Add migration documentation.

Update docs. Add a new options and configuration.
Workaround for postgresql.
2020-01-30 23:17:01 +03:00 · 2020-01-28 23:20:29 +03:00 · 2020-01-28 23:18:39 +03:00 · 2020-01-28 22:15:26 +03:00 · 2020-01-28 01:02:43 +03:00 · 2020-01-28 00:55:39 +03:00
57 changed files with 1266 additions and 357 deletions
--- a/build.gradle
+++ b/build.gradle
@@ -108,7 +108,7 @@ dependencies {
    compile 'net.i2p.crypto:eddsa:0.3.0'

    // LDAP connector
-    compile 'org.apache.directory.api:api-all:1.0.0'
+    compile 'org.apache.directory.api:api-all:1.0.3'

    // DNS lookups
    compile 'dnsjava:dnsjava:2.1.9'
--- a/docs/MSC2140_MSC2134.md
+++ b/docs/MSC2140_MSC2134.md
@@ -0,0 +1,146 @@
+# MSC2140
+
+## V1 vs V2
+In the [MSC2140](https://github.com/matrix-org/matrix-doc/pull/2140) the v2 prefix was introduced.
+
+Default values:
+```.yaml
+matrix:
+  v1: true   # deprecated
+  v2: false
+```
+
+To disable change value to `false`.
+
+NOTE: the v1 is deprecated, therefore recommend to use only v2 and disable v1 (default value can be ommited):
+```.yaml
+matrix:
+  v1: false
+```
+NOTE: Riot Web version 1.5.5 and below checks the v1 for backward compatibility.
+
+NOTE: v2 disabled by default in order to preserve backward compatibility.
+
+## Terms
+
+###### Requires: No. 
+
+Administrator can omit terms configuration. In this case the terms checking will be disabled.
+
+Example:
+```.yaml
+policy:
+  policies:
+    term_name: # term name
+      version: 1.0 # version
+      terms:
+        en:  # lang
+          name: term name en  # localized name
+          url: https://ma1sd.host.tld/term_en.html  # localized url
+        fe:  # lang 
+          name: term name fr  # localized name
+          url: https://ma1sd.host.tld/term_fr.html  # localized url
+      regexp:
+        - '/_matrix/identity/v2/account.*'
+        - '/_matrix/identity/v2/hash_details'
+        - '/_matrix/identity/v2/lookup'
+```
+Where:
+
+- `term_name` -- name of the terms.
+- `version` -- the terms version.
+- `lang` -- the term language.
+- `name` -- the name of the term.
+- `url` -- the url of the term. Might be any url (i.e. from another host) for a html page.
+- `regexp` -- regexp patterns for API which should be available only after accepting the terms.
+
+API will be checks for accepted terms only with authorization.
+There are the next API:
+- [`GET /_matrix/identity/v2/account`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-account) - Gets information about what user owns the access token used in the request.
+- [`POST /_matrix/identity/v2/account/logout`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-account-logout) - Logs out the access token, preventing it from being used to authenticate future requests to the server.
+- [`GET /_matrix/identity/v2/hash_details`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-hash-details) - Gets parameters for hashing identifiers from the server. This can include any of the algorithms defined in this specification.
+- [`POST /_matrix/identity/v2/lookup`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-lookup) - Looks up the set of Matrix User IDs which have bound the 3PIDs given, if bindings are available. Note that the format of the addresses is defined later in this specification.
+- [`POST /_matrix/identity/v2/validate/email/requestToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-validate-email-requesttoken) - Create a session for validating an email address.
+- [`POST /_matrix/identity/v2/validate/email/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-validate-email-submittoken) - Validate ownership of an email address.
+- [`GET /_matrix/identity/v2/validate/email/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-validate-email-submittoken) - Validate ownership of an email address.
+- [`POST /_matrix/identity/v2/validate/msisdn/requestToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-validate-msisdn-requesttoken) - Create a session for validating a phone number.
+- [`POST /_matrix/identity/v2/validate/msisdn/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-validate-msisdn-submittoken) - Validate ownership of a phone number.
+- [`GET /_matrix/identity/v2/validate/msisdn/submitToken`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-validate-msisdn-submittoken) - Validate ownership of a phone number.
+- [`GET /_matrix/identity/v2/3pid/getValidated3pid`](https://matrix.org/docs/spec/identity_service/r0.3.0#get-matrix-identity-v2-3pid-getvalidated3pid) - Determines if a given 3pid has been validated by a user.
+- [`POST /_matrix/identity/v2/3pid/bind`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-3pid-bind) - Publish an association between a session and a Matrix user ID.
+- [`POST /_matrix/identity/v2/3pid/unbind`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-3pid-unbind) - Remove an association between a session and a Matrix user ID.
+- [`POST /_matrix/identity/v2/store-invite`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-store-invite) - Store pending invitations to a user's 3pid.
+- [`POST /_matrix/identity/v2/sign-ed25519`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-sign-ed25519) - Sign invitation details.
+
+There is only one exception: [`POST /_matrix/identity/v2/terms`](https://matrix.org/docs/spec/identity_service/r0.3.0#post-matrix-identity-v2-terms) which uses for accepting the terms and requires the authorization.
+
+## [Hash lookup](https://github.com/matrix-org/matrix-doc/blob/hs/hash-identity/proposals/2134-identity-hash-lookup.md)
+
+Hashes and the pepper updates together according to the `rotationPolicy`.
+
+###### Requires: No. 
+
+In case the `none` algorithms ma1sd will be lookup using the v1 bulk API.
+
+```.yaml
+hashing:
+  enabled: true # enable or disable the hash lookup MSC2140 (default is false)
+  pepperLength: 20 # length of the pepper value (default is 20)
+  rotationPolicy: per_requests # or `per_seconds` how often the hashes will be updating
+  hashStorageType: sql # or `in_memory` where the hashes will be stored
+  algorithms:
+    - none   # the same as v1 bulk lookup
+    - sha256 # hash the 3PID and pepper.
+  delay: 2m # how often hashes will be updated if rotation policy = per_seconds (default is 10s)
+  requests: 10 # how many lookup requests will be performed before updating hashes if rotation policy = per_requests (default is 10)
+```
+
+When enabled and client requests the `none` algorithms then hash lookups works as v1 bulk lookup.
