.StringUtils
-import org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException
-import org.apache.directory.api.ldap.model.cursor.EntryCursor
-import org.apache.directory.api.ldap.model.entry.Attribute
-import org.apache.directory.api.ldap.model.entry.Entry
-import org.apache.directory.api.ldap.model.message.SearchScope
-import org.apache.directory.ldap.client.api.LdapConnection
-import org.apache.directory.ldap.client.api.LdapNetworkConnection
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.stereotype.Component
-
-@Component
-class LdapProvider implements IThreePidProvider {
-
-    public static final String UID = "uid"
-    public static final String MATRIX_ID = "mxid"
-
-    private Logger log = LoggerFactory.getLogger(LdapProvider.class)
-
-    @Autowired
-    private ServerConfig srvCfg
-
-    @Autowired
-    private LdapConfig ldapCfg
-
-    @Override
-    boolean isEnabled() {
-        return ldapCfg.getEnabled()
-    }
-
-    @Override
-    boolean isLocal() {
-        return true
-    }
-
-    @Override
-    int getPriority() {
-        return 20
-    }
-
-    Optional<String> lookup(LdapConnection conn, String medium, String value) {
-        Optional<String> queryOpt = ldapCfg.getMapping(medium)
-        if (!queryOpt.isPresent()) {
-            log.warn("{} is not a configured 3PID type for LDAP lookup", medium)
-            return Optional.empty()
-        }
-
-        String searchQuery = queryOpt.get().replaceAll("%3pid", value)
-        EntryCursor cursor = conn.search(ldapCfg.getBaseDn(), searchQuery, SearchScope.SUBTREE, ldapCfg.getAttribute())
-        try {
-            while (cursor.next()) {
-                Entry entry = cursor.get()
-                log.info("Found possible match, DN: {}", entry.getDn().getName())
-
-                Attribute attribute = entry.get(ldapCfg.getAttribute())
-                if (attribute == null) {
-                    log.info("DN {}: no attribute {}, skpping", entry.getDn(), ldapCfg.getAttribute())
-                    continue
-                }
-
-                String data = attribute.get().toString()
-                if (data.length() < 1) {
-                    log.info("DN {}: empty attribute {}, skipping", ldapCfg.getAttribute())
-                    continue
-                }
-
-                StringBuilder matrixId = new StringBuilder()
-                // TODO Should we turn this block into a map of functions?
-                if (StringUtils.equals(UID, ldapCfg.getType())) {
-                    matrixId.append("@").append(data).append(":").append(srvCfg.getName())
-                } else if (StringUtils.equals(MATRIX_ID, ldapCfg.getType())) {
-                    matrixId.append(data)
-                } else {
-                    log.warn("Bind was found but type {} is not supported", ldapCfg.getType())
-                    continue
-                }
-
-                log.info("DN {} is a valid match", entry.getDn().getName())
-                return Optional.of(matrixId.toString())
-            }
-        } catch (CursorLdapReferralException e) {
-            log.warn("3PID {} is only available via referral, skipping", value)
-        } finally {
-            cursor.close()
-        }
-
-        return Optional.empty()
-    }
-
-    @Override
-    Optional<?> find(SingleLookupRequest request) {
-        log.info("Performing LDAP lookup ${request.getThreePid()} of type ${request.getType()}")
-
-        LdapConnection conn = new LdapNetworkConnection(ldapCfg.getHost(), ldapCfg.getPort(), ldapCfg.getTls())
-        try {
-            conn.bind(ldapCfg.getBindDn(), ldapCfg.getBindPassword())
-
-            Optional<String> mxid = lookup(conn, request.getType(), request.getThreePid())
-            if (mxid.isPresent()) {
-                return Optional.of([
-                        address   : request.getThreePid(),
-                        medium    : request.getType(),
-                        mxid      : mxid.get(),
-                        not_before: 0,
-                        not_after : 9223372036854775807,
-                        ts        : 0
-                ])
-            }
-        } finally {
-            conn.close()
-        }
-
-        log.info("No match found")
-        return Optional.empty()
-    }
-
-    @Override
-    List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
-        log.info("Looking up {} mappings", mappings.size())
-        List<ThreePidMapping> mappingsFound = new ArrayList<>()
-
-        LdapConnection conn = new LdapNetworkConnection(ldapCfg.getHost(), ldapCfg.getPort())
-        try {
-            conn.bind(ldapCfg.getBindDn(), ldapCfg.getBindPassword())
-
-            for (ThreePidMapping mapping : mappings) {
-                try {
-                    Optional<String> mxid = lookup(conn, mapping.getMedium(), mapping.getValue())
-                    if (mxid.isPresent()) {
-                        mapping.setMxid(mxid.get())
-                        mappingsFound.add(mapping)
-                    }
-                } catch (IllegalArgumentException e) {
-                    log.warn("{} is not a supported 3PID type for LDAP lookup", mapping.getMedium())
-                }
-            }
-        } finally {
-            conn.close()
-        }
-
-        return mappingsFound
-    }
-
-}

src/main/groovy/io/kamax/mxisd/lookup/provider/RemoteIdentityServerFetcher.groovy

@@ -1,153 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.lookup.provider
-
-import groovy.json.JsonException
-import groovy.json.JsonOutput
-import groovy.json.JsonSlurper
-import io.kamax.mxisd.controller.v1.ClientBulkLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import io.kamax.mxisd.lookup.fetcher.IRemoteIdentityServerFetcher
-import org.apache.http.HttpEntity
-import org.apache.http.HttpResponse
-import org.apache.http.client.HttpClient
-import org.apache.http.client.entity.EntityBuilder
-import org.apache.http.client.methods.HttpPost
-import org.apache.http.entity.ContentType
-import org.apache.http.impl.client.HttpClients
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.context.annotation.Lazy
-import org.springframework.context.annotation.Scope
-import org.springframework.stereotype.Component
-
-@Component
-@Scope("prototype")
-@Lazy
-public class RemoteIdentityServerFetcher implements IRemoteIdentityServerFetcher {
-
-    public static final String THREEPID_TEST_MEDIUM = "email"
-    public static final String THREEPID_TEST_ADDRESS = "john.doe@example.org"
-
-    private Logger log = LoggerFactory.getLogger(RemoteIdentityServerFetcher.class)
-
-    private JsonSlurper json = new JsonSlurper()
-
-    @Override
-    boolean isUsable(String remote) {
-        try {
-            HttpURLConnection rootSrvConn = (HttpURLConnection) new URL(
-                    "${remote}/_matrix/identity/api/v1/lookup?medium=${THREEPID_TEST_MEDIUM}&address=${THREEPID_TEST_ADDRESS}"
-            ).openConnection()
-            // TODO turn this into a configuration property
-            rootSrvConn.setConnectTimeout(2000)
-
-            if (rootSrvConn.getResponseCode() != 200) {
-                return false
-            }
-
-            def output = json.parseText(rootSrvConn.getInputStream().getText())
-            if (output['address']) {
-                return false
-            }
-
-            return true
-        } catch (IOException | JsonException e) {
-            log.info("{} is not a usable Identity Server: {}", remote, e.getMessage())
-            return false
-        }
-    }
-
-    @Override
-    Optional<?> find(String remote, String type, String threePid) {
-        log.info("Looking up {} 3PID {} using {}", type, threePid, remote)
-
-        HttpURLConnection rootSrvConn = (HttpURLConnection) new URL(
-                "${remote}/_matrix/identity/api/v1/lookup?medium=${type}&address=${threePid}"
-        ).openConnection()
-
-        try {
-            def output = json.parseText(rootSrvConn.getInputStream().getText())
-            if (output['address']) {
-                log.info("Found 3PID mapping: {}", output)
-                return Optional.of(output)
-            }
-
-            log.info("Empty 3PID mapping from {}", remote)
-            return Optional.empty()
-        } catch (IOException e) {
-            log.warn("Error looking up 3PID mapping {}: {}", threePid, e.getMessage())
-            return Optional.empty()
-        } catch (JsonException e) {
-            log.warn("Invalid JSON answer from {}", remote)
-            return Optional.empty()
-        }
-    }
-
-    @Override
-    List<ThreePidMapping> find(String remote, List<ThreePidMapping> mappings) {
-        List<ThreePidMapping> mappingsFound = new ArrayList<>()
-
-        ClientBulkLookupRequest mappingRequest = new ClientBulkLookupRequest()
-        mappingRequest.setMappings(mappings)
-
-        String url = "${remote}/_matrix/identity/api/v1/bulk_lookup"
-        HttpClient client = HttpClients.createDefault()
-        try {
-            HttpPost request = new HttpPost(url)
-            request.setEntity(
-                    EntityBuilder.create()
-                            .setText(JsonOutput.toJson(mappingRequest))
-                            .setContentType(ContentType.APPLICATION_JSON)
-                            .build()
-            )
-
-            HttpResponse response = client.execute(request)
-            try {
-                if (response.getStatusLine().getStatusCode() != 200) {
-                    log.info("Could not perform lookup at {} due to HTTP return code: {}", url, response.getStatusLine().getStatusCode())
-                    return mappingsFound
-                }
-
-                HttpEntity entity = response.getEntity()
-                if (entity != null) {
-                    ClientBulkLookupRequest input = (ClientBulkLookupRequest) json.parseText(entity.getContent().getText())
-                    for (List<String> mappingRaw : input.getThreepids()) {
-                        ThreePidMapping mapping = new ThreePidMapping()
-                        mapping.setMedium(mappingRaw.get(0))
-                        mapping.setValue(mappingRaw.get(1))
-                        mapping.setMxid(mappingRaw.get(2))
-                        mappingsFound.add(mapping)
-                    }
-                } else {
-                    log.info("HTTP response from {} was empty", remote)
-                }
-
-                return mappingsFound
-            } finally {
-                response.close()
-            }
-        } finally {
-            client.close()
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/lookup/strategy/LookupStrategy.groovy

@@ -1,36 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.lookup.strategy
-
-import io.kamax.mxisd.lookup.BulkLookupRequest
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import io.kamax.mxisd.lookup.provider.IThreePidProvider
-
-interface LookupStrategy {
-
-    List<IThreePidProvider> getLocalProviders()
-
-    Optional<?> find(SingleLookupRequest request)
-
-    List<ThreePidMapping> find(BulkLookupRequest requests)
-
-}

src/main/groovy/io/kamax/mxisd/lookup/strategy/RecursivePriorityLookupStrategy.groovy

@@ -1,160 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.lookup.strategy
-
-import edazdarevic.commons.net.CIDRUtils
-import io.kamax.mxisd.config.RecursiveLookupConfig
-import io.kamax.mxisd.lookup.ALookupRequest
-import io.kamax.mxisd.lookup.BulkLookupRequest
-import io.kamax.mxisd.lookup.SingleLookupRequest
-import io.kamax.mxisd.lookup.ThreePidMapping
-import io.kamax.mxisd.lookup.fetcher.IBridgeFetcher
-import io.kamax.mxisd.lookup.provider.IThreePidProvider
-import org.slf4j.Logger
-import org.slf4j.LoggerFactory
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.stereotype.Component
-
-import java.util.function.Predicate
-import java.util.stream.Collectors
-
-@Component
-class RecursivePriorityLookupStrategy implements LookupStrategy, InitializingBean {
-
-    private Logger log = LoggerFactory.getLogger(RecursivePriorityLookupStrategy.class)
-
-    @Autowired
-    private RecursiveLookupConfig recursiveCfg
-
-    @Autowired
-    private List<IThreePidProvider> providers
-
-    @Autowired
-    private IBridgeFetcher bridge
-
-    private List<CIDRUtils> allowedCidr = new ArrayList<>()
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        log.info("Found ${providers.size()} providers")
-
-        providers.sort(new Comparator<IThreePidProvider>() {
-
-            @Override
-            int compare(IThreePidProvider o1, IThreePidProvider o2) {
-                return Integer.compare(o2.getPriority(), o1.getPriority())
-            }
-
-        })
-
-        log.info("Recursive lookup enabled: {}", recursiveCfg.isEnabled())
-        for (String cidr : recursiveCfg.getAllowedCidr()) {
-            log.info("{} is allowed for recursion", cidr)
-            allowedCidr.add(new CIDRUtils(cidr))
-        }
-    }
-
-    boolean isAllowedForRecursive(String source) {
-        boolean canRecurse = false
-
-        if (recursiveCfg.isEnabled()) {
-            log.debug("Checking {} CIDRs for recursion", allowedCidr.size())
-            for (CIDRUtils cidr : allowedCidr) {
-                if (cidr.isInRange(source)) {
-                    log.debug("{} is in range {}, allowing recursion", source, cidr.getNetworkAddress())
-                    canRecurse = true
-                    break
-                } else {
-                    log.debug("{} is not in range {}", source, cidr.getNetworkAddress())
-                }
-            }
-        }
-
-        return canRecurse
-    }
-
-    List<IThreePidProvider> listUsableProviders(ALookupRequest request) {
-        List<IThreePidProvider> usableProviders = new ArrayList<>()
-
-        boolean canRecurse = isAllowedForRecursive(request.getRequester())
-
-        log.info("Host {} allowed for recursion: {}", request.getRequester(), canRecurse)
-        for (IThreePidProvider provider : providers) {
-            if (provider.isEnabled() && (provider.isLocal() || canRecurse)) {
-                usableProviders.add(provider)
-            }
-        }
-
-        return usableProviders
-    }
-
-    @Override
-    List<IThreePidProvider> getLocalProviders() {
-        return providers.stream().filter(new Predicate<IThreePidProvider>() {
-            @Override
-            boolean test(IThreePidProvider iThreePidProvider) {
-                return iThreePidProvider.isEnabled() && iThreePidProvider.isLocal()
-            }
-        }).collect(Collectors.toList())
-    }
-
-    @Override
-    Optional<?> find(SingleLookupRequest request) {
-        for (IThreePidProvider provider : listUsableProviders(request)) {
-            Optional<?> lookupDataOpt = provider.find(request)
-            if (lookupDataOpt.isPresent()) {
-                return lookupDataOpt
-            }
-        }
-
-        if (recursiveCfg.getBridge().getEnabled() && (!recursiveCfg.getBridge().getRecursiveOnly() || isAllowedForRecursive(request.getRequester()))) {
-            log.info("Using bridge failover for lookup")
-            return bridge.find(request)
-        }
-
-        return Optional.empty()
-    }
-
-    @Override
-    List<ThreePidMapping> find(BulkLookupRequest request) {
-        List<ThreePidMapping> mapToDo = new ArrayList<>(request.getMappings())
-        List<ThreePidMapping> mapFoundAll = new ArrayList<>()
-
-        for (IThreePidProvider provider : listUsableProviders(request)) {
-            if (mapToDo.isEmpty()) {
-                log.info("No more mappings to lookup")
-                break
-            } else {
-                log.info("{} mappings remaining overall", mapToDo.size())
-            }
-
-            log.info("Using provider {} for remaining mappings", provider.getClass().getSimpleName())
-            List<ThreePidMapping> mapFound = provider.populate(mapToDo)
-            log.info("Provider {} returned {} mappings", provider.getClass().getSimpleName(), mapFound.size())
-            mapFoundAll.addAll(mapFound)
-            mapToDo.removeAll(mapFound)
-        }
-
-        return mapFoundAll
-    }
-
-}