+
+Delay specified in the format: `2d 4h 12m 34s` - this means 2 days 4 hours 12 minutes and 34 seconds. Zero units may be omitted. For example:
+
+- 12s - 12 seconds
+- 3m - 3 minutes
+- 5m 6s - 5 minutes and 6 seconds
+- 6h 3s - 6 hours and 3 seconds
+
+
+Sha256 algorithm supports only sql, memory and exec 3PID providers.
+For sql provider (i.e. for the `synapseSql`):
+```.yaml
+synapseSql:
+  lookup:
+    query: 'select user_id as mxid, medium, address from user_threepids' # query for retrive 3PIDs for hashes.
+```
+
+For general sql provider:
+```.yaml
+sql:
+  lookup:
+    query: 'select user as mxid, field1 as medium, field2 as address from some_table' # query for retrive 3PIDs for hashes.
+```
+
+Each query should return the `mxid`, `medium` and `address` fields.
+
+
+For memory providers:
+```.yaml
+memory:
+  hashEnabled: true # enable the hash lookup (defaults is false)
+```
+
+For exec providers:
+```.yaml
+exec:
+  identity:
+    hashEnabled: true # enable the hash lookup (defaults is false)
+```
+
+For ldap providers:
+```.yaml
+ldap:
+  lookup: true
+```
+
+NOTE: Federation requests work only with `none` algorithms.
+
--- a/docs/configure.md
+++ b/docs/configure.md
@@ -48,6 +48,9 @@ Create a list under the label `myOtherServers` containing two Identity servers:
 ## Unbind (MSC1915)
 - `session.policy.unbind.enabled`: Enable or disable unbind functionality (MSC1915). (Defaults to true).

+## Hash lookups, Term and others (MSC2140, MSC2134)
+See the [dedicated document](MSC2140_MSC2134.md) for configuration.
+
 *Warning*: Unbind check incoming request by two ways:
 - session validation.
 - request signature via `X-Matrix` header and uses `server.publicUrl` property to construct the signing json;
@@ -55,7 +58,47 @@ Commonly the `server.publicUrl` should be the same value as the `trusted_third_p

 ## Storage
 ### SQLite
-`storage.provider.sqlite.database`: Absolute location of the SQLite database
+```yaml
+storage:
+  backend: sqlite # default
+  provider:
+    sqlite:
+      database: /var/lib/ma1sd/store.db #  Absolute location of the SQLite database
+```
+
+### Postgresql
+```yaml
+storage:
+  backend: postgresql
+  provider:
+    postgresql:
+      database: //localhost:5432/ma1sd
+      username: ma1sd
+      password: secret_password
+```
+See [the migration instruction](migration-to-postgresql.md) from sqlite to postgresql
+
+
+## Logging
+```yaml
+logging:
+  root: error  # default level for all loggers (apps and thirdparty libraries)
+  app: info    # log level only for the ma1sd
+```
+
+Possible value: `trace`, `debug`, `info`, `warn`, `error`, `off`.
+
+Default value for root level: `info`.
+
+Value for app level can be specified via `MA1SD_LOG_LEVEL` environment variable, configuration or start options.
+
+Default value for app level: `info`.
+
+| start option | equivalent configuration |
+| --- | --- |
+|  | app: info |
+| -v | app: debug |
+| -vv | app: trace |

 ## Identity stores
 See the [Identity stores](stores/README.md) for specific configuration
--- a/docs/migration-to-postgresql.md
+++ b/docs/migration-to-postgresql.md
@@ -0,0 +1,41 @@
+# Migration from sqlite to postgresql
+
+Starting from the version 2.3.0 ma1sd support postgresql for internal storage in addition to sqlite (parameters `storage.backend`).
+
+#### Migration steps
+
+1. create the postgresql database and user for ma1sd storage
+2. create a backup for sqlite storage (default location: /var/lib/ma1sd/store.db)
+3. migrate data from sqlite to postgresql
+4. change ma1sd configuration to use the postgresql
+
+For data migration is it possible to use https://pgloader.io tool.
+
+Example of the migration command:
+```shell script
+pgloader --with "quote identifiers" /path/to/store.db pgsql://ma1sd_user:ma1sd_password@host:port/database
+```
+or (short version for database on localhost)
+```shell script
+pgloader --with "quote identifiers" /path/to/store.db pgsql://ma1sd_user:ma1sd_password@localhost/ma1sd
+```
+
+An option `--with "quote identifies"` used to create case sensitive tables.
+ma1sd_user - postgresql user for ma1sd.
+ma1sd_password - password of the postgresql user.
+host - postgresql host
+post - database port (default 5432)
+database - database name.
+
+
+Configuration example for postgresql storage:
+```yaml
+storage:
+  backend: postgresql
+  provider:
+    postgresql:
+      database: '//localhost/ma1sd' # or full variant //192.168.1.100:5432/ma1sd_database
+      username: 'ma1sd_user'
+      password: 'ma1sd_password'
+```
+
--- a/docs/stores/ldap.md
+++ b/docs/stores/ldap.md
@@ -89,7 +89,7 @@ ldap:
 #### 3PIDs
 You can also change the attribute lists for 3PID, like email or phone numbers.

-The following example would overwrite the [default list of attributes](../../src/main/java/io/kamax/ma1sd/config/ldap/LdapConfig.java#L64)
+The following example would overwrite the [default list of attributes](../../src/main/java/io/kamax/mxisd/config/ldap/LdapConfig.java#L64)
 for emails and phone number:
 ```yaml
 ldap:
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,6 @@
+#Thu Dec 05 22:39:36 MSK 2019
+distributionUrl=https\://services.gradle.org/distributions/gradle-6.0-all.zip
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.0-bin.zip
-zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME
--- a/ma1sd.example.yaml
+++ b/ma1sd.example.yaml
@@ -21,6 +21,8 @@
 #
 matrix:
  domain: ''
+  v1: true   # deprecated
+  v2: false  # MSC2140 API v2. Disabled by default in order to preserve backward compatibility.


 ################
@@ -109,3 +111,63 @@ threepid:

          # Password for the account
          password: "ThePassword"
+
+
+#### MSC2134 (hash lookup)
+
+#hashing:
+#  enabled: false # enable or disable the hash lookup MSC2140 (default is false)
+#  pepperLength: 20 # length of the pepper value (default is 20)
+#  rotationPolicy: per_requests # or `per_seconds` how often the hashes will be updating
+#  hashStorageType: sql # or `in_memory` where the hashes will be stored
+#  algorithms:
+#    - none   # the same as v1 bulk lookup
+#    - sha256 # hash the 3PID and pepper.
+#  delay: 2m # how often hashes will be updated if rotation policy = per_seconds (default is 10s)
+#  requests: 10 # how many lookup requests will be performed before updating hashes if rotation policy = per_requests (default is 10)
+
+### hash lookup for synapseSql provider.
+# synapseSql:
+#   lookup:
+#     query: 'select user_id as mxid, medium, address from user_threepids' # query for retrive 3PIDs for hashes.
+#   legacyRoomNames: false  # use the old query to get room names.
+
+### hash lookup for ldap provider (with example of the ldap configuration)
+# ldap:
+#   enabled: true
+#   lookup: true # hash lookup
+#   connection:
+#     host: 'ldap.domain.tld'
+#     port: 389
+#     bindDn: 'cn=admin,dc=domain,dc=tld'
+#     bindPassword: 'Secret'
+#     baseDNs:
+#       - 'dc=domain,dc=tld'
+#   attribute:
+#     uid:
+#       type: 'uid' # or mxid
+#       value: 'cn'
+#     name: 'displayName'
+#   identity:
+#     filter: '(objectClass=inetOrgPerson)'
+
+#### MSC2140 (Terms)
+#policy:
+#  policies:
+#    term_name: # term name
+#      version: 1.0 # version
+#      terms:
+#        en:  # lang
+#          name: term name en  # localized name
+#          url: https://ma1sd.host.tld/term_en.html  # localized url
+#        fe:  # lang
+#          name: term name fr  # localized name
+#          url: https://ma1sd.host.tld/term_fr.html  # localized url
+#      regexp:
+#        - '/_matrix/identity/v2/account.*'
+#        - '/_matrix/identity/v2/hash_details'
+#        - '/_matrix/identity/v2/lookup'
+#
+
+# logging:
+#   root: trace   # logging level
--- a/src/main/java/io/kamax/matrix/codec/MxSha256.java
+++ b/src/main/java/io/kamax/matrix/codec/MxSha256.java
@@ -1,47 +0,0 @@
-/*
- * matrix-java-sdk - Matrix Client SDK for Java
- * Copyright (C) 2017 Kamax Sarl
- *
- * https://www.kamax.io/
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
-package io.kamax.matrix.codec;
-
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-
-public class MxSha256 {
-
-    private MessageDigest md;
-
-    public MxSha256() {
-        try {
-            md = MessageDigest.getInstance("SHA-256");
-        } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    public String hash(byte[] data) {
-        return MxBase64.encode(md.digest(data));
-    }
-
-    public String hash(String data) {
-        return hash(data.getBytes(StandardCharsets.UTF_8));
-    }
-
-}
--- a/src/main/java/io/kamax/mxisd/HttpMxisd.java
+++ b/src/main/java/io/kamax/mxisd/HttpMxisd.java
@@ -52,7 +52,8 @@ import io.kamax.mxisd.http.undertow.handler.identity.share.SessionValidationGetH
 import io.kamax.mxisd.http.undertow.handler.identity.share.SessionValidationPostHandler;
 import io.kamax.mxisd.http.undertow.handler.identity.share.SignEd25519Handler;
 import io.kamax.mxisd.http.undertow.handler.identity.share.StoreInviteHandler;
-import io.kamax.mxisd.http.undertow.handler.identity.v1.*;
+import io.kamax.mxisd.http.undertow.handler.identity.v1.BulkLookupHandler;
+import io.kamax.mxisd.http.undertow.handler.identity.v1.SingleLookupHandler;
 import io.kamax.mxisd.http.undertow.handler.identity.v2.HashDetailsHandler;
 import io.kamax.mxisd.http.undertow.handler.identity.v2.HashLookupHandler;
 import io.kamax.mxisd.http.undertow.handler.invite.v1.RoomInviteHandler;
@@ -103,37 +104,30 @@ public class HttpMxisd {
        HttpHandler asNotFoundHandler = SaneHandler.around(new AsNotFoundHandler(m.getAs()));

        final RoutingHandler handler = Handlers.routing()
-            .add("OPTIONS", "/**", SaneHandler.around(new OptionsHandler()))
+            .add("OPTIONS", "/**", sane(new OptionsHandler()))

            // Status endpoints
-            .get(StatusHandler.Path, SaneHandler.around(new StatusHandler()))
-            .get(VersionHandler.Path, SaneHandler.around(new VersionHandler()))
+            .get(StatusHandler.Path, sane(new StatusHandler()))
+            .get(VersionHandler.Path, sane(new VersionHandler()))

            // Authentication endpoints
-            .get(LoginHandler.Path, SaneHandler.around(new LoginGetHandler(m.getAuth(), m.getHttpClient())))
-            .post(LoginHandler.Path, SaneHandler.around(new LoginPostHandler(m.getAuth())))
-            .post(RestAuthHandler.Path, SaneHandler.around(new RestAuthHandler(m.getAuth())))
-
-            // Account endpoints
-            .post(AccountRegisterHandler.Path, SaneHandler.around(new AccountRegisterHandler(m.getAccMgr())))
-            .get(AccountGetUserInfoHandler.Path,
-                SaneHandler.around(AuthorizationHandler.around(m.getAccMgr(), new AccountGetUserInfoHandler(m.getAccMgr()))))
-            .post(AccountLogoutHandler.Path,
-                SaneHandler.around(AuthorizationHandler.around(m.getAccMgr(), new AccountLogoutHandler(m.getAccMgr()))))
+            .get(LoginHandler.Path, sane(new LoginGetHandler(m.getAuth(), m.getHttpClient())))
+            .post(LoginHandler.Path, sane(new LoginPostHandler(m.getAuth())))
+            .post(RestAuthHandler.Path, sane(new RestAuthHandler(m.getAuth())))

            // Directory endpoints
-            .post(UserDirectorySearchHandler.Path, SaneHandler.around(new UserDirectorySearchHandler(m.getDirectory())))
+            .post(UserDirectorySearchHandler.Path, sane(new UserDirectorySearchHandler(m.getDirectory())))

            // Profile endpoints
-            .get(ProfileHandler.Path, SaneHandler.around(new ProfileHandler(m.getProfile())))