src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java

@@ -1,164 +0,0 @@
-package io.kamax.mxisd.mapping;
-
-import io.kamax.mxisd.exception.BadRequestException;
-import io.kamax.mxisd.lookup.ThreePid;
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.stereotype.Component;
-
-import java.time.Instant;
-import java.time.temporal.ChronoUnit;
-import java.util.*;
-
-@Component
-public class MappingManager {
-
-    private Logger log = LoggerFactory.getLogger(MappingManager.class);
-
-    private Map<String, Session> threePidLookups = new WeakHashMap<>();
-    private Map<String, Session> sessions = new HashMap<>();
-    private Timer cleaner;
-
-    MappingManager() {
-        cleaner = new Timer();
-        cleaner.schedule(new TimerTask() {
-            @Override
-            public void run() {
-                List<Session> sList = new ArrayList<>(sessions.values());
-                for (Session s : sList) {
-                    if (s.timestamp.plus(24, ChronoUnit.HOURS).isBefore(Instant.now())) { // TODO config timeout
-                        log.info("Session {} is obsolete, removing", s.sid);
-
-                        sessions.remove(s.sid);
-                        threePidLookups.remove(s.hash);
-                    }
-                }
-            }
-        }, 0, 10 * 1000);  // TODO config delay
-    }
-
-    public String create(MappingSession data) {
-        String sid;
-        do {
-            sid = Long.toString(System.currentTimeMillis());
-        } while (sessions.containsKey(sid));
-
-        String threePidHash = data.getMedium() + data.getValue();
-        Session session = threePidLookups.get(threePidHash);
-        if (session != null) {
-            sid = session.sid;
-        } else {
-            // TODO perform some kind of validation
-
-            session = new Session(sid, threePidHash, data);
-            sessions.put(sid, session);
-            threePidLookups.put(threePidHash, session);
-        }
-
-        log.info("Created new session {} to validate {} {}", sid, session.medium, session.address);
-        return sid;
-    }
-
-    public void validate(String sid, String secret, String token) {
-        Session s = sessions.get(sid);
-        if (s == null || !StringUtils.equals(s.secret, secret)) {
-            throw new BadRequestException("sid or secret are not valid");
-        }
-
-        // TODO actually check token
-
-        s.isValidated = true;
-        s.validationTimestamp = Instant.now();
-    }
-
-    public Optional<ThreePid> getValidated(String sid, String secret) {
-        Session s = sessions.get(sid);
-        if (s != null && StringUtils.equals(s.secret, secret)) {
-            return Optional.of(new ThreePid(s.medium, s.address, s.validationTimestamp));
-        }
-
-        return Optional.empty();
-    }
-
-    public void bind(String sid, String secret, String mxid) {
-        Session s = sessions.get(sid);
-        if (s == null || !StringUtils.equals(s.secret, secret)) {
-            throw new BadRequestException("sid or secret are not valid");
-        }
-
-        log.info("Performed bind for mxid {}", mxid);
-        // TODO perform bind, whatever it is
-    }
-
-    private class Session {
-
-        private String sid;
-        private String hash;
-        private Instant timestamp;
-        private Instant validationTimestamp;
-        private boolean isValidated;
-        private String secret;
-        private String medium;
-        private String address;
-
-        public Session(String sid, String hash, MappingSession data) {
-            this.sid = sid;
-            this.hash = hash;
-            timestamp = Instant.now();
-            validationTimestamp = Instant.now();
-            secret = data.getSecret();
-            medium = data.getMedium();
-            address = data.getValue();
-        }
-
-        public Instant getTimestamp() {
-            return timestamp;
-        }
-
-        public void setTimestamp(Instant timestamp) {
-            this.timestamp = timestamp;
-        }
-
-        public Instant getValidationTimestamp() {
-            return validationTimestamp;
-        }
-
-        public void setValidationTimestamp(Instant validationTimestamp) {
-            this.validationTimestamp = validationTimestamp;
-        }
-
-        public boolean isValidated() {
-            return isValidated;
-        }
-
-        public void setValidated(boolean validated) {
-            isValidated = validated;
-        }
-
-        public String getSecret() {
-            return secret;
-        }
-
-        public void setSecret(String secret) {
-            this.secret = secret;
-        }
-
-        public String getMedium() {
-            return medium;
-        }
-
-        public void setMedium(String medium) {
-            this.medium = medium;
-        }
-
-        public String getAddress() {
-            return address;
-        }
-
-        public void setAddress(String address) {
-            this.address = address;
-        }
-    }
-
-}

src/main/groovy/io/kamax/mxisd/mapping/MappingSession.java

@@ -1,15 +0,0 @@
-package io.kamax.mxisd.mapping;
-
-public interface MappingSession {
-
-    String getServer();
-
-    String getSecret();
-
-    int getAttempt();
-
-    String getMedium();
-
-    String getValue();
-
-}

src/main/groovy/io/kamax/mxisd/signature/SignatureManager.groovy

@@ -1,59 +0,0 @@
-/*
- * mxisd - Matrix Identity Server Daemon
- * Copyright (C) 2017 Maxime Dor
- *
- * https://max.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.mxisd.signature
-
-import io.kamax.mxisd.config.ServerConfig
-import io.kamax.mxisd.key.KeyManager
-import net.i2p.crypto.eddsa.EdDSAEngine
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.beans.factory.annotation.Autowired
-import org.springframework.stereotype.Component
-
-import java.security.MessageDigest
-
-@Component
-class SignatureManager implements InitializingBean {
-
-    @Autowired
-    private KeyManager keyMgr
-
-    @Autowired
-    private ServerConfig srvCfg
-
-    private EdDSAEngine signEngine
-
-    Map<?, ?> signMessage(String message) {
-        byte[] signRaw = signEngine.signOneShot(message.getBytes())
-        String sign = Base64.getEncoder().encodeToString(signRaw)
-        return [
-                "${srvCfg.getName()}": [
-                        "ed25519:${keyMgr.getCurrentIndex()}": sign
-                ]
-        ]
-    }
-
-    @Override
-    void afterPropertiesSet() throws Exception {
-        signEngine = new EdDSAEngine(MessageDigest.getInstance(keyMgr.getSpecs().getHashAlgorithm()))
-        signEngine.initSign(keyMgr.getPrivateKey(keyMgr.getCurrentIndex()))
-    }
-
-}

src/main/java/io/kamax/mxisd/MatrixIdentityServerApplication.java

@@ -18,16 +18,16 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd
+package io.kamax.mxisd;
 
-import org.springframework.boot.SpringApplication
-import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
 
 @SpringBootApplication
-class MatrixIdentityServerApplication {
+public class MatrixIdentityServerApplication {
 
-    static void main(String[] args) throws Exception {
-        SpringApplication.run(MatrixIdentityServerApplication.class, args)
+    public static void main(String[] args) {
+        SpringApplication.run(MatrixIdentityServerApplication.class, args);
     }
 
 }

src/main/java/io/kamax/mxisd/ThreePid.java

@@ -0,0 +1,69 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd;
+
+// FIXME this should be in matrix-java-sdk
+public class ThreePid {
+
+    private String medium;
+    private String address;
+
+    public ThreePid(ThreePid tpid) {
+        this(tpid.getMedium(), tpid.getAddress());
+    }
+
+    public ThreePid(String medium, String address) {
+        this.medium = medium;
+        this.address = address;
+    }
+
+    public String getMedium() {
+        return medium;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    @Override
+    public String toString() {
+        return getMedium() + ":" + getAddress();
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        ThreePid threePid = (ThreePid) o;
+
+        if (!medium.equals(threePid.medium)) return false;
+        return address.equals(threePid.address);
+    }
+
+    @Override
+    public int hashCode() {
+        int result = medium.hashCode();
+        result = 31 * result + address.hashCode();
+        return result;
+    }
+
+}

src/main/java/io/kamax/mxisd/UserID.java

@@ -0,0 +1,46 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd;
+
+// FIXME consider integrating in matrix-java-sdk?
+public class UserID {
+
+    private String type;
+    private String value;
+
+    protected UserID() {
+        // stub for (de)serialization
+    }
+
+    public UserID(String type, String value) {
+        this.type = type;
+        this.value = value;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+}

src/main/java/io/kamax/mxisd/UserIdType.java

@@ -0,0 +1,47 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd;
+
+import org.apache.commons.lang.StringUtils;
+
+// FIXME consider integrating in matrix-java-sdk?
+public enum UserIdType {
+
+    Localpart("localpart"),
+    MatrixID("mxid"),
+    EmailLocalpart("email_localpart"),
+    Email("email");
+
+    private String id;
+
+    UserIdType(String id) {
+        this.id = id;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public boolean is(String id) {
+        return StringUtils.equalsIgnoreCase(this.id, id);
+    }
+
+}

src/main/java/io/kamax/mxisd/auth/AuthManager.java

@@ -0,0 +1,93 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.ThreePid;
+import io.kamax.mxisd.UserIdType;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.BackendAuthResult;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.invitation.InvitationManager;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@Service
+public class AuthManager {
+
+    private Logger log = LoggerFactory.getLogger(AuthManager.class);
+
+    @Autowired
+    private List<AuthenticatorProvider> providers = new ArrayList<>();
+
+    @Autowired
+    private MatrixConfig mxCfg;
+
+    @Autowired
+    private InvitationManager invMgr;
+
+    public UserAuthResult authenticate(String id, String password) {
+        _MatrixID mxid = new MatrixID(id);
+        for (AuthenticatorProvider provider : providers) {
+            if (!provider.isEnabled()) {
+                continue;
+            }
+
+            BackendAuthResult result = provider.authenticate(mxid, password);
+            if (result.isSuccess()) {
+
+                String mxId;
+                if (UserIdType.Localpart.is(result.getId().getType())) {
+                    mxId = new MatrixID(result.getId().getValue(), mxCfg.getDomain()).getId();
+                } else if (UserIdType.MatrixID.is(result.getId().getType())) {
+                    mxId = new MatrixID(result.getId().getValue()).getId();
+                } else {
+                    log.warn("Unsupported User ID type {} for backend {}", result.getId().getType(), provider.getClass().getSimpleName());
+                    continue;
+                }
+
+                UserAuthResult authResult = new UserAuthResult().success(result.getProfile().getDisplayName());
+                for (ThreePid pid : result.getProfile().getThreePids()) {
+                    authResult.withThreePid(pid.getMedium(), pid.getAddress());
+                }
+                log.info("{} was authenticated by {}, publishing 3PID mappings, if any", id, provider.getClass().getSimpleName());
+                for (ThreePid pid : authResult.getThreePids()) {
+                    log.info("Processing {} for {}", pid, id);
+                    invMgr.publishMappingIfInvited(new ThreePidMapping(pid, mxId));
+                }
+
+                invMgr.lookupMappingsForInvites();
+
+                return authResult;
+            }
+        }
+
+        return new UserAuthResult().failure();
+    }
+
+}

src/main/java/io/kamax/mxisd/auth/UserAuthResult.java

@@ -0,0 +1,86 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth;
+
+import io.kamax.mxisd.ThreePid;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public class UserAuthResult {
+
+    private boolean success;
+    private String displayName;
+    private String photo;
+    private Set<ThreePid> threePids = new HashSet<>();
+
+    public UserAuthResult failure() {
+        success = false;
+        displayName = null;
+        photo = null;
+        threePids.clear();
+
+        return this;
+    }
+
+    public UserAuthResult success(String displayName) {
+        setSuccess(true);
+        setDisplayName(displayName);
+
+        return this;
+    }
+
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public void setSuccess(boolean success) {
+        this.success = success;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public String getPhoto() {
+        return photo;
+    }
+
+    public void setPhoto(String photo) {
+        this.photo = photo;
+    }
+
+    public UserAuthResult withThreePid(String medium, String address) {
+        threePids.add(new ThreePid(medium, address));
+
+        return this;
+    }
+
+    public Set<ThreePid> getThreePids() {
+        return Collections.unmodifiableSet(threePids);
+    }
+
+}

src/main/java/io/kamax/mxisd/auth/provider/AuthenticatorProvider.java

@@ -18,11 +18,14 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.exception
+package io.kamax.mxisd.auth.provider;
 
-import org.springframework.http.HttpStatus
-import org.springframework.web.bind.annotation.ResponseStatus
+import io.kamax.matrix._MatrixID;
+
+public interface AuthenticatorProvider {
+
+    boolean isEnabled();
+
+    BackendAuthResult authenticate(_MatrixID mxid, String password);
 