-            .get(InternalProfileHandler.Path, SaneHandler.around(new InternalProfileHandler(m.getProfile())))
+            .get(ProfileHandler.Path, sane(new ProfileHandler(m.getProfile())))
+            .get(InternalProfileHandler.Path, sane(new InternalProfileHandler(m.getProfile())))

            // Registration endpoints
            .post(Register3pidRequestTokenHandler.Path,
-                SaneHandler.around(new Register3pidRequestTokenHandler(m.getReg(), m.getClientDns(), m.getHttpClient())))
+                sane(new Register3pidRequestTokenHandler(m.getReg(), m.getClientDns(), m.getHttpClient())))

            // Invite endpoints
-            .post(RoomInviteHandler.Path, SaneHandler.around(new RoomInviteHandler(m.getHttpClient(), m.getClientDns(), m.getInvite())))
+            .post(RoomInviteHandler.Path, sane(new RoomInviteHandler(m.getHttpClient(), m.getClientDns(), m.getInvite())))

            // Application Service endpoints
            .get(AsUserHandler.Path, asUserHandler)
@@ -145,11 +139,12 @@ public class HttpMxisd {
            .put("/transactions/{" + AsTransactionHandler.ID + "}", asTxnHandler) // Legacy endpoint

            // Banned endpoints
-            .get(InternalInfoHandler.Path, SaneHandler.around(new InternalInfoHandler()));
+            .get(InternalInfoHandler.Path, sane(new InternalInfoHandler()));
        keyEndpoints(handler);
        identityEndpoints(handler);
        termsEndpoints(handler);
        hashEndpoints(handler);
+        accountEndpoints(handler);
        httpSrv = Undertow.builder().addHttpListener(m.getConfig().getServer().getPort(), "0.0.0.0").setHandler(handler).build();

        httpSrv.start();
@@ -193,17 +188,33 @@ public class HttpMxisd {
        );
    }

+    private void accountEndpoints(RoutingHandler routingHandler) {
+        MatrixConfig matrixConfig = m.getConfig().getMatrix();
+        if (matrixConfig.isV2()) {
+            routingHandler.post(AccountRegisterHandler.Path, sane(new AccountRegisterHandler(m.getAccMgr())));
+            wrapWithTokenAndAuthorizationHandlers(routingHandler, Methods.GET, new AccountGetUserInfoHandler(m.getAccMgr()),
+                AccountGetUserInfoHandler.Path, true);
+            wrapWithTokenAndAuthorizationHandlers(routingHandler, Methods.GET, new AccountLogoutHandler(m.getAccMgr()),
+                AccountLogoutHandler.Path, true);
+        }
+    }
+
    private void termsEndpoints(RoutingHandler routingHandler) {
-        routingHandler.get(GetTermsHandler.PATH, new GetTermsHandler(m.getConfig().getPolicy()));
-        routingHandler
-            .post(AcceptTermsHandler.PATH, AuthorizationHandler.around(m.getAccMgr(), sane(new AcceptTermsHandler(m.getAccMgr()))));
+        MatrixConfig matrixConfig = m.getConfig().getMatrix();
+        if (matrixConfig.isV2()) {
+            routingHandler.get(GetTermsHandler.PATH, sane(new GetTermsHandler(m.getConfig().getPolicy())));
+            routingHandler.post(AcceptTermsHandler.PATH, sane(new AcceptTermsHandler(m.getAccMgr())));
+        }
    }

    private void hashEndpoints(RoutingHandler routingHandler) {
-        routingHandler
-            .get(HashDetailsHandler.PATH, AuthorizationHandler.around(m.getAccMgr(), sane(new HashDetailsHandler(m.getHashManager()))));
-        routingHandler.post(HashLookupHandler.Path,
-            AuthorizationHandler.around(m.getAccMgr(), sane(new HashLookupHandler(m.getIdentity(), m.getHashManager()))));
+        MatrixConfig matrixConfig = m.getConfig().getMatrix();
+        if (matrixConfig.isV2()) {
+            wrapWithTokenAndAuthorizationHandlers(routingHandler, Methods.GET, new HashDetailsHandler(m.getHashManager()),
+                HashDetailsHandler.PATH, true);
+            wrapWithTokenAndAuthorizationHandlers(routingHandler, Methods.POST,
+                new HashLookupHandler(m.getIdentity(), m.getHashManager()), HashLookupHandler.Path, true);
+        }
    }

    private void addEndpoints(RoutingHandler routingHandler, HttpString method, boolean useAuthorization, ApiHandler... handlers) {
@@ -216,23 +227,35 @@ public class HttpMxisd {
                               HttpHandler httpHandler) {
        MatrixConfig matrixConfig = m.getConfig().getMatrix();
        if (matrixConfig.isV1()) {
-            routingHandler.add(method, apiHandler.getPath(IdentityServiceAPI.V1), httpHandler);
+            routingHandler.add(method, apiHandler.getPath(IdentityServiceAPI.V1), sane(httpHandler));
        }
        if (matrixConfig.isV2()) {
-            HttpHandler handlerWithTerms = CheckTermsHandler.around(m.getAccMgr(), httpHandler, getPolicyObjects(apiHandler));
-            HttpHandler wrappedHandler = useAuthorization ? AuthorizationHandler.around(m.getAccMgr(), handlerWithTerms) : handlerWithTerms;
-            routingHandler.add(method, apiHandler.getPath(IdentityServiceAPI.V2), wrappedHandler);
+            wrapWithTokenAndAuthorizationHandlers(routingHandler, method, httpHandler, apiHandler.getPath(IdentityServiceAPI.V2),
+                useAuthorization);
        }
    }

+    private void wrapWithTokenAndAuthorizationHandlers(RoutingHandler routingHandler, HttpString method, HttpHandler httpHandler,
+                                                       String url, boolean useAuthorization) {
+        List<PolicyConfig.PolicyObject> policyObjects = getPolicyObjects(url);
+        HttpHandler wrappedHandler;
+        if (useAuthorization) {
+            wrappedHandler = policyObjects.isEmpty() ? httpHandler : CheckTermsHandler.around(m.getAccMgr(), httpHandler, policyObjects);
+            wrappedHandler = AuthorizationHandler.around(m.getAccMgr(), wrappedHandler);
+        } else {
+            wrappedHandler = httpHandler;
+        }
+        routingHandler.add(method, url, sane(wrappedHandler));
+    }
+
    @NotNull
-    private List<PolicyConfig.PolicyObject> getPolicyObjects(ApiHandler apiHandler) {
+    private List<PolicyConfig.PolicyObject> getPolicyObjects(String url) {
        PolicyConfig policyConfig = m.getConfig().getPolicy();
        List<PolicyConfig.PolicyObject> policies = new ArrayList<>();
        if (!policyConfig.getPolicies().isEmpty()) {
            for (PolicyConfig.PolicyObject policy : policyConfig.getPolicies().values()) {
                for (Pattern pattern : policy.getPatterns()) {
-                    if (pattern.matcher(apiHandler.getHandlerPath()).matches()) {
+                    if (pattern.matcher(url).matches()) {
                        policies.add(policy);
                    }
                }
--- a/src/main/java/io/kamax/mxisd/Mxisd.java
+++ b/src/main/java/io/kamax/mxisd/Mxisd.java
@@ -27,6 +27,8 @@ import io.kamax.mxisd.auth.AuthProviders;
 import io.kamax.mxisd.backend.IdentityStoreSupplier;
 import io.kamax.mxisd.backend.sql.synapse.Synapse;
 import io.kamax.mxisd.config.MxisdConfig;
+import io.kamax.mxisd.config.PostgresqlStorageConfig;
+import io.kamax.mxisd.config.StorageConfig;
 import io.kamax.mxisd.crypto.CryptoFactory;
 import io.kamax.mxisd.crypto.KeyManager;
 import io.kamax.mxisd.crypto.SignatureManager;
@@ -109,7 +111,20 @@ public class Mxisd {
        IdentityServerUtils.setHttpClient(httpClient);
        srvFetcher = new RemoteIdentityServerFetcher(httpClient);

-        store = new OrmLiteSqlStorage(cfg);
+        StorageConfig.BackendEnum storageBackend = cfg.getStorage().getBackend();
+        StorageConfig.Provider storageProvider = cfg.getStorage().getProvider();
+        switch (storageBackend) {
+            case sqlite:
+                store = new OrmLiteSqlStorage(storageBackend, storageProvider.getSqlite().getDatabase());
+                break;
+            case postgresql:
+                PostgresqlStorageConfig postgresql = storageProvider.getPostgresql();
+                store = new OrmLiteSqlStorage(storageBackend, postgresql.getDatabase(), postgresql.getUsername(), postgresql.getPassword());
+                break;
+            default:
+                throw new IllegalStateException("Storage provider hasn't been configured");
+        }
+
        keyMgr = CryptoFactory.getKeyManager(cfg.getKey());
        signMgr = CryptoFactory.getSignatureManager(cfg, keyMgr);
        clientDns = new ClientDnsOverwrite(cfg.getDns().getOverwrite());
@@ -125,7 +140,7 @@ public class Mxisd {
        idStrategy = new RecursivePriorityLookupStrategy(cfg.getLookup(), ThreePidProviders.get(), bridgeFetcher, hashManager);
        pMgr = new ProfileManager(ProfileProviders.get(), clientDns, httpClient);
        notifMgr = new NotificationManager(cfg.getNotification(), NotificationHandlers.get());
-        sessMgr = new SessionManager(cfg, store, notifMgr, resolver, httpClient, signMgr);
+        sessMgr = new SessionManager(cfg, store, notifMgr, resolver, signMgr);
        invMgr = new InvitationManager(cfg, store, idStrategy, keyMgr, signMgr, resolver, notifMgr, pMgr);
        authMgr = new AuthManager(cfg, AuthProviders.get(), idStrategy, invMgr, clientDns, httpClient);
        dirMgr = new DirectoryManager(cfg.getDirectory(), clientDns, httpClient, DirectoryProviders.get());
--- a/src/main/java/io/kamax/mxisd/MxisdStandaloneExec.java
+++ b/src/main/java/io/kamax/mxisd/MxisdStandaloneExec.java
@@ -44,28 +44,43 @@ public class MxisdStandaloneExec {
        try {
            MxisdConfig cfg = null;
            Iterator<String> argsIt = Arrays.asList(args).iterator();
+            boolean dump = false;
+            boolean exit = false;
            while (argsIt.hasNext()) {
                String arg = argsIt.next();
-                if (StringUtils.equalsAny(arg, "-h", "--help", "-?", "--usage")) {
+                switch (arg) {
+                    case "-h":
+                    case "--help":
+                    case "-?":
+                    case "--usage":
                        System.out.println("Available arguments:" + System.lineSeparator());
                        System.out.println("  -h, --help       Show this help message");
                        System.out.println("  --version        Print the version then exit");
                        System.out.println("  -c, --config     Set the configuration file location");
                        System.out.println("  -v               Increase log level (log more info)");
                        System.out.println("  -vv              Further increase log level");
+                        System.out.println("  --dump           Dump the full ma1sd configuration");
+                        System.out.println("  --dump-and-exit  Dump the full ma1sd configuration and exit");
                        System.out.println(" ");
                        System.exit(0);
-                } else if (StringUtils.equals(arg, "-v")) {
+                        return;
+                    case "-v":
                        System.setProperty("org.slf4j.simpleLogger.log.io.kamax.mxisd", "debug");
-                } else if (StringUtils.equals(arg, "-vv")) {
+                        break;
+                    case "-vv":
                        System.setProperty("org.slf4j.simpleLogger.log.io.kamax.mxisd", "trace");
-                } else if (StringUtils.equalsAny(arg, "-c", "--config")) {
+                        break;
+                    case "-c":
+                    case "--config":
                        String cfgFile = argsIt.next();
                        cfg = YamlConfigLoader.loadFromFile(cfgFile);
-                } else if (StringUtils.equals("--version", arg)) {
-                    System.out.println(Mxisd.Version);
-                    System.exit(0);
-                } else {
+                        break;
+                    case "--dump-and-exit":
+                        exit = true;
+                    case "--dump":
+                        dump = true;
+                        break;
+                    default:
                        System.err.println("Invalid argument: " + arg);
                        System.err.println("Try '--help' for available arguments");