-@ResponseStatus(value = HttpStatus.NOT_IMPLEMENTED)
-class NotImplementedException extends RuntimeException {
 }

src/main/java/io/kamax/mxisd/auth/provider/BackendAuthResult.java

@@ -0,0 +1,95 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.auth.provider;
+
+import io.kamax.mxisd.ThreePid;
+import io.kamax.mxisd.UserID;
+import io.kamax.mxisd.UserIdType;
+
+import java.util.HashSet;
+import java.util.Set;
+
+public class BackendAuthResult {
+
+    public static class BackendAuthProfile {
+
+        private String displayName;
+        private Set<ThreePid> threePids = new HashSet<>();
+
+        public String getDisplayName() {
+            return displayName;
+        }
+
+        public Set<ThreePid> getThreePids() {
+            return threePids;
+        }
+    }
+
+    public static BackendAuthResult failure() {
+        BackendAuthResult r = new BackendAuthResult();
+        r.success = false;
+        return r;
+    }
+
+    public void fail() {
+        success = false;
+    }
+
+    public static BackendAuthResult success(String id, UserIdType type, String displayName) {
+        return success(id, type.getId(), displayName);
+    }
+
+    public static BackendAuthResult success(String id, String type, String displayName) {
+        BackendAuthResult r = new BackendAuthResult();
+        r.succeed(id, type, displayName);
+        return r;
+    }
+
+    public void succeed(String id, String type, String displayName) {
+        this.success = true;
+        this.id = new UserID(type, id);
+        this.profile = new BackendAuthProfile();
+        this.profile.displayName = displayName;
+    }
+
+    private Boolean success;
+    private UserID id;
+    private BackendAuthProfile profile = new BackendAuthProfile();
+
+    public Boolean isSuccess() {
+        return success;
+    }
+
+    public UserID getId() {
+        return id;
+    }
+
+    public BackendAuthProfile getProfile() {
+        return profile;
+    }
+
+    public BackendAuthResult withThreePid(ThreePid threePid) {
+        this.profile.threePids.add(threePid);
+
+        return this;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/firebase/GoogleFirebaseAuthenticator.java

@@ -0,0 +1,163 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.firebase;
+
+import com.google.firebase.auth.UserInfo;
+import com.google.i18n.phonenumbers.NumberParseException;
+import com.google.i18n.phonenumbers.PhoneNumberUtil;
+import io.kamax.matrix.ThreePidMedium;
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.ThreePid;
+import io.kamax.mxisd.UserIdType;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.BackendAuthResult;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+
+public class GoogleFirebaseAuthenticator extends GoogleFirebaseBackend implements AuthenticatorProvider {
+
+    private Logger log = LoggerFactory.getLogger(GoogleFirebaseAuthenticator.class);
+
+    private PhoneNumberUtil phoneUtil = PhoneNumberUtil.getInstance();
+
+    public GoogleFirebaseAuthenticator(boolean isEnabled, String credsPath, String db) {
+        super(isEnabled, "AuthenticationProvider", credsPath, db);
+    }
+
+    private void waitOnLatch(BackendAuthResult result, CountDownLatch l, String purpose) {
+        try {
+            l.await(30, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for " + purpose);
+            result.fail();
+        }
+    }
+
+    private void toEmail(BackendAuthResult result, String email) {
+        if (StringUtils.isBlank(email)) {
+            return;
+        }
+
+        result.withThreePid(new ThreePid(ThreePidMedium.Email.getId(), email));
+    }
+
+    private void toMsisdn(BackendAuthResult result, String phoneNumber) {
+        if (StringUtils.isBlank(phoneNumber)) {
+            return;
+        }
+
+        try {
+            String number = phoneUtil.format(
+                    phoneUtil.parse(
+                            phoneNumber,
+                            null // No default region
+                    ),
+                    PhoneNumberUtil.PhoneNumberFormat.E164
+            ).substring(1); // We want without the leading +
+            result.withThreePid(new ThreePid(ThreePidMedium.PhoneNumber.getId(), number));
+        } catch (NumberParseException e) {
+            log.warn("Invalid phone number: {}", phoneNumber);
+        }
+    }
+
+    private void waitOnLatch(CountDownLatch l) {
+        try {
+            l.await(30, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for Firebase auth check");
+        }
+    }
+
+    @Override
+    public BackendAuthResult authenticate(_MatrixID mxid, String password) {
+        if (!isEnabled()) {
+            throw new IllegalStateException();
+        }
+
+        log.info("Trying to authenticate {}", mxid);
+
+        final BackendAuthResult result = BackendAuthResult.failure();
+
+        String localpart = mxid.getLocalPart();
+        CountDownLatch l = new CountDownLatch(1);
+        getFirebase().verifyIdToken(password).addOnSuccessListener(token -> {
+            try {
+                if (!StringUtils.equals(localpart, token.getUid())) {
+                    log.info("Failure to authenticate {}: Matrix ID localpart '{}' does not match Firebase UID '{}'", mxid, localpart, token.getUid());
+                    result.fail();
+                    return;
+                }
+
+                result.succeed(mxid.getId(), UserIdType.MatrixID.getId(), token.getName());
+                log.info("{} was successfully authenticated", mxid);
+                log.info("Fetching profile for {}", mxid);
+                CountDownLatch userRecordLatch = new CountDownLatch(1);
+                getFirebase().getUser(token.getUid()).addOnSuccessListener(user -> {
+                    try {
+                        toEmail(result, user.getEmail());
+                        toMsisdn(result, user.getPhoneNumber());
+
+                        for (UserInfo info : user.getProviderData()) {
+                            toEmail(result, info.getEmail());
+                            toMsisdn(result, info.getPhoneNumber());
+                        }
+
+                        log.info("Got {} 3PIDs in profile", result.getProfile().getThreePids().size());
+                    } finally {
+                        userRecordLatch.countDown();
+                    }
+                }).addOnFailureListener(e -> {
+                    try {
+                        log.warn("Unable to fetch Firebase user profile for {}", mxid);
+                        result.fail();
+                    } finally {
+                        userRecordLatch.countDown();
+                    }
+                });
+
+                waitOnLatch(result, userRecordLatch, "Firebase user profile");
+            } finally {
+                l.countDown();
+            }
+        }).addOnFailureListener(e -> {
+            try {
+                if (e instanceof IllegalArgumentException) {
+                    log.info("Failure to authenticate {}: invalid firebase token", mxid);
+                } else {
+                    log.info("Failure to authenticate {}: {}", mxid, e.getMessage(), e);
+                    log.info("Exception", e);
+                }
+
+                result.fail();
+            } finally {
+                l.countDown();
+            }
+        });
+
+        waitOnLatch(result, l, "Firebase auth check");
+        return result;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/firebase/GoogleFirebaseBackend.java

@@ -0,0 +1,88 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.firebase;
+
+import com.google.firebase.FirebaseApp;
+import com.google.firebase.FirebaseOptions;
+import com.google.firebase.auth.FirebaseAuth;
+import com.google.firebase.auth.FirebaseCredential;
+import com.google.firebase.auth.FirebaseCredentials;
+import com.google.firebase.database.FirebaseDatabase;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.FileInputStream;
+import java.io.IOException;
+
+public class GoogleFirebaseBackend {
+
+    private Logger log = LoggerFactory.getLogger(GoogleFirebaseBackend.class);
+
+    private boolean isEnabled;
+    private FirebaseAuth fbAuth;
+    protected FirebaseDatabase fbDb;
+
+    GoogleFirebaseBackend(boolean isEnabled, String name, String credsPath, String db) {
+        this.isEnabled = isEnabled;
+        if (!isEnabled) {
+            return;
+        }
+
+        try {
+            FirebaseApp fbApp = FirebaseApp.initializeApp(getOpts(credsPath, db), name);
+            fbAuth = FirebaseAuth.getInstance(fbApp);
+            FirebaseDatabase.getInstance(fbApp);
+
+            log.info("Google Firebase Authentication is ready");
+        } catch (IOException e) {
+            throw new RuntimeException("Error when initializing Firebase", e);
+        }
+    }
+
+    private FirebaseCredential getCreds(String credsPath) throws IOException {
+        if (StringUtils.isNotBlank(credsPath)) {
+            return FirebaseCredentials.fromCertificate(new FileInputStream(credsPath));
+        } else {
+            return FirebaseCredentials.applicationDefault();
+        }
+    }
+
+    private FirebaseOptions getOpts(String credsPath, String db) throws IOException {
+        if (StringUtils.isBlank(db)) {
+            throw new IllegalArgumentException("Firebase database is not configured");
+        }
+
+        return new FirebaseOptions.Builder()
+                .setCredential(getCreds(credsPath))
+                .setDatabaseUrl(db)
+                .build();
+    }
+
+    FirebaseAuth getFirebase() {
+        return fbAuth;
+    }
+
+    public boolean isEnabled() {
+        return isEnabled;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/firebase/GoogleFirebaseProvider.java

@@ -0,0 +1,132 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.firebase;
+
+import com.google.firebase.auth.UserRecord;
+import com.google.firebase.tasks.OnFailureListener;
+import com.google.firebase.tasks.OnSuccessListener;
+import io.kamax.matrix.MatrixID;
+import io.kamax.matrix.ThreePidMedium;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+
+public class GoogleFirebaseProvider extends GoogleFirebaseBackend implements IThreePidProvider {
+
+    private Logger log = LoggerFactory.getLogger(GoogleFirebaseProvider.class);
+    private String domain;
+
+    public GoogleFirebaseProvider(boolean isEnabled, String credsPath, String db, String domain) {
+        super(isEnabled, "ThreePidProvider", credsPath, db);
+        this.domain = domain;
+    }
+
+    private String getMxid(UserRecord record) {
+        return new MatrixID(record.getUid(), domain).getId();
+    }
+
+    @Override
+    public boolean isLocal() {
+        return true;
+    }
+
+    @Override
+    public int getPriority() {
+        return 25;
+    }
+
+    private void waitOnLatch(CountDownLatch l) {
+        try {
+            l.await(30, TimeUnit.SECONDS);
+        } catch (InterruptedException e) {
+            log.warn("Interrupted while waiting for Firebase auth check");
+        }
+    }
+
+    private Optional<UserRecord> findInternal(String medium, String address) {
+        final UserRecord[] r = new UserRecord[1];
+        CountDownLatch l = new CountDownLatch(1);
+
+        OnSuccessListener<UserRecord> success = result -> {
+            log.info("Found 3PID match for {}:{} - UID is {}", medium, address, result.getUid());
+            r[0] = result;
+            l.countDown();
+        };
+
+        OnFailureListener failure = e -> {
+            log.info("No 3PID match for {}:{} - {}", medium, address, e.getMessage());
+            r[0] = null;
+            l.countDown();
+        };
+
+        if (ThreePidMedium.Email.is(medium)) {
+            log.info("Performing E-mail 3PID lookup for {}", address);
+            getFirebase().getUserByEmail(address)
+                    .addOnSuccessListener(success)
+                    .addOnFailureListener(failure);
+            waitOnLatch(l);
+        } else if (ThreePidMedium.PhoneNumber.is(medium)) {
+            log.info("Performing msisdn 3PID lookup for {}", address);
+            getFirebase().getUserByPhoneNumber(address)
+                    .addOnSuccessListener(success)
+                    .addOnFailureListener(failure);
+            waitOnLatch(l);
+        } else {
+            log.info("{} is not a supported 3PID medium", medium);
+            r[0] = null;
+        }
+
+        return Optional.ofNullable(r[0]);
+    }
+
+    @Override
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        Optional<UserRecord> urOpt = findInternal(request.getType(), request.getThreePid());
+        return urOpt.map(userRecord -> new SingleLookupReply(request, getMxid(userRecord)));
+
+    }
+
+    @Override
+    public List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
+        List<ThreePidMapping> results = new ArrayList<>();
+        mappings.parallelStream().forEach(o -> {
+            Optional<UserRecord> urOpt = findInternal(o.getMedium(), o.getValue());
+            if (urOpt.isPresent()) {
+                ThreePidMapping result = new ThreePidMapping();
+                result.setMedium(o.getMedium());
+                result.setValue(o.getValue());
+                result.setMxid(getMxid(urOpt.get()));
+                results.add(result);
+            }
+        });
+        return results;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/ldap/LdapAuthProvider.java

@@ -0,0 +1,115 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.ldap;
+
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.UserIdType;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.BackendAuthResult;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.ldap.LdapConfig;
+import org.apache.commons.lang.StringUtils;
+import org.apache.directory.api.ldap.model.cursor.CursorException;
+import org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException;
+import org.apache.directory.api.ldap.model.cursor.EntryCursor;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.SearchScope;
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+public class LdapAuthProvider extends LdapGenericBackend implements AuthenticatorProvider {
+
+    private Logger log = LoggerFactory.getLogger(LdapAuthProvider.class);
+
+    @Autowired
+    public LdapAuthProvider(LdapConfig cfg, MatrixConfig mxCfg) {
+        super(cfg, mxCfg);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return getCfg().isEnabled();
+    }
+
+    @Override
+    public BackendAuthResult authenticate(_MatrixID mxid, String password) {
+        log.info("Performing auth for {}", mxid);
+
+
+        try (LdapConnection conn = getConn()) {
+            bind(conn);
+
+            String uidType = getAt().getUid().getType();
+            String userFilterValue = StringUtils.equals(LdapGenericBackend.UID, uidType) ? mxid.getLocalPart() : mxid.getId();
+            if (StringUtils.isBlank(userFilterValue)) {
+                log.warn("Username is empty, failing auth");
+                return BackendAuthResult.failure();
+            }
+
+            String userFilter = "(" + getUidAtt() + "=" + userFilterValue + ")";
+            userFilter = buildWithFilter(userFilter, getCfg().getAuth().getFilter());
+            try (EntryCursor cursor = conn.search(getBaseDn(), userFilter, SearchScope.SUBTREE, getUidAtt(), getAt().getName())) {
+                while (cursor.next()) {
+                    Entry entry = cursor.get();
+                    String dn = entry.getDn().getName();
+                    log.info("Checking possible match, DN: {}", dn);
+
+                    if (!getAttribute(entry, getUidAtt()).isPresent()) {
+                        continue;
+                    }
+
+                    log.info("Attempting authentication on LDAP for {}", dn);
+                    try {
+                        conn.bind(entry.getDn(), password);
+                    } catch (LdapException e) {
+                        log.info("Unable to bind using {} because {}", entry.getDn().getName(), e.getMessage());
+                        return BackendAuthResult.failure();
+                    }
+
+                    Attribute nameAttribute = entry.get(getAt().getName());
+                    String name = nameAttribute != null ? nameAttribute.get().toString() : null;
+
+                    log.info("Authentication successful for {}", entry.getDn().getName());
+                    log.info("DN {} is a valid match", dn);
+
+                    // TODO should we canonicalize the MXID?
+                    return BackendAuthResult.success(mxid.getId(), UserIdType.MatrixID, name);
+                }
+            } catch (CursorLdapReferralException e) {
+                log.warn("Entity for {} is only available via referral, skipping", mxid);
+            }
+
+            log.info("No match were found for {}", mxid);
+            return BackendAuthResult.failure();
+        } catch (LdapException | IOException | CursorException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/ldap/LdapDirectoryProvider.java