                        System.exit(1);
@@ -76,6 +91,13 @@ public class MxisdStandaloneExec {
                cfg = YamlConfigLoader.tryLoadFromFile("ma1sd.yaml").orElseGet(MxisdConfig::new);
            }

+            if (dump) {
+                YamlConfigLoader.dumpConfig(cfg);
+                if (exit) {
+                    System.exit(0);
+                }
+            }
+
            log.info("ma1sd starting");
            log.info("Version: {}", Mxisd.Version);

--- a/src/main/java/io/kamax/mxisd/as/processor/event/MembershipEventProcessor.java
+++ b/src/main/java/io/kamax/mxisd/as/processor/event/MembershipEventProcessor.java
@@ -144,7 +144,13 @@ public class MembershipEventProcessor implements EventTypeProcessor {
                .collect(Collectors.toList());
        log.info("Found {} email(s) in identity store for {}", tpids.size(), inviteeId);

-        for (_ThreePid tpid : tpids) {
+        log.info("Removing duplicates from identity store");
+        List<_ThreePid> uniqueTpids = tpids.stream()
+                .distinct()
+                .collect(Collectors.toList());
+        log.info("There are {} unique email(s) in identity store for {}", uniqueTpids.size(), inviteeId);        
+
+        for (_ThreePid tpid : uniqueTpids) {
            log.info("Found Email to notify about room invitation: {}", tpid.getAddress());
            Map<String, String> properties = new HashMap<>();
            profiler.getDisplayName(sender).ifPresent(name -> properties.put("sender_display_name", name));
--- a/src/main/java/io/kamax/mxisd/auth/AccountManager.java
+++ b/src/main/java/io/kamax/mxisd/auth/AccountManager.java
@@ -10,30 +10,23 @@ import io.kamax.mxisd.exception.BadRequestException;
 import io.kamax.mxisd.exception.InvalidCredentialsException;
 import io.kamax.mxisd.exception.NotFoundException;
 import io.kamax.mxisd.matrix.HomeserverFederationResolver;
+import io.kamax.mxisd.matrix.HomeserverVerifier;
 import io.kamax.mxisd.storage.IStorage;
 import io.kamax.mxisd.storage.ormlite.dao.AccountDao;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
 import org.apache.http.util.EntityUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.IOException;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateParsingException;
-import java.security.cert.X509Certificate;
 import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.UUID;
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.SSLPeerUnverifiedException;
-import javax.net.ssl.SSLSession;

 public class AccountManager {

@@ -62,7 +55,7 @@ public class AccountManager {

        String token = UUID.randomUUID().toString();
        AccountDao account = new AccountDao(openIdToken.getAccessToken(), openIdToken.getTokenType(),
-            openIdToken.getMatrixServerName(), openIdToken.getExpiredIn(),
+            openIdToken.getMatrixServerName(), openIdToken.getExpiresIn(),
            Instant.now().getEpochSecond(), userId, token);
        storage.insertToken(account);

@@ -73,13 +66,14 @@ public class AccountManager {

    private String getUserId(OpenIdToken openIdToken) {
        String matrixServerName = openIdToken.getMatrixServerName();
-        String homeserverURL = resolver.resolve(matrixServerName).toString();
+        HomeserverFederationResolver.HomeserverTarget homeserverTarget = resolver.resolve(matrixServerName);
+        String homeserverURL = homeserverTarget.getUrl().toString();
        LOGGER.info("Domain resolved: {} => {}", matrixServerName, homeserverURL);
        HttpGet getUserInfo = new HttpGet(
            homeserverURL + "/_matrix/federation/v1/openid/userinfo?access_token=" + openIdToken.getAccessToken());
        String userId;
-        try (CloseableHttpClient httpClient = HttpClientBuilder.create()
-            .setSSLHostnameVerifier(new MatrixHostnameVerifier(matrixServerName)).build()) {
+        try (CloseableHttpClient httpClient = HttpClients.custom()
+            .setSSLHostnameVerifier(new HomeserverVerifier(homeserverTarget.getDomain())).build()) {
            try (CloseableHttpResponse response = httpClient.execute(getUserInfo)) {
                int statusCode = response.getStatusLine().getStatusCode();
                if (statusCode == HttpStatus.SC_OK) {
@@ -169,74 +163,4 @@ public class AccountManager {
    public MatrixConfig getMatrixConfig() {
        return matrixConfig;
    }
-
-    public static class MatrixHostnameVerifier implements HostnameVerifier {
-
-        private static final String ALT_DNS_NAME_TYPE = "2";
-        private static final String ALT_IP_ADDRESS_TYPE = "7";
-
-        private final String matrixHostname;
-
-        public MatrixHostnameVerifier(String matrixHostname) {
-            this.matrixHostname = matrixHostname;
-        }
-
-        @Override
-        public boolean verify(String hostname, SSLSession session) {
-            try {
-                Certificate peerCertificate = session.getPeerCertificates()[0];
-                if (peerCertificate instanceof X509Certificate) {
-                    X509Certificate x509Certificate = (X509Certificate) peerCertificate;
-                    if (x509Certificate.getSubjectAlternativeNames() == null) {
-                        return false;
-                    }
-                    for (String altSubjectName : getAltSubjectNames(x509Certificate)) {
-                        if (match(altSubjectName)) {
-                            return true;
-                        }
-                    }
-                }
-            } catch (SSLPeerUnverifiedException | CertificateParsingException e) {
-                LOGGER.error("Unable to check remote host", e);
-                return false;
-            }
-
-            return false;
-        }
-
-        private List<String> getAltSubjectNames(X509Certificate x509Certificate) {
-            List<String> subjectNames = new ArrayList<>();
-            try {
-                for (List<?> subjectAlternativeNames : x509Certificate.getSubjectAlternativeNames()) {