@@ -0,0 +1,120 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.ldap;
+
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.ldap.LdapAttributeConfig;
+import io.kamax.mxisd.config.ldap.LdapConfig;
+import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchResult;
+import io.kamax.mxisd.directory.IDirectoryProvider;
+import io.kamax.mxisd.exception.InternalServerError;
+import org.apache.directory.api.ldap.model.cursor.CursorException;
+import org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException;
+import org.apache.directory.api.ldap.model.cursor.EntryCursor;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.SearchScope;
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+@Component
+public class LdapDirectoryProvider extends LdapGenericBackend implements IDirectoryProvider {
+
+    private Logger log = LoggerFactory.getLogger(LdapDirectoryProvider.class);
+
+    @Autowired
+    public LdapDirectoryProvider(LdapConfig cfg, MatrixConfig mxCfg) {
+        super(cfg, mxCfg);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return getCfg().isEnabled();
+    }
+
+    protected UserDirectorySearchResult search(String query, List<String> attributes) {
+        UserDirectorySearchResult result = new UserDirectorySearchResult();
+        result.setLimited(false);
+
+        try (LdapConnection conn = getConn()) {
+            bind(conn);
+
+            LdapAttributeConfig atCfg = getCfg().getAttribute();
+
+            attributes = new ArrayList<>(attributes);
+            attributes.add(getUidAtt());
+            String[] attArray = new String[attributes.size()];
+            attributes.toArray(attArray);
+
+            String searchQuery = buildOrQueryWithFilter(getCfg().getDirectory().getFilter(), "*" + query + "*", attArray);
+            log.debug("Query: {}", searchQuery);
+            try (EntryCursor cursor = conn.search(getBaseDn(), searchQuery, SearchScope.SUBTREE, attArray)) {
+                while (cursor.next()) {
+                    Entry entry = cursor.get();
+                    log.info("Found possible match, DN: {}", entry.getDn().getName());
+                    getAttribute(entry, getUidAtt()).ifPresent(uid -> {
+                        log.info("DN {} is a valid match", entry.getDn().getName());
+                        try {
+                            UserDirectorySearchResult.Result entryResult = new UserDirectorySearchResult.Result();
+                            entryResult.setUserId(buildMatrixIdFromUid(uid));
+                            getAttribute(entry, atCfg.getName()).ifPresent(entryResult::setDisplayName);
+                            result.addResult(entryResult);
+                        } catch (IllegalArgumentException e) {
+                            log.warn("Bind was found but type {} is not supported", atCfg.getUid().getType());
+                        }
+                    });
+                }
+            }
+        } catch (CursorLdapReferralException e) {
+            log.warn("An entry is only available via referral, skipping");
+        } catch (IOException | LdapException | CursorException e) {
+            throw new InternalServerError(e);
+        }
+
+        return result;
+    }
+
+    @Override
+    public UserDirectorySearchResult searchByDisplayName(String query) {
+        log.info("Performing LDAP directory search on display name using '{}'", query);
+        List<String> attributes = new ArrayList<>();
+        attributes.add(getAt().getName());
+        attributes.addAll(getCfg().getDirectory().getAttribute().getOther());
+        return search(query, attributes);
+    }
+
+    @Override
+    public UserDirectorySearchResult searchBy3pid(String query) {
+        log.info("Performing LDAP directory search on 3PIDs using '{}'", query);
+        List<String> attributes = new ArrayList<>();
+        attributes.add(getAt().getName());
+        getCfg().getAttribute().getThreepid().forEach((k, v) -> attributes.addAll(v));
+        return search(query, attributes);
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/ldap/LdapGenericBackend.java

@@ -0,0 +1,140 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.ldap;
+
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.ldap.LdapAttributeConfig;
+import io.kamax.mxisd.config.ldap.LdapConfig;
+import org.apache.commons.lang.StringUtils;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.apache.directory.ldap.client.api.LdapNetworkConnection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+
+public abstract class LdapGenericBackend {
+
+    public static final String UID = "uid";
+    public static final String MATRIX_ID = "mxid";
+
+    private Logger log = LoggerFactory.getLogger(LdapGenericBackend.class);
+
+    private LdapConfig cfg;
+    private MatrixConfig mxCfg;
+
+    public LdapGenericBackend(LdapConfig cfg, MatrixConfig mxCfg) {
+        this.cfg = cfg;
+        this.mxCfg = mxCfg;
+    }
+
+    protected LdapConfig getCfg() {
+        return cfg;
+    }
+
+    protected String getBaseDn() {
+        return cfg.getConn().getBaseDn();
+    }
+
+    protected LdapAttributeConfig getAt() {
+        return cfg.getAttribute();
+    }
+
+    protected String getUidAtt() {
+        return getAt().getUid().getValue();
+    }
+
+    protected synchronized LdapConnection getConn() throws LdapException {
+        return new LdapNetworkConnection(cfg.getConn().getHost(), cfg.getConn().getPort(), cfg.getConn().isTls());
+    }
+
+    protected void bind(LdapConnection conn) throws LdapException {
+        if (StringUtils.isBlank(cfg.getConn().getBindDn()) && StringUtils.isBlank(cfg.getConn().getBindPassword())) {
+            conn.anonymousBind();
+        } else {
+            conn.bind(cfg.getConn().getBindDn(), cfg.getConn().getBindPassword());
+        }
+    }
+
+    protected String buildWithFilter(String base, String filter) {
+        if (StringUtils.isBlank(filter)) {
+            return base;
+        } else {
+            return "(&" + filter + base + ")";
+        }
+    }
+
+    public static String buildOrQuery(String value, List<String> attributes) {
+        if (attributes.size() < 1) {
+            throw new IllegalArgumentException();
+        }
+
+        StringBuilder builder = new StringBuilder();
+        builder.append("(|");
+        attributes.forEach(s -> {
+            builder.append("(");
+            builder.append(s).append("=").append(value).append(")");
+        });
+        builder.append(")");
+        return builder.toString();
+    }
+
+    public static String buildOrQuery(String value, String... attributes) {
+        return buildOrQuery(value, Arrays.asList(attributes));
+    }
+
+    public String buildOrQueryWithFilter(String filter, String value, String... attributes) {
+        return buildWithFilter(buildOrQuery(value, attributes), filter);
+    }
+
+    public String buildMatrixIdFromUid(String uid) {
+        String uidType = getCfg().getAttribute().getUid().getType();
+        if (StringUtils.equals(UID, uidType)) {
+            return "@" + uid + ":" + mxCfg.getDomain();
+        } else if (StringUtils.equals(MATRIX_ID, uidType)) {
+            return uid;
+        } else {
+            throw new IllegalArgumentException("Bind type " + uidType + " is not supported");
+        }
+    }
+
+    public Optional<String> getAttribute(Entry entry, String attName) {
+        Attribute attribute = entry.get(attName);
+        if (attribute == null) {
+            log.info("DN {}: no attribute {}, skipping", entry.getDn(), attName);
+            return Optional.empty();
+        }
+
+        String value = attribute.get().toString();
+        if (StringUtils.isBlank(value)) {
+            log.info("DN {}: empty attribute {}, skipping", attName);
+            return Optional.empty();
+        }
+
+        return Optional.of(value);
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/ldap/LdapThreePidProvider.java

@@ -0,0 +1,137 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.ldap;
+
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.ldap.LdapConfig;
+import io.kamax.mxisd.exception.InternalServerError;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.apache.directory.api.ldap.model.cursor.CursorException;
+import org.apache.directory.api.ldap.model.cursor.CursorLdapReferralException;
+import org.apache.directory.api.ldap.model.cursor.EntryCursor;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.SearchScope;
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+@Component
+public class LdapThreePidProvider extends LdapGenericBackend implements IThreePidProvider {
+
+    private Logger log = LoggerFactory.getLogger(LdapThreePidProvider.class);
+
+    public LdapThreePidProvider(LdapConfig cfg, MatrixConfig mxCfg) {
+        super(cfg, mxCfg);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return getCfg().isEnabled();
+    }
+
+    @Override
+    public boolean isLocal() {
+        return true;
+    }
+
+    @Override
+    public int getPriority() {
+        return 20;
+    }
+
+    private Optional<String> lookup(LdapConnection conn, String medium, String value) {
+        Optional<String> queryOpt = getCfg().getIdentity().getQuery(medium);
+        if (!queryOpt.isPresent()) {
+            log.warn("{} is not a configured 3PID type for LDAP lookup", medium);
+            return Optional.empty();
+        }
+
+        String searchQuery = queryOpt.get().replaceAll(getCfg().getIdentity().getToken(), value);
+        try (EntryCursor cursor = conn.search(getBaseDn(), searchQuery, SearchScope.SUBTREE, getUidAtt())) {
+            while (cursor.next()) {
+                Entry entry = cursor.get();
+                log.info("Found possible match, DN: {}", entry.getDn().getName());
+
+                Optional<String> data = getAttribute(entry, getUidAtt());
+                if (!data.isPresent()) {
+                    continue;
+                }
+
+                log.info("DN {} is a valid match", entry.getDn().getName());
+                return Optional.of(buildMatrixIdFromUid(data.get()));
+            }
+        } catch (CursorLdapReferralException e) {
+            log.warn("3PID {} is only available via referral, skipping", value);
+        } catch (IOException | LdapException | CursorException e) {
+            throw new InternalServerError(e);
+        }
+
+        return Optional.empty();
+    }
+
+    @Override
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        log.info("Performing LDAP lookup {} of type {}", request.getThreePid(), request.getType());
+
+        try (LdapConnection conn = getConn()) {
+            bind(conn);
+            return lookup(conn, request.getType(), request.getThreePid()).map(id -> new SingleLookupReply(request, id));
+        } catch (LdapException | IOException e) {
+            throw new InternalServerError(e);
+        }
+    }
+
+    @Override
+    public List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
+        log.info("Looking up {} mappings", mappings.size());
+        List<ThreePidMapping> mappingsFound = new ArrayList<>();
+
+        try (LdapConnection conn = getConn()) {
+            bind(conn);
+
+            for (ThreePidMapping mapping : mappings) {
+                try {
+                    lookup(conn, mapping.getMedium(), mapping.getValue()).ifPresent(id -> {
+                        mapping.setMxid(id);
+                        mappingsFound.add(mapping);
+                    });
+                } catch (IllegalArgumentException e) {
+                    log.warn("{} is not a supported 3PID type for LDAP lookup", mapping.getMedium());
+                }
+            }
+        } catch (LdapException | IOException e) {
+            throw new InternalServerError(e);
+        }
+
+        return mappingsFound;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/LookupBulkResponseJson.java

@@ -0,0 +1,34 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+import java.util.ArrayList;
+import java.util.List;
+
+public class LookupBulkResponseJson {
+
+    private List<LookupSingleResponseJson> lookup = new ArrayList<>();
+
+    public List<LookupSingleResponseJson> getLookup() {
+        return lookup;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/LookupSingleRequestJson.java

@@ -0,0 +1,40 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+public class LookupSingleRequestJson {
+
+    private String medium;
+    private String address;
+
+    public LookupSingleRequestJson(String medium, String address) {
+        this.medium = medium;
+        this.address = address;
+    }
+
+    public String getMedium() {
+        return medium;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+}

src/main/java/io/kamax/mxisd/backend/rest/LookupSingleResponseJson.java

@@ -18,27 +18,26 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.lookup
+package io.kamax.mxisd.backend.rest;
 
-class SingleLookupRequest extends ALookupRequest {
+import io.kamax.mxisd.UserID;
 
-    private String type
-    private String threePid
+public class LookupSingleResponseJson {
 
-    String getType() {
-        return type
+    private String medium;
+    private String address;
+    private UserID id;
+
+    public String getMedium() {
+        return medium;
     }
 
-    void setType(String type) {
-        this.type = type
+    public String getAddress() {
+        return address;
     }
 
-    String getThreePid() {
-        return threePid
-    }
-
-    void setThreePid(String threePid) {
-        this.threePid = threePid
+    public UserID getId() {
+        return id;
     }
 
 }

src/main/java/io/kamax/mxisd/backend/rest/RestAuthProvider.java

@@ -0,0 +1,69 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.BackendAuthResult;
+import io.kamax.mxisd.config.rest.RestBackendConfig;
+import io.kamax.mxisd.util.RestClientUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpUriRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+public class RestAuthProvider extends RestProvider implements AuthenticatorProvider {
+
+    @Autowired
+    public RestAuthProvider(RestBackendConfig cfg) {
+        super(cfg);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled();
+    }
+
+    @Override
+    public BackendAuthResult authenticate(_MatrixID mxid, String password) {
+        RestAuthRequestJson auth = new RestAuthRequestJson();
+        auth.setMxid(mxid.getId());
+        auth.setLocalpart(mxid.getLocalPart());
+        auth.setDomain(mxid.getDomain());
+        auth.setPassword(password);
+
+        HttpUriRequest req = RestClientUtils.post(cfg.getEndpoints().getAuth(), gson, "auth", auth);
+        try (CloseableHttpResponse res = client.execute(req)) {
+            int status = res.getStatusLine().getStatusCode();
+            if (status < 200 || status >= 300) {
+                return BackendAuthResult.failure();
+            }
+
+            return parser.parse(res, "auth", BackendAuthResult.class);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/RestAuthRequestJson.java

@@ -0,0 +1,62 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+public class RestAuthRequestJson {
+
+    private String mxid;
+    private String localpart;
+    private String domain;
+    private String password;
+
+    public String getMxid() {
+        return mxid;
+    }
+
+    public void setMxid(String mxid) {
+        this.mxid = mxid;
+    }
+
+    public String getLocalpart() {
+        return localpart;
+    }
+
+    public void setLocalpart(String localpart) {
+        this.localpart = localpart;
+    }
+
+    public String getDomain() {
+        return domain;
+    }
+
+    public void setDomain(String domain) {
+        this.domain = domain;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/RestDirectoryProvider.java

@@ -0,0 +1,82 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.rest.RestBackendConfig;
+import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchRequest;
+import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchResult;
+import io.kamax.mxisd.directory.IDirectoryProvider;
+import io.kamax.mxisd.exception.InternalServerError;
+import io.kamax.mxisd.util.RestClientUtils;
+import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+public class RestDirectoryProvider extends RestProvider implements IDirectoryProvider {
+
+    private MatrixConfig mxCfg;
+
+    public RestDirectoryProvider(RestBackendConfig cfg, MatrixConfig mxCfg) {
+        super(cfg);
+        this.mxCfg = mxCfg;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled() && StringUtils.isNotBlank(cfg.getEndpoints().getDirectory());
+    }
+
+    private UserDirectorySearchResult search(String by, String query) {
+        UserDirectorySearchRequest request = new UserDirectorySearchRequest(query);
+        request.setBy(by);
+        try (CloseableHttpResponse httpResponse = client.execute(RestClientUtils.post(cfg.getEndpoints().getDirectory(), request))) {
+            int status = httpResponse.getStatusLine().getStatusCode();
+            if (status < 200 || status >= 300) {
+                throw new InternalServerError("REST backend: Error: " + IOUtils.toString(httpResponse.getEntity().getContent(), StandardCharsets.UTF_8));
+            }
+
+            UserDirectorySearchResult response = parser.parse(httpResponse, UserDirectorySearchResult.class);
+            for (UserDirectorySearchResult.Result result : response.getResults()) {
+                result.setUserId(new MatrixID(result.getUserId(), mxCfg.getDomain()).getId());
+            }
+
+            return response;
+        } catch (IOException e) {
+            throw new InternalServerError("REST backend: I/O error: " + e.getMessage());
+        }
+    }
+
+    @Override
+    public UserDirectorySearchResult searchByDisplayName(String query) {
+        return search("name", query);
+    }
+
+    @Override
+    public UserDirectorySearchResult searchBy3pid(String query) {
+        return search("threepid", query);
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/RestProvider.java

@@ -0,0 +1,46 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+import com.google.gson.FieldNamingPolicy;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import io.kamax.mxisd.config.rest.RestBackendConfig;
+import io.kamax.mxisd.util.GsonParser;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+
+public class RestProvider {
+
+    protected RestBackendConfig cfg;
+    protected Gson gson;
+    protected GsonParser parser;
+    protected CloseableHttpClient client;
+
+    public RestProvider(RestBackendConfig cfg) {
+        this.cfg = cfg;
+
+        client = HttpClients.createDefault();
+        gson = new GsonBuilder().setFieldNamingPolicy(FieldNamingPolicy.LOWER_CASE_WITH_UNDERSCORES).create();
+        parser = new GsonParser(gson);
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/rest/RestThreePidProvider.java

@@ -0,0 +1,131 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.rest;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.UserID;
+import io.kamax.mxisd.UserIdType;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.rest.RestBackendConfig;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import io.kamax.mxisd.util.RestClientUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpUriRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+@Component
+public class RestThreePidProvider extends RestProvider implements IThreePidProvider {
+
+    private Logger log = LoggerFactory.getLogger(RestThreePidProvider.class);
+
+    private MatrixConfig mxCfg; // FIXME should be done in the lookup manager
+
+    @Autowired
+    public RestThreePidProvider(RestBackendConfig cfg, MatrixConfig mxCfg) {
+        super(cfg);
+        this.mxCfg = mxCfg;
+    }
+
+    // TODO refactor in lookup manager with above FIXME
+    private _MatrixID getMxId(UserID id) {
+        if (UserIdType.Localpart.is(id.getType())) {
+            return new MatrixID(id.getValue(), mxCfg.getDomain());
+        } else {
+            return new MatrixID(id.getValue());
+        }
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled();
+    }
+
+    @Override
+    public boolean isLocal() {
+        return true;
+    }
+
+    @Override
+    public int getPriority() {
+        return 20;
+    }
+
+    // TODO refactor common code
+    @Override
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        String endpoint = cfg.getEndpoints().getIdentity().getSingle();
+        HttpUriRequest req = RestClientUtils.post(endpoint, gson, "lookup",
+                new LookupSingleRequestJson(request.getType(), request.getThreePid()));
+
+        try (CloseableHttpResponse res = client.execute(req)) {
+            int status = res.getStatusLine().getStatusCode();
+            if (status < 200 || status >= 300) {
+                log.warn("REST endpoint {} answered with status {}, no binding found", endpoint, status);
+                return Optional.empty();
+            }
+
+            Optional<LookupSingleResponseJson> responseOpt = parser.parseOptional(res, "lookup", LookupSingleResponseJson.class);
+            return responseOpt.map(lookupSingleResponseJson -> new SingleLookupReply(request, getMxId(lookupSingleResponseJson.getId())));
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    // TODO refactor common code
+    @Override
+    public List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
+        List<LookupSingleRequestJson> ioListRequest = mappings.stream()
+                .map(mapping -> new LookupSingleRequestJson(mapping.getMedium(), mapping.getValue()))
+                .collect(Collectors.toList());
+
+        HttpUriRequest req = RestClientUtils.post(
+                cfg.getEndpoints().getIdentity().getBulk(), gson, "lookup", ioListRequest);
+        try (CloseableHttpResponse res = client.execute(req)) {
+            mappings = new ArrayList<>();
+
+            int status = res.getStatusLine().getStatusCode();
+            if (status < 200 || status >= 300) {
+                return mappings;
+            }
+
+            LookupBulkResponseJson listIo = parser.parse(res, LookupBulkResponseJson.class);
+            return listIo.getLookup().stream()
+                    .map(io -> new ThreePidMapping(io.getMedium(), io.getAddress(), getMxId(io.getId()).getId()))
+                    .collect(Collectors.toList());
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/sql/SqlAuthProvider.java

@@ -0,0 +1,61 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.sql;
+
+import io.kamax.matrix._MatrixID;
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.auth.provider.BackendAuthResult;
+import io.kamax.mxisd.config.ServerConfig;
+import io.kamax.mxisd.config.sql.SqlProviderConfig;
+import io.kamax.mxisd.invitation.InvitationManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+@Component
+public class SqlAuthProvider implements AuthenticatorProvider {
+
+    private Logger log = LoggerFactory.getLogger(SqlAuthProvider.class);
+
+    @Autowired
+    private ServerConfig srvCfg;
+
+    @Autowired
+    private SqlProviderConfig cfg;
+
+    @Autowired
+    private InvitationManager invMgr;
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled();
+    }
+
+    @Override
+    public BackendAuthResult authenticate(_MatrixID mxid, String password) {
+        log.info("Performing dummy authentication try to force invite mapping refresh");
+
+        invMgr.lookupMappingsForInvites();
+        return BackendAuthResult.failure();
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/sql/SqlConnectionPool.java

@@ -0,0 +1,45 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.sql;
+
+import com.mchange.v2.c3p0.ComboPooledDataSource;
+import io.kamax.mxisd.config.sql.SqlConfig;
+
+import java.sql.Connection;
+import java.sql.SQLException;
+
+public class SqlConnectionPool {
+
+    private ComboPooledDataSource ds;
+
+    public SqlConnectionPool(SqlConfig cfg) {
+        ds = new ComboPooledDataSource();
+        ds.setJdbcUrl("jdbc:" + cfg.getType() + ":" + cfg.getConnection());
+        ds.setMinPoolSize(1);
+        ds.setMaxPoolSize(10);
+        ds.setAcquireIncrement(2);
+    }
+
+    public Connection get() throws SQLException {
+        return ds.getConnection();
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/sql/SqlDirectoryProvider.java

@@ -0,0 +1,114 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.sql;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.sql.SqlConfig;
+import io.kamax.mxisd.config.sql.SqlProviderConfig;
+import io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchResult;
+import io.kamax.mxisd.directory.IDirectoryProvider;
+import io.kamax.mxisd.exception.InternalServerError;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.Optional;
+
+import static io.kamax.mxisd.controller.directory.v1.io.UserDirectorySearchResult.Result;
+
+public abstract class SqlDirectoryProvider implements IDirectoryProvider {
+
+    private Logger log = LoggerFactory.getLogger(SqlDirectoryProvider.class);
+
+    protected SqlConfig cfg;
+    private MatrixConfig mxCfg;
+
+    private SqlConnectionPool pool;
+
+    public SqlDirectoryProvider(SqlConfig cfg, MatrixConfig mxCfg) {
+        this.cfg = cfg;
+        this.pool = new SqlConnectionPool(cfg);
+        this.mxCfg = mxCfg;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled();
+    }
+
+    protected void setParameters(PreparedStatement stmt, String searchTerm) throws SQLException {
+        for (int i = 1; i <= stmt.getParameterMetaData().getParameterCount(); i++) {
+            stmt.setString(i, searchTerm);
+        }
+    }
+
+    protected Optional<Result> processRow(ResultSet rSet) throws SQLException {
+        Result item = new Result();
+        item.setUserId(rSet.getString(1));
+        item.setDisplayName(rSet.getString(2));
+        return Optional.of(item);
+    }
+
+    public UserDirectorySearchResult search(String searchTerm, SqlProviderConfig.Query query) {
+        try (Connection conn = pool.get()) {
+            log.info("Will execute query: {}", query.getValue());
+            try (PreparedStatement stmt = conn.prepareStatement(query.getValue())) {
+                setParameters(stmt, searchTerm);
+
+                try (ResultSet rSet = stmt.executeQuery()) {
+                    UserDirectorySearchResult result = new UserDirectorySearchResult();
+                    result.setLimited(false);
+
+                    while (rSet.next()) {
+                        processRow(rSet).ifPresent(e -> {
+                            if (StringUtils.equalsIgnoreCase("localpart", query.getType())) {
+                                e.setUserId(new MatrixID(e.getUserId(), mxCfg.getDomain()).getId());
+                            }
+                            result.addResult(e);
+                        });
+                    }
+
+                    return result;
+                }
+            }
+        } catch (SQLException e) {
+            throw new InternalServerError(e);
+        }
+    }
+
+    @Override
+    public UserDirectorySearchResult searchByDisplayName(String searchTerm) {
+        log.info("Searching users by display name using '{}'", searchTerm);
+        return search(searchTerm, cfg.getDirectory().getQuery().getName());
+    }
+
+    @Override
+    public UserDirectorySearchResult searchBy3pid(String searchTerm) {
+        log.info("Searching users by 3PID using '{}'", searchTerm);
+        return search(searchTerm, cfg.getDirectory().getQuery().getThreepid());
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/sql/SqlThreePidProvider.java

@@ -0,0 +1,116 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.sql;
+
+import io.kamax.matrix.MatrixID;
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.sql.SqlProviderConfig;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
+import io.kamax.mxisd.lookup.ThreePidMapping;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+@Component
+public class SqlThreePidProvider implements IThreePidProvider {
+
+    private Logger log = LoggerFactory.getLogger(SqlThreePidProvider.class);
+
+    private SqlProviderConfig cfg;
+    private MatrixConfig mxCfg;
+
+    private SqlConnectionPool pool;
+
+    @Autowired
+    public SqlThreePidProvider(SqlProviderConfig cfg, MatrixConfig mxCfg) {
+        this.cfg = cfg;
+        this.pool = new SqlConnectionPool(cfg);
+        this.mxCfg = mxCfg;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return cfg.isEnabled();
+    }
+
+    @Override
+    public boolean isLocal() {
+        return true;
+    }
+
+    @Override
+    public int getPriority() {
+        return 20;
+    }
+
+    @Override
+    public Optional<SingleLookupReply> find(SingleLookupRequest request) {
+        log.info("SQL lookup");
+        String stmtSql = StringUtils.defaultIfBlank(cfg.getIdentity().getMedium().get(request.getType()), cfg.getIdentity().getQuery());
+        log.info("SQL query: {}", stmtSql);
+        try (Connection conn = pool.get()) {
+            try (PreparedStatement stmt = conn.prepareStatement(stmtSql)) {
+                stmt.setString(1, request.getType().toLowerCase());
+                stmt.setString(2, request.getThreePid().toLowerCase());
+
+                try (ResultSet rSet = stmt.executeQuery()) {
+                    while (rSet.next()) {
+                        String uid = rSet.getString("uid");
+                        log.info("Found match: {}", uid);
+                        if (StringUtils.equals("uid", cfg.getIdentity().getType())) {
+                            log.info("Resolving as localpart");
+                            return Optional.of(new SingleLookupReply(request, new MatrixID(uid, mxCfg.getDomain())));
+                        }
+                        if (StringUtils.equals("mxid", cfg.getIdentity().getType())) {
+                            log.info("Resolving as MXID");
+                            return Optional.of(new SingleLookupReply(request, new MatrixID(uid)));
+                        }
+
+                        log.info("Identity type is unknown, skipping");
+                    }
+
+                    log.info("No match found in SQL");
+                    return Optional.empty();
+                }
+            }
+        } catch (SQLException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Override
+    public List<ThreePidMapping> populate(List<ThreePidMapping> mappings) {
+        return new ArrayList<>();
+    }
+
+}