-                    if (subjectAlternativeNames == null
-                        || subjectAlternativeNames.size() < 2
-                        || subjectAlternativeNames.get(0) == null
-                        || subjectAlternativeNames.get(1) == null) {
-                        continue;
-                    }
-                    String subjectType = subjectAlternativeNames.get(0).toString();
-                    switch (subjectType) {
-                        case ALT_DNS_NAME_TYPE:
-                        case ALT_IP_ADDRESS_TYPE:
-                            subjectNames.add(subjectAlternativeNames.get(1).toString());
-                            break;
-                        default:
-                            LOGGER.trace("Unusable subject type: " + subjectType);
-                    }
-                }
-            } catch (CertificateParsingException e) {
-                LOGGER.error("Unable to parse the certificate", e);
-                return Collections.emptyList();
-            }
-            return subjectNames;
-        }
-
-        private boolean match(String altSubjectName) {
-            if (altSubjectName.startsWith("*.")) {
-                return altSubjectName.toLowerCase().endsWith(matrixHostname.toLowerCase());
-            } else {
-                return matrixHostname.equalsIgnoreCase(altSubjectName);
-            }
-        }
-    }
 }
--- a/src/main/java/io/kamax/mxisd/auth/OpenIdToken.java
+++ b/src/main/java/io/kamax/mxisd/auth/OpenIdToken.java
@@ -1,14 +1,20 @@
 package io.kamax.mxisd.auth;

+import com.google.gson.annotations.SerializedName;
+
 public class OpenIdToken {

+    @SerializedName("access_token")
    private String accessToken;

+    @SerializedName("token_type")
    private String tokenType;

+    @SerializedName("matrix_server_name")
    private String matrixServerName;

-    private long expiredIn;
+    @SerializedName("expires_in")
+    private long expiresIn;

    public String getAccessToken() {
        return accessToken;
@@ -34,11 +40,11 @@ public class OpenIdToken {
        this.matrixServerName = matrixServerName;
    }

-    public long getExpiredIn() {
-        return expiredIn;
+    public long getExpiresIn() {
+        return expiresIn;
    }

-    public void setExpiredIn(long expiredIn) {
-        this.expiredIn = expiredIn;
+    public void setExpiresIn(long expiresIn) {
+        this.expiresIn = expiresIn;
    }
 }
--- a/src/main/java/io/kamax/mxisd/backend/exec/ExecIdentityStore.java
+++ b/src/main/java/io/kamax/mxisd/backend/exec/ExecIdentityStore.java
@@ -173,6 +173,10 @@ public class ExecIdentityStore extends ExecStore implements IThreePidProvider {

    @Override
    public Iterable<ThreePidMapping> populateHashes() {
+        if (!cfg.isHashLookup()) {
+            return Collections.emptyList();
+        }
+
        Processor<List<ThreePidMapping>> p = new Processor<>();
        p.withConfig(cfg.getLookup().getBulk());

--- a/src/main/java/io/kamax/mxisd/backend/ldap/LdapThreePidProvider.java
+++ b/src/main/java/io/kamax/mxisd/backend/ldap/LdapThreePidProvider.java
@@ -41,7 +41,10 @@ import org.slf4j.LoggerFactory;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
+import java.util.stream.Collectors;

 public class LdapThreePidProvider extends LdapBackend implements IThreePidProvider {

@@ -137,4 +140,65 @@ public class LdapThreePidProvider extends LdapBackend implements IThreePidProvid
        return mappingsFound;
    }

+    private List<String> getAttributes() {
+        final List<String> attributes = getCfg().getAttribute().getThreepid().values().stream().flatMap(List::stream)
+            .collect(Collectors.toList());
+        attributes.add(getUidAtt());
+        return attributes;
+    }
+
+    private Optional<String> getAttributeValue(Entry entry, List<String> attributes) {
+        return attributes.stream()
+            .map(attr -> getAttribute(entry, attr))
+            .filter(Objects::nonNull)
+            .filter(Optional::isPresent)
+            .map(Optional::get)
+            .findFirst();
+    }
+
+    @Override
+    public Iterable<ThreePidMapping> populateHashes() {
+        List<ThreePidMapping> result = new ArrayList<>();
+        if (!getCfg().getIdentity().isLookup()) {
+            return result;
+        }
+
+        String filter = getCfg().getIdentity().getFilter();
+
+        try (LdapConnection conn = getConn()) {
+            bind(conn);
+
+            log.debug("Query: {}", filter);
+            List<String> attributes = getAttributes();
+            log.debug("Attributes: {}", GsonUtil.build().toJson(attributes));
+
+            for (String baseDN : getBaseDNs()) {
+                log.debug("Base DN: {}", baseDN);
+
+                try (EntryCursor cursor = conn.search(baseDN, filter, SearchScope.SUBTREE, attributes.toArray(new String[0]))) {
+                    while (cursor.next()) {
+                        Entry entry = cursor.get();
+                        log.info("Found possible match, DN: {}", entry.getDn().getName());
+                        Optional<String> mxid = getAttribute(entry, getUidAtt());
+                        if (!mxid.isPresent()) {
+                            continue;
+                        }
+
+                        for (Map.Entry<String, List<String>> attributeEntry : getCfg().getAttribute().getThreepid().entrySet()) {
+                            String medium = attributeEntry.getKey();
+                            getAttributeValue(entry, attributeEntry.getValue())
+                                .ifPresent(s -> result.add(new ThreePidMapping(medium, s, buildMatrixIdFromUid(mxid.get()))));
+                        }
+                    }
+                } catch (CursorLdapReferralException e) {
+                    log.warn("3PID is only available via referral, skipping", e);
+                } catch (IOException | LdapException | CursorException e) {
+                    log.error("Unable to fetch 3PID mappings", e);
+                }