src/main/java/io/kamax/mxisd/backend/sql/SynapseSqliteDirectoryProvider.java

@@ -0,0 +1,71 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.backend.sql;
+
+import io.kamax.mxisd.config.MatrixConfig;
+import io.kamax.mxisd.config.sql.SqlProviderConfig;
+import io.kamax.mxisd.config.sql.synapse.SynapseSqlProviderConfig;
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
+
+@Component
+public class SynapseSqliteDirectoryProvider extends SqlDirectoryProvider {
+
+    private SynapseSqlProviderConfig cfg;
+
+    @Autowired
+    public SynapseSqliteDirectoryProvider(SynapseSqlProviderConfig cfg, MatrixConfig mxCfg) {
+        super(cfg, mxCfg);
+
+        if (StringUtils.equals("sqlite", cfg.getType())) {
+            String userId = "'@' || p.user_id || ':" + mxCfg.getDomain() + "'";
+            SqlProviderConfig.Type queries = cfg.getDirectory().getQuery();
+            queries.getName().setValue(
+                    "select " + userId + ", displayname from profiles p where displayname like ?");
+            queries.getThreepid().setValue(
+                    "select t.user_id, p.displayname " +
+                            "from user_threepids t JOIN profiles p on t.user_id = " + userId + " " +
+                            "where t.address like ?");
+        } else if (StringUtils.equals("postgresql", cfg.getType())) {
+            String userId = "concat('@',p.user_id,':" + mxCfg.getDomain() + "')";
+            SqlProviderConfig.Type queries = cfg.getDirectory().getQuery();
+            queries.getName().setValue(
+                    "select " + userId + ", displayname from profiles p where displayname ilike ?");
+            queries.getThreepid().setValue(
+                    "select t.user_id, p.displayname " +
+                            "from user_threepids t JOIN profiles p on t.user_id = " + userId + " " +
+                            "where t.address ilike ?");
+        } else {
+            throw new ConfigurationException("Invalid SQL type");
+        }
+    }
+
+    @Override
+    protected void setParameters(PreparedStatement stmt, String searchTerm) throws SQLException {
+        stmt.setString(1, "%" + searchTerm + "%");
+    }
+
+}

src/main/java/io/kamax/mxisd/config/DnsOverwriteConfig.java

@@ -0,0 +1,106 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import com.google.gson.Gson;
+import io.kamax.mxisd.util.GsonUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.util.ArrayList;
+import java.util.List;
+
+@Configuration
+@ConfigurationProperties("dns.overwrite")
+public class DnsOverwriteConfig {
+
+    private Logger log = LoggerFactory.getLogger(DnsOverwriteConfig.class);
+
+    public static class Entry {
+
+        private String name;
+        private String value;
+
+        public String getName() {
+            return name;
+        }
+
+        public void setName(String name) {
+            this.name = name;
+        }
+
+        public String getValue() {
+            return value;
+        }
+
+        public void setValue(String value) {
+            this.value = value;
+        }
+
+    }
+
+    public static class Type {
+
+        List<Entry> client = new ArrayList<>();
+        List<Entry> federation = new ArrayList<>();
+
+        public List<Entry> getClient() {
+            return client;
+        }
+
+        public void setClient(List<Entry> client) {
+            this.client = client;
+        }
+
+        public List<Entry> getFederation() {
+            return federation;
+        }
+
+        public void setFederation(List<Entry> federation) {
+            this.federation = federation;
+        }
+
+    }
+
+    private Type homeserver = new Type();
+
+    public Type getHomeserver() {
+        return homeserver;
+    }
+
+    public void setHomeserver(Type homeserver) {
+        this.homeserver = homeserver;
+    }
+
+    @PostConstruct
+    public void build() {
+        Gson gson = GsonUtil.build();
+        log.info("--- DNS Overwrite config ---");
+        log.info("Homeserver:");
+        log.info("\tClient: {}", gson.toJson(getHomeserver().getClient()));
+        log.info("\tFederation: {}", gson.toJson(getHomeserver().getFederation()));
+
+    }
+
+}

src/main/java/io/kamax/mxisd/config/FirebaseConfig.java

@@ -0,0 +1,93 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import io.kamax.mxisd.auth.provider.AuthenticatorProvider;
+import io.kamax.mxisd.backend.firebase.GoogleFirebaseAuthenticator;
+import io.kamax.mxisd.backend.firebase.GoogleFirebaseProvider;
+import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("firebase")
+public class FirebaseConfig {
+
+    private Logger log = LoggerFactory.getLogger(FirebaseConfig.class);
+
+    @Autowired
+    private MatrixConfig mxCfg;
+
+    private boolean enabled;
+    private String credentials;
+    private String database;
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getCredentials() {
+        return credentials;
+    }
+
+    public void setCredentials(String credentials) {
+        this.credentials = credentials;
+    }
+
+    public String getDatabase() {
+        return database;
+    }
+
+    public void setDatabase(String database) {
+        this.database = database;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Firebase configuration ---");
+        log.info("Enabled: {}", isEnabled());
+        if (isEnabled()) {
+            log.info("Credentials: {}", getCredentials());
+            log.info("Database: {}", getDatabase());
+        }
+    }
+
+    @Bean
+    public AuthenticatorProvider getAuthProvider() {
+        return new GoogleFirebaseAuthenticator(enabled, credentials, database);
+    }
+
+    @Bean
+    public IThreePidProvider getLookupProvider() {
+        return new GoogleFirebaseProvider(enabled, credentials, database, mxCfg.getDomain());
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ForwardConfig.java

@@ -0,0 +1,43 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@Configuration
+@ConfigurationProperties(prefix = "forward")
+public class ForwardConfig {
+
+    private List<String> servers = new ArrayList<>();
+
+    public List<String> getServers() {
+        return servers;
+    }
+
+    public void setServers(List<String> servers) {
+        this.servers = servers;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/KeyConfig.java

@@ -18,31 +18,33 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.config
+package io.kamax.mxisd.config;
 
-import org.apache.commons.lang.StringUtils
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
 
 @Configuration
 @ConfigurationProperties(prefix = "key")
-class KeyConfig implements InitializingBean {
+public class KeyConfig {
 
-    private String path
+    private String path;
 
-    void setPath(String path) {
-        this.path = path
+    public void setPath(String path) {
+        this.path = path;
     }
 
-    String getPath() {
-        return path
+    public String getPath() {
+        return path;
     }
 
-    @Override
-    void afterPropertiesSet() throws Exception {
+    @PostConstruct
+    public void build() {
         if (StringUtils.isBlank(getPath())) {
-            throw new RuntimeException("Key path must be configured!")
+            throw new ConfigurationException("key.path");
         }
     }
 

src/main/java/io/kamax/mxisd/config/MatrixConfig.java

@@ -0,0 +1,94 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import com.google.gson.Gson;
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Configuration
+@ConfigurationProperties("matrix")
+public class MatrixConfig {
+
+    public static class Identity {
+        private Map<String, List<String>> servers = new HashMap<>();
+
+        public Map<String, List<String>> getServers() {
+            return servers;
+        }
+
+        public void setServers(Map<String, List<String>> servers) {
+            this.servers = servers;
+        }
+
+        public List<String> getServers(String label) {
+            if (!servers.containsKey(label)) {
+                throw new RuntimeException("No Identity server list with label '" + label + "'");
+            }
+
+            return servers.get(label);
+        }
+    }
+
+    private Logger log = LoggerFactory.getLogger(MatrixConfig.class);
+
+    private String domain;
+    private Identity identity = new Identity();
+
+    public String getDomain() {
+        return domain;
+    }
+
+    public void setDomain(String domain) {
+        this.domain = domain;
+    }
+
+    public Identity getIdentity() {
+        return identity;
+    }
+
+    public void setIdentity(Identity identity) {
+        this.identity = identity;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Matrix config ---");
+
+        if (StringUtils.isBlank(domain)) {
+            throw new ConfigurationException("matrix.domain");
+        }
+
+        log.info("Domain: {}", getDomain());
+        log.info("Identity:");
+        log.info("\tServers: {}", new Gson().toJson(identity.getServers()));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/RecursiveLookupBridgeConfig.java

@@ -0,0 +1,86 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.util.HashMap;
+import java.util.Map;
+
+@Configuration
+@ConfigurationProperties(prefix = "lookup.recursive.bridge")
+public class RecursiveLookupBridgeConfig {
+
+    private Logger log = LoggerFactory.getLogger(RecursiveLookupBridgeConfig.class);
+
+    private boolean enabled;
+    private boolean recursiveOnly;
+    private String server;
+    private Map<String, String> mappings = new HashMap<>();
+
+    public boolean getEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public boolean getRecursiveOnly() {
+        return recursiveOnly;
+    }
+
+    public void setRecursiveOnly(boolean recursiveOnly) {
+        this.recursiveOnly = recursiveOnly;
+    }
+
+    public String getServer() {
+        return server;
+    }
+
+    public void setServer(String server) {
+        this.server = server;
+    }
+
+    public Map<String, String> getMappings() {
+        return mappings;
+    }
+
+    public void setMappings(Map<String, String> mappings) {
+        this.mappings = mappings;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Bridge integration lookups config ---");
+        log.info("Enabled: {}", getEnabled());
+        if (getEnabled()) {
+            log.info("Recursive only: {}", getRecursiveOnly());
+            log.info("Fallback Server: {}", getServer());
+            log.info("Mappings: {}", mappings.size());
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/config/RecursiveLookupConfig.java

@@ -18,41 +18,43 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.config
+package io.kamax.mxisd.config;
 
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.List;
 
 @Configuration
 @ConfigurationProperties(prefix = "lookup.recursive")
-class RecursiveLookupConfig {
+public class RecursiveLookupConfig {
 
-    private boolean enabled
-    private List<String> allowedCidr
-    private RecursiveLookupBridgeConfig bridge
+    private boolean enabled;
+    private List<String> allowedCidr;
+    private RecursiveLookupBridgeConfig bridge;
 
-    boolean isEnabled() {
-        return enabled
+    public boolean isEnabled() {
+        return enabled;
     }
 
-    void setEnabled(boolean enabled) {
-        this.enabled = enabled
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
     }
 
-    List<String> getAllowedCidr() {
-        return allowedCidr
+    public List<String> getAllowedCidr() {
+        return allowedCidr;
     }
 
-    void setAllowedCidr(List<String> allowedCidr) {
-        this.allowedCidr = allowedCidr
+    public void setAllowedCidr(List<String> allowedCidr) {
+        this.allowedCidr = allowedCidr;
     }
 
-    RecursiveLookupBridgeConfig getBridge() {
-        return bridge
+    public RecursiveLookupBridgeConfig getBridge() {
+        return bridge;
     }
 
-    void setBridge(RecursiveLookupBridgeConfig bridge) {
-        this.bridge = bridge
+    public void setBridge(RecursiveLookupBridgeConfig bridge) {
+        this.bridge = bridge;
     }
 
 }

src/main/java/io/kamax/mxisd/config/SQLiteStorageConfig.java

@@ -0,0 +1,40 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties("storage.provider.sqlite")
+public class SQLiteStorageConfig {
+
+    private String database;
+
+    public String getDatabase() {
+        return database;
+    }
+
+    public void setDatabase(String database) {
+        this.database = database;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ServerConfig.java

@@ -0,0 +1,98 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.net.MalformedURLException;
+import java.net.URL;
+
+@Configuration
+@ConfigurationProperties(prefix = "server")
+public class ServerConfig {
+
+    private Logger log = LoggerFactory.getLogger(ServerConfig.class);
+
+    @Autowired
+    private MatrixConfig mxCfg;
+
+    private String name;
+    private int port;
+    private String publicUrl;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    public void setPort(int port) {
+        this.port = port;
+    }
+
+    public String getPublicUrl() {
+        return publicUrl;
+    }
+
+    public void setPublicUrl(String publicUrl) {
+        this.publicUrl = publicUrl;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Server config ---");
+
+        if (StringUtils.isBlank(getName())) {
+            setName(mxCfg.getDomain());
+            log.debug("server.name is empty, using matrix.domain");
+        }
+
+        if (StringUtils.isBlank(getPublicUrl())) {
+            setPublicUrl("https://" + getName());
+            log.debug("Public URL is empty, generating from name");
+        } else {
+            setPublicUrl(StringUtils.replace(getPublicUrl(), "%SERVER_NAME%", getName()));
+        }
+
+        try {
+            new URL(getPublicUrl());
+        } catch (MalformedURLException e) {
+            log.warn("Public URL is not valid: {}", StringUtils.defaultIfBlank(e.getMessage(), "<no reason provided>"));
+        }
+
+        log.info("Name: {}", getName());
+        log.info("Port: {}", getPort());
+        log.info("Public URL: {}", getPublicUrl());
+    }
+
+}

src/main/java/io/kamax/mxisd/config/SessionConfig.java

@@ -0,0 +1,173 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import com.google.gson.Gson;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("session")
+public class SessionConfig {
+
+    private static Logger log = LoggerFactory.getLogger(SessionConfig.class);
+
+    public static class Policy {
+
+        public static class PolicyTemplate {
+
+            public static class PolicySource {
+
+                public static class PolicySourceRemote {
+
+                    private boolean enabled;
+                    private String server;
+
+                    public boolean isEnabled() {
+                        return enabled;
+                    }
+
+                    public void setEnabled(boolean enabled) {
+                        this.enabled = enabled;
+                    }
+
+                    public String getServer() {
+                        return server;
+                    }
+
+                    public void setServer(String server) {
+                        this.server = server;
+                    }
+
+                }
+
+                private boolean enabled;
+                private boolean toLocal;
+                private PolicySourceRemote toRemote = new PolicySourceRemote();
+
+                public boolean isEnabled() {
+                    return enabled;
+                }
+
+                public void setEnabled(boolean enabled) {
+                    this.enabled = enabled;
+                }
+
+                public boolean toLocal() {
+                    return toLocal;
+                }
+
+                public void setToLocal(boolean toLocal) {
+                    this.toLocal = toLocal;
+                }
+
+                public boolean toRemote() {
+                    return toRemote.isEnabled();
+                }
+
+                public PolicySourceRemote getToRemote() {
+                    return toRemote;
+                }
+
+                public void setToRemote(PolicySourceRemote toRemote) {
+                    this.toRemote = toRemote;
+                }
+
+            }
+
+            private boolean enabled;
+            private PolicySource forLocal = new PolicySource();
+            private PolicySource forRemote = new PolicySource();
+
+            public boolean isEnabled() {
+                return enabled;
+            }
+
+            public void setEnabled(boolean enabled) {
+                this.enabled = enabled;
+            }
+
+            public PolicySource getForLocal() {
+                return forLocal;
+            }
+
+            public PolicySource forLocal() {
+                return forLocal;
+            }
+
+            public PolicySource getForRemote() {
+                return forRemote;
+            }
+
+            public PolicySource forRemote() {
+                return forRemote;
+            }
+
+            public PolicySource forIf(boolean isLocal) {
+                return isLocal ? forLocal : forRemote;
+            }
+
+        }
+
+        private PolicyTemplate validation = new PolicyTemplate();
+
+        public PolicyTemplate getValidation() {
+            return validation;
+        }
+
+        public void setValidation(PolicyTemplate validation) {
+            this.validation = validation;
+        }
+
+    }
+
+    private MatrixConfig mxCfg;
+    private Policy policy = new Policy();
+
+    @Autowired
+    public SessionConfig(MatrixConfig mxCfg) {
+        this.mxCfg = mxCfg;
+    }
+
+    public MatrixConfig getMatrixCfg() {
+        return mxCfg;
+    }
+
+    public Policy getPolicy() {
+        return policy;
+    }
+
+    public void setPolicy(Policy policy) {
+        this.policy = policy;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Session config ---");
+        log.info("Global Policy: {}", new Gson().toJson(policy));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/StorageConfig.java

@@ -18,31 +18,33 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.config
+package io.kamax.mxisd.config;
 
-import org.apache.commons.lang.StringUtils
-import org.springframework.beans.factory.InitializingBean
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
 
 @Configuration
-@ConfigurationProperties(prefix = "server")
-class ServerConfig implements InitializingBean {
+@ConfigurationProperties("storage")
+public class StorageConfig {
 
-    private String name
+    private String backend;
 
-    String getName() {
-        return name
+    public String getBackend() {
+        return backend;
     }
 
-    void setName(String name) {
-        this.name = name
+    public void setBackend(String backend) {
+        this.backend = backend;
     }
 
-    @Override
-    void afterPropertiesSet() throws Exception {
-        if (StringUtils.isBlank(getName())) {
-            throw new RuntimeException("Server name must be configured. Use the same realm as your Homeserver")
+    @PostConstruct
+    private void postConstruct() {
+        if (StringUtils.isBlank(getBackend())) {
+            throw new ConfigurationException("storage.backend");
         }
     }
 

src/main/java/io/kamax/mxisd/config/ThymeleafConfig.java

@@ -0,0 +1,42 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.thymeleaf.resourceresolver.FileResourceResolver;
+import org.thymeleaf.templateresolver.TemplateResolver;
+
+@Configuration
+public class ThymeleafConfig {
+
+    @Bean
+    public TemplateResolver getFileSystemResolver() {
+        TemplateResolver resolver = new TemplateResolver();
+        resolver.setPrefix("");
+        resolver.setSuffix("");
+        resolver.setCacheable(false);
+        resolver.setOrder(1);
+        resolver.setResourceResolver(new FileResourceResolver());
+        return resolver;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ViewConfig.java

@@ -0,0 +1,144 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+import com.google.gson.Gson;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("view")
+public class ViewConfig {
+
+    private Logger log = LoggerFactory.getLogger(ViewConfig.class);
+
+    public static class Session {
+
+        public static class Paths {
+
+            private String failure;
+            private String success;
+
+            public String getFailure() {
+                return failure;
+            }
+
+            public void setFailure(String failure) {
+                this.failure = failure;
+            }
+
+            public String getSuccess() {
+                return success;
+            }
+
+            public void setSuccess(String success) {
+                this.success = success;
+            }
+
+        }
+
+        public static class Local {
+
+            private Paths onTokenSubmit = new Paths();
+
+            public Paths getOnTokenSubmit() {
+                return onTokenSubmit;
+            }
+
+            public void setOnTokenSubmit(Paths onTokenSubmit) {
+                this.onTokenSubmit = onTokenSubmit;
+            }
+
+        }
+
+        public static class Remote {
+
+            private Paths onRequest = new Paths();
+            private Paths onCheck = new Paths();
+
+            public Paths getOnRequest() {
+                return onRequest;
+            }
+
+            public void setOnRequest(Paths onRequest) {
+                this.onRequest = onRequest;
+            }
+
+            public Paths getOnCheck() {
+                return onCheck;
+            }
+
+            public void setOnCheck(Paths onCheck) {
+                this.onCheck = onCheck;
+            }
+
+        }
+
+        private Local local = new Local();
+        private Local localRemote = new Local();
+        private Remote remote = new Remote();
+
+        public Local getLocal() {
+            return local;
+        }
+
+        public void setLocal(Local local) {
+            this.local = local;
+        }
+
+        public Local getLocalRemote() {
+            return localRemote;
+        }
+
+        public void setLocalRemote(Local localRemote) {
+            this.localRemote = localRemote;
+        }
+
+        public Remote getRemote() {
+            return remote;
+        }
+
+        public void setRemote(Remote remote) {
+            this.remote = remote;
+        }
+    }
+
+    private Session session = new Session();
+
+    public Session getSession() {
+        return session;
+    }
+
+    public void setSession(Session session) {
+        this.session = session;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- View config ---");
+        log.info("Session: {}", new Gson().toJson(session));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ldap/LdapAttributeConfig.java

@@ -0,0 +1,62 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.attribute")
+public class LdapAttributeConfig {
+
+    private LdapAttributeUidConfig uid;
+    private String name;
+    private Map<String, List<String>> threepid = new HashMap<>();
+
+    public LdapAttributeUidConfig getUid() {
+        return uid;
+    }
+
+    public void setUid(LdapAttributeUidConfig uid) {
+        this.uid = uid;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public Map<String, List<String>> getThreepid() {
+        return threepid;
+    }
+
+    public void setThreepid(Map<String, List<String>> threepid) {
+        this.threepid = threepid;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ldap/LdapAttributeUidConfig.java

@@ -0,0 +1,49 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.attribute.uid")
+public class LdapAttributeUidConfig {
+
+    private String type;
+    private String value;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ldap/LdapAuthConfig.java

@@ -18,23 +18,23 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-package io.kamax.mxisd.config
+package io.kamax.mxisd.config.ldap;
 
-import org.springframework.boot.context.properties.ConfigurationProperties
-import org.springframework.context.annotation.Configuration
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
 
 @Configuration
-@ConfigurationProperties(prefix = "forward")
-class ForwardConfig {
+@ConfigurationProperties(prefix = "ldap.auth")
+public class LdapAuthConfig {
 
-    private List<String> servers
+    private String filter;
 
-    List<String> getServers() {
-        return servers
+    public String getFilter() {
+        return filter;
     }
 
-    void setServers(List<String> servers) {
-        this.servers = servers
+    public void setFilter(String filter) {
+        this.filter = filter;
     }
 
 }

src/main/java/io/kamax/mxisd/config/ldap/LdapConfig.java

@@ -0,0 +1,209 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import com.google.gson.Gson;
+import io.kamax.matrix.ThreePidMedium;
+import io.kamax.mxisd.backend.ldap.LdapGenericBackend;
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.util.ArrayList;
+import java.util.List;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap")
+public class LdapConfig {
+
+    private Logger log = LoggerFactory.getLogger(LdapConfig.class);
+    private static Gson gson = new Gson();
+
+    private boolean enabled;
+    private String filter;
+
+    public static class Directory {
+
+        public static class Attribute {
+
+            private List<String> other = new ArrayList<>();
+
+            public List<String> getOther() {
+                return other;
+            }
+
+            public void setOther(List<String> other) {
+                this.other = other;
+            }
+
+        }
+
+        private Attribute attribute = new Attribute();
+        private String filter;
+
+        public Attribute getAttribute() {
+            return attribute;
+        }
+
+        public void setAttribute(Attribute attribute) {
+            this.attribute = attribute;
+        }
+
+        public String getFilter() {
+            return filter;
+        }
+
+        public void setFilter(String filter) {
+            this.filter = filter;
+        }
+
+    }
+
+    @Autowired
+    private LdapConnectionConfig conn;
+    private LdapAttributeConfig attribute;
+    private LdapAuthConfig auth;
+    private Directory directory;
+    private LdapIdentityConfig identity;
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getFilter() {
+        return filter;
+    }
+
+    public void setFilter(String filter) {
+        this.filter = filter;
+    }
+
+    public LdapConnectionConfig getConn() {
+        return conn;
+    }
+
+    public void setConn(LdapConnectionConfig conn) {
+        this.conn = conn;
+    }
+
+    public LdapAttributeConfig getAttribute() {
+        return attribute;
+    }
+
+    public void setAttribute(LdapAttributeConfig attribute) {
+        this.attribute = attribute;
+    }
+
+    public LdapAuthConfig getAuth() {
+        return auth;
+    }
+
+    public void setAuth(LdapAuthConfig auth) {
+        this.auth = auth;
+    }
+
+    public Directory getDirectory() {
+        return directory;
+    }
+
+    public void setDirectory(Directory directory) {
+        this.directory = directory;
+    }
+
+    public LdapIdentityConfig getIdentity() {
+        return identity;
+    }
+
+    public void setIdentity(LdapIdentityConfig identity) {
+        this.identity = identity;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- LDAP Config ---");
+        log.info("Enabled: {}", isEnabled());
+
+        if (!isEnabled()) {
+            return;
+        }
+
+        if (StringUtils.isBlank(conn.getHost())) {
+            throw new IllegalStateException("LDAP Host must be configured!");
+        }
+
+        if (conn.getPort() < 1 || conn.getPort() > 65535) {
+            throw new IllegalStateException("LDAP port is not valid");
+        }
+
+        if (StringUtils.isBlank(attribute.getUid().getType())) {
+            throw new IllegalStateException("Attribute UID Type cannot be empty");
+        }
+
+
+        if (StringUtils.isBlank(attribute.getUid().getValue())) {
+            throw new IllegalStateException("Attribute UID value cannot be empty");
+        }
+
+        String uidType = attribute.getUid().getType();
+        if (!StringUtils.equals(LdapGenericBackend.UID, uidType) && !StringUtils.equals(LdapGenericBackend.MATRIX_ID, uidType)) {
+            throw new IllegalArgumentException("Unsupported LDAP UID type: " + uidType);
+        }
+
+        if (StringUtils.isBlank(identity.getToken())) {
+            throw new ConfigurationException("ldap.identity.token");
+        }
+
+        // Build queries
+        attribute.getThreepid().forEach((k, v) -> {
+            if (StringUtils.isBlank(identity.getMedium().get(k))) {
+                if (ThreePidMedium.PhoneNumber.is(k)) {
+                    identity.getMedium().put(k, LdapGenericBackend.buildOrQuery("+" + getIdentity().getToken(), v));
+                } else {
+                    identity.getMedium().put(k, LdapGenericBackend.buildOrQuery(getIdentity().getToken(), v));
+                }
+            }
+        });
+
+        getAuth().setFilter(StringUtils.defaultIfBlank(getAuth().getFilter(), getFilter()));
+        getDirectory().setFilter(StringUtils.defaultIfBlank(getDirectory().getFilter(), getFilter()));
+        getIdentity().setFilter(StringUtils.defaultIfBlank(getIdentity().getFilter(), getFilter()));
+
+        log.info("Host: {}", conn.getHost());
+        log.info("Port: {}", conn.getPort());
+        log.info("Bind DN: {}", conn.getBindDn());
+        log.info("Base DN: {}", conn.getBaseDn());
+
+        log.info("Attribute: {}", gson.toJson(attribute));
+        log.info("Auth: {}", gson.toJson(auth));
+        log.info("Directory: {}", gson.toJson(directory));
+        log.info("Identity: {}", gson.toJson(identity));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ldap/LdapConnectionConfig.java

@@ -0,0 +1,85 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.connection")
+public class LdapConnectionConfig {
+
+    private boolean tls;
+    private String host;
+    private int port;
+    private String bindDn;
+    private String bindPassword;
+    private String baseDn;
+
+    public boolean isTls() {
+        return tls;
+    }
+
+    public void setTls(boolean tls) {
+        this.tls = tls;
+    }
+
+    public String getHost() {
+        return host;
+    }
+
+    public void setHost(String host) {
+        this.host = host;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    public void setPort(int port) {
+        this.port = port;
+    }
+
+    public String getBindDn() {
+        return bindDn;
+    }
+
+    public void setBindDn(String bindDn) {
+        this.bindDn = bindDn;
+    }
+
+    public String getBindPassword() {
+        return bindPassword;
+    }
+
+    public void setBindPassword(String bindPassword) {
+        this.bindPassword = bindPassword;
+    }
+
+    public String getBaseDn() {
+        return baseDn;
+    }
+
+    public void setBaseDn(String baseDn) {
+        this.baseDn = baseDn;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/ldap/LdapIdentityConfig.java

@@ -0,0 +1,66 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.ldap;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+@Configuration
+@ConfigurationProperties(prefix = "ldap.identity")
+public class LdapIdentityConfig {
+
+    private String filter;
+    private String token;
+    private Map<String, String> medium = new HashMap<>();
+
+    public String getFilter() {
+        return filter;
+    }
+
+    public void setFilter(String filter) {
+        this.filter = filter;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public void setToken(String token) {
+        this.token = token;
+    }
+
+    public Map<String, String> getMedium() {
+        return medium;
+    }
+
+    public Optional<String> getQuery(String key) {
+        return Optional.ofNullable(medium.get(key));
+    }
+
+    public void setMedium(Map<String, String> medium) {
+        this.medium = medium;
+    }
+
+}

src/main/java/io/kamax/mxisd/config/rest/RestBackendConfig.java

@@ -0,0 +1,160 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.rest;
+
+import io.kamax.mxisd.exception.ConfigurationException;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+import java.net.MalformedURLException;
+import java.net.URL;
+
+@Configuration
+@ConfigurationProperties("rest")
+public class RestBackendConfig {
+
+    public static class IdentityEndpoints {
+
+        private String single;
+        private String bulk;
+
+        public String getSingle() {
+            return single;
+        }
+
+        public void setSingle(String single) {
+            this.single = single;
+        }
+
+        public String getBulk() {
+            return bulk;
+        }
+
+        public void setBulk(String bulk) {
+            this.bulk = bulk;
+        }
+
+    }
+
+    public static class Endpoints {
+
+        private String auth;
+        private String directory;
+        private IdentityEndpoints identity = new IdentityEndpoints();
+
+        public String getAuth() {
+            return auth;
+        }
+
+        public void setAuth(String auth) {
+            this.auth = auth;
+        }
+
+        public String getDirectory() {
+            return directory;
+        }
+
+        public void setDirectory(String directory) {
+            this.directory = directory;
+        }
+
+        public IdentityEndpoints getIdentity() {
+            return identity;
+        }
+
+        public void setIdentity(IdentityEndpoints identity) {
+            this.identity = identity;
+        }
+
+    }
+
+    private Logger log = LoggerFactory.getLogger(RestBackendConfig.class);
+
+    private boolean enabled;
+    private String host;
+    private Endpoints endpoints = new Endpoints();
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getHost() {
+        return host;
+    }
+
+    public void setHost(String host) {
+        this.host = host;
+    }
+
+    public Endpoints getEndpoints() {
+        return endpoints;
+    }
+
+    public void setEndpoints(Endpoints endpoints) {
+        this.endpoints = endpoints;
+    }
+
+    private String buildEndpointUrl(String endpoint) {
+        if (StringUtils.startsWith(endpoint, "/")) {
+            if (StringUtils.isBlank(getHost())) {
+                throw new ConfigurationException("rest.host");
+            }
+
+            try {
+                new URL(getHost());
+            } catch (MalformedURLException e) {
+                throw new ConfigurationException("rest.host", e.getMessage());
+            }
+
+            return getHost() + endpoint;
+        } else {
+            return endpoint;
+        }
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- REST backend config ---");
+        log.info("Enabled: {}", isEnabled());
+
+        if (isEnabled()) {
+            endpoints.setAuth(buildEndpointUrl(endpoints.getAuth()));
+            endpoints.setDirectory(buildEndpointUrl(endpoints.getDirectory()));
+            endpoints.identity.setSingle(buildEndpointUrl(endpoints.identity.getSingle()));
+            endpoints.identity.setBulk(buildEndpointUrl(endpoints.identity.getBulk()));
+
+            log.info("Host: {}", getHost());
+            log.info("Auth endpoint: {}", endpoints.getAuth());
+            log.info("Directory endpoint: {}", endpoints.getDirectory());
+            log.info("Identity Single endpoint: {}", endpoints.identity.getSingle());
+            log.info("Identity Bulk endpoint: {}", endpoints.identity.getBulk());
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/config/sql/SqlConfig.java

@@ -0,0 +1,221 @@
+package io.kamax.mxisd.config.sql;
+
+import io.kamax.mxisd.util.GsonUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public abstract class SqlConfig {
+
+    private Logger log = LoggerFactory.getLogger(SqlConfig.class);
+
+    public static class Query {
+
+        private String type;
+        private String value;
+
+        public String getType() {
+            return type;
+        }
+
+        public void setType(String type) {
+            this.type = type;
+        }
+
+        public String getValue() {
+            return value;
+        }
+
+        public void setValue(String value) {
+            this.value = value;
+        }
+
+    }
+
+    public static class Type {
+
+        private SqlProviderConfig.Query name = new SqlProviderConfig.Query();
+        private SqlProviderConfig.Query threepid = new SqlProviderConfig.Query();
+
+        public SqlProviderConfig.Query getName() {
+            return name;
+        }
+
+        public void setName(SqlProviderConfig.Query name) {
+            this.name = name;
+        }
+
+        public SqlProviderConfig.Query getThreepid() {
+            return threepid;
+        }
+
+        public void setThreepid(SqlProviderConfig.Query threepid) {
+            this.threepid = threepid;
+        }
+
+    }
+
+    public static class Auth {
+
+        private Boolean enabled;
+
+        public Boolean isEnabled() {
+            return enabled;
+        }
+
+        public void setEnabled(Boolean enabled) {
+            this.enabled = enabled;
+        }
+
+    }
+
+    public static class Directory {
+
+        private Boolean enabled;
+        private SqlProviderConfig.Type query = new SqlProviderConfig.Type();
+
+        public Boolean isEnabled() {
+            return enabled;
+        }
+
+        public void setEnabled(Boolean enabled) {
+            this.enabled = enabled;
+        }
+
+        public SqlProviderConfig.Type getQuery() {
+            return query;
+        }
+
+        public void setQuery(SqlProviderConfig.Type query) {
+            this.query = query;
+        }
+
+    }
+
+    public static class Identity {
+
+        private Boolean enabled;
+        private String type;
+        private String query;
+        private Map<String, String> medium = new HashMap<>();
+
+        public Boolean isEnabled() {
+            return enabled;
+        }
+
+        public void setEnabled(Boolean enabled) {
+            this.enabled = enabled;
+        }
+
+        public String getType() {
+            return type;
+        }
+
+        public void setType(String type) {
+            this.type = type;
+        }
+
+        public String getQuery() {
+            return query;
+        }
+
+        public void setQuery(String query) {
+            this.query = query;
+        }
+
+        public Map<String, String> getMedium() {
+            return medium;
+        }
+
+        public void setMedium(Map<String, String> medium) {
+            this.medium = medium;
+        }
+
+    }
+
+    private boolean enabled;
+    private String type;
+    private String connection;
+    private SqlProviderConfig.Auth auth = new SqlProviderConfig.Auth();
+    private SqlProviderConfig.Directory directory = new SqlProviderConfig.Directory();
+    private SqlProviderConfig.Identity identity = new SqlProviderConfig.Identity();
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getConnection() {
+        return connection;
+    }
+
+    public void setConnection(String connection) {
+        this.connection = connection;
+    }
+
+    public SqlProviderConfig.Auth getAuth() {
+        return auth;
+    }
+
+    public void setAuth(SqlProviderConfig.Auth auth) {
+        this.auth = auth;
+    }
+
+    public SqlProviderConfig.Directory getDirectory() {
+        return directory;
+    }
+
+    public void setDirectory(SqlProviderConfig.Directory directory) {
+        this.directory = directory;
+    }
+
+    public SqlProviderConfig.Identity getIdentity() {
+        return identity;
+    }
+
+    public void setIdentity(SqlProviderConfig.Identity identity) {
+        this.identity = identity;
+    }
+
+    protected abstract String getProviderName();
+
+    public void build() {
+        log.info("--- " + getProviderName() + " Provider config ---");
+
+        if (getAuth().isEnabled() == null) {
+            getAuth().setEnabled(isEnabled());
+        }
+
+        if (getDirectory().isEnabled() == null) {
+            getDirectory().setEnabled(isEnabled());
+        }
+
+        if (getIdentity().isEnabled() == null) {
+            getIdentity().setEnabled(isEnabled());
+        }
+
+        log.info("Enabled: {}", isEnabled());
+        if (isEnabled()) {
+            log.info("Type: {}", getType());
+            log.info("Connection: {}", getConnection());
+            log.info("Auth enabled: {}", getAuth().isEnabled());
+            log.info("Directory queries: {}", GsonUtil.build().toJson(getDirectory().getQuery()));
+            log.info("Identity type: {}", getIdentity().getType());
+            log.info("Identity medium queries: {}", GsonUtil.build().toJson(getIdentity().getMedium()));
+        }
+    }
+
+}

src/main/java/io/kamax/mxisd/config/sql/SqlProviderConfig.java

@@ -0,0 +1,44 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.sql;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("sql")
+@Primary
+public class SqlProviderConfig extends SqlConfig {
+
+    @Override
+    protected String getProviderName() {
+        return "Generic SQL";
+    }
+
+    @PostConstruct
+    public void build() {
+        super.build();
+    }
+
+}

src/main/java/io/kamax/mxisd/config/sql/synapse/SynapseSqlProviderConfig.java

@@ -0,0 +1,43 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.sql.synapse;
+
+import io.kamax.mxisd.config.sql.SqlConfig;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("synapseSql")
+public class SynapseSqlProviderConfig extends SqlConfig {
+
+    @Override
+    protected String getProviderName() {
+        return "Synapse SQL";
+    }
+
+    @PostConstruct
+    public void build() {
+        super.build();
+    }
+
+}

src/main/java/io/kamax/mxisd/config/threepid/connector/EmailSendGridConfig.java

@@ -0,0 +1,202 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.threepid.connector;
+
+import io.kamax.mxisd.util.GsonUtil;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties("notification.handlers.sendgrid")
+public class EmailSendGridConfig {
+
+    public static class EmailTemplate {
+
+        public static class EmailBody {
+
+            private String text;
+            private String html;
+
+            public String getText() {
+                return text;
+            }
+
+            public void setText(String text) {
+                this.text = text;
+            }
+
+            public String getHtml() {
+                return html;
+            }
+
+            public void setHtml(String html) {
+                this.html = html;
+            }
+
+        }
+
+        private String subject;
+        private EmailBody body = new EmailBody();
+
+        public String getSubject() {
+            return subject;
+        }
+
+        public void setSubject(String subject) {
+            this.subject = subject;
+        }
+
+        public EmailBody getBody() {
+            return body;
+        }
+
+        public void setBody(EmailBody body) {
+            this.body = body;
+        }
+
+    }
+
+    public static class Api {
+
+        private String key;
+
+        public String getKey() {
+            return key;
+        }
+
+        public void setKey(String key) {
+            this.key = key;
+        }
+
+    }
+
+    public static class Identity {
+
+        private String from;
+        private String name;
+
+        public String getFrom() {
+            return from;
+        }
+
+        public void setFrom(String from) {
+            this.from = from;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        public void setName(String name) {
+            this.name = name;
+        }
+
+    }
+
+    public static class Templates {
+
+        public static class TemplateSession {
+
+            private EmailTemplate local = new EmailTemplate();
+            private EmailTemplate remote = new EmailTemplate();
+
+            public EmailTemplate getLocal() {
+                return local;
+            }
+
+            public void setLocal(EmailTemplate local) {
+                this.local = local;
+            }
+
+            public EmailTemplate getRemote() {
+                return remote;
+            }
+
+            public void setRemote(EmailTemplate remote) {
+                this.remote = remote;
+            }
+        }
+
+        private EmailTemplate invite = new EmailTemplate();
+        private TemplateSession session = new TemplateSession();
+
+        public EmailTemplate getInvite() {
+            return invite;
+        }
+
+        public void setInvite(EmailTemplate invite) {
+            this.invite = invite;
+        }
+
+        public TemplateSession getSession() {
+            return session;
+        }
+
+        public void setSession(TemplateSession session) {
+            this.session = session;
+        }
+
+    }
+
+    private Logger log = LoggerFactory.getLogger(EmailSendGridConfig.class);
+
+    private Api api = new Api();
+    private Identity identity = new Identity();
+    private Templates templates = new Templates();
+
+    public Api getApi() {
+        return api;
+    }
+
+    public void setApi(Api api) {
+        this.api = api;
+    }
+
+    public Identity getIdentity() {
+        return identity;
+    }
+
+    public void setIdentity(Identity identity) {
+        this.identity = identity;
+    }
+
+    public Templates getTemplates() {
+        return templates;
+    }
+
+    public void setTemplates(Templates templates) {
+        this.templates = templates;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Email SendGrid connector config ---");
+        log.info("API key configured?: {}", StringUtils.isNotBlank(api.getKey()));
+        log.info("Identity: {}", GsonUtil.build().toJson(identity));
+        log.info("Templates: {}", GsonUtil.build().toJson(templates));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/threepid/connector/EmailSmtpConfig.java

@@ -0,0 +1,93 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.threepid.connector;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties(prefix = "threepid.medium.email.connectors.smtp")
+public class EmailSmtpConfig {
+
+    private Logger log = LoggerFactory.getLogger(EmailSmtpConfig.class);
+
+    private String host;
+    private int port;
+    private int tls;
+    private String login;
+    private String password;
+
+    public String getHost() {
+        return host;
+    }
+
+    public void setHost(String host) {
+        this.host = host;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    public void setPort(int port) {
+        this.port = port;
+    }
+
+    public int getTls() {
+        return tls;
+    }
+
+    public void setTls(int tls) {
+        this.tls = tls;
+    }
+
+    public String getLogin() {
+        return login;
+    }
+
+    public void setLogin(String login) {
+        this.login = login;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- E-mail SMTP Connector config ---");
+        log.info("Host: {}", getHost());
+        log.info("Port: {}", getPort());
+        log.info("TLS Mode: {}", getTls());
+        log.info("Login: {}", getLogin());
+        log.info("Has password: {}", StringUtils.isNotBlank(getPassword()));
+    }
+
+}

src/main/java/io/kamax/mxisd/config/threepid/connector/PhoneTwilioConfig.java

@@ -0,0 +1,73 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Maxime Dor
+ *
+ * https://max.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config.threepid.connector;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import javax.annotation.PostConstruct;
+
+@Configuration
+@ConfigurationProperties(prefix = PhoneTwilioConfig.NAMESPACE)
+public class PhoneTwilioConfig {
+
+    static final String NAMESPACE = "threepid.medium.msisdn.connectors.twilio";
+
+    private Logger log = LoggerFactory.getLogger(PhoneTwilioConfig.class);
+
+    private String accountSid;
+    private String authToken;
+    private String number;
+
+    public String getAccountSid() {
+        return accountSid;
+    }
+
+    public void setAccountSid(String accountSid) {
+        this.accountSid = accountSid;
+    }
+
+    public String getAuthToken() {
+        return authToken;
+    }
+
+    public void setAuthToken(String authToken) {
+        this.authToken = authToken;
+    }
+
+    public String getNumber() {
+        return number;
+    }
+
+    public void setNumber(String number) {
+        this.number = number;
+    }
+
+    @PostConstruct
+    public void build() {
+        log.info("--- Phone SMS Twilio connector config ---");
+        log.info("Account SID: {}", getAccountSid());
+        log.info("Sender number: {}", getNumber());
+    }
+
+}