+            }
+        } catch (LdapException | IOException e) {
+            log.error("Unable to fetch 3PID mappings", e);
+        }
+        return result;
+    }
 }
--- a/src/main/java/io/kamax/mxisd/backend/memory/MemoryIdentityStore.java
+++ b/src/main/java/io/kamax/mxisd/backend/memory/MemoryIdentityStore.java
@@ -174,6 +174,10 @@ public class MemoryIdentityStore implements AuthenticatorProvider, DirectoryProv

    @Override
    public Iterable<ThreePidMapping> populateHashes() {
+        if (!cfg.isHashEnabled()) {
+            return Collections.emptyList();
+        }
+
        return cfg.getIdentities().stream()
            .map(mic -> mic.getThreepids().stream().map(mtp -> new ThreePidMapping(mtp.getMedium(), mtp.getAddress(), mic.getUsername())))
            .flatMap(s -> s).collect(
--- a/src/main/java/io/kamax/mxisd/backend/sql/SqlThreePidProvider.java
+++ b/src/main/java/io/kamax/mxisd/backend/sql/SqlThreePidProvider.java
@@ -107,14 +107,16 @@ public abstract class SqlThreePidProvider implements IThreePidProvider {

    @Override
    public Iterable<ThreePidMapping> populateHashes() {
-        if (StringUtils.isBlank(cfg.getLookup().getQuery())) {
+        String query = cfg.getLookup().getQuery();
+        if (StringUtils.isBlank(query)) {
            log.warn("Lookup query not configured, skip.");
            return Collections.emptyList();
        }

+        log.debug("Uses query to match users: {}", query);
        List<ThreePidMapping> result = new ArrayList<>();
        try (Connection connection = pool.get()) {
-            PreparedStatement statement = connection.prepareStatement(cfg.getLookup().getQuery());
+            PreparedStatement statement = connection.prepareStatement(query);
            try (ResultSet resultSet = statement.executeQuery()) {
                while (resultSet.next()) {
                    String mxid = resultSet.getString("mxid");
--- a/src/main/java/io/kamax/mxisd/backend/sql/synapse/Synapse.java
+++ b/src/main/java/io/kamax/mxisd/backend/sql/synapse/Synapse.java
@@ -29,15 +29,19 @@ import java.util.Optional;

 public class Synapse {

-    private SqlConnectionPool pool;
+    private final SqlConnectionPool pool;
+    private final SynapseSqlProviderConfig providerConfig;

    public Synapse(SynapseSqlProviderConfig sqlCfg) {
        this.pool = new SqlConnectionPool(sqlCfg);
+        providerConfig = sqlCfg;
    }

    public Optional<String> getRoomName(String id) {
+        String query = providerConfig.isLegacyRoomNames() ? SynapseQueries.getLegacyRoomName() : SynapseQueries.getRoomName();
+
        return pool.withConnFunction(conn -> {
-            PreparedStatement stmt = conn.prepareStatement(SynapseQueries.getRoomName());
+            try (PreparedStatement stmt = conn.prepareStatement(query)) {
                stmt.setString(1, id);
                ResultSet rSet = stmt.executeQuery();
                if (!rSet.next()) {
@@ -45,7 +49,7 @@ public class Synapse {
                }

                return Optional.ofNullable(rSet.getString(1));
+            }
        });
    }
-
 }
--- a/src/main/java/io/kamax/mxisd/backend/sql/synapse/SynapseQueries.java
+++ b/src/main/java/io/kamax/mxisd/backend/sql/synapse/SynapseQueries.java
@@ -72,7 +72,10 @@ public class SynapseQueries {
    }

    public static String getRoomName() {
-        return "select r.name from room_names r, events e, (select r1.room_id,max(e1.origin_server_ts) ts from room_names r1, events e1 where r1.event_id = e1.event_id group by r1.room_id) rle where e.origin_server_ts = rle.ts and r.event_id = e.event_id and r.room_id = ?";
+        return "select name from room_stats_state where room_id = ? limit 1";
    }

+    public static String getLegacyRoomName() {
+        return "select r.name from room_names r, events e, (select r1.room_id,max(e1.origin_server_ts) ts from room_names r1, events e1 where r1.event_id = e1.event_id group by r1.room_id) rle where e.origin_server_ts = rle.ts and r.event_id = e.event_id and r.room_id = ?";
+    }
 }
--- a/src/main/java/io/kamax/mxisd/config/DurationDeserializer.java
+++ b/src/main/java/io/kamax/mxisd/config/DurationDeserializer.java
@@ -0,0 +1,30 @@
+package io.kamax.mxisd.config;
+
+public class DurationDeserializer {
+
+    public long deserialize(String argument) {
+        long duration = 0L;
+        for (String part : argument.split(" ")) {
+            String unit = part.substring(part.length() - 1);
+            long value = Long.parseLong(part.substring(0, part.length() - 1));
+            switch (unit) {
+                case "s":
+                    duration += value;
+                    break;
+                case "m":
+                    duration += value * 60;
+                    break;
+                case "h":
+                    duration += value * 60 * 60;
+                    break;
+                case "d":
+                    duration += value * 60 * 60 * 24;
+                    break;
+                default:
+                    throw new IllegalArgumentException(String.format("Unknown duration unit: %s", unit));
+            }
+        }
+
+        return duration;
+    }
+}
--- a/src/main/java/io/kamax/mxisd/config/ExecConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/ExecConfig.java
@@ -309,6 +309,7 @@ public class ExecConfig {
        private Boolean enabled;
        private int priority;
        private Lookup lookup = new Lookup();
+        private boolean hashLookup = false;

        public Boolean isEnabled() {
            return enabled;
@@ -334,6 +335,13 @@ public class ExecConfig {
            this.lookup = lookup;
        }

+        public boolean isHashLookup() {
+            return hashLookup;
+        }
+
+        public void setHashLookup(boolean hashLookup) {
+            this.hashLookup = hashLookup;
+        }
    }

    public static class Profile {
--- a/src/main/java/io/kamax/mxisd/config/HashingConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/HashingConfig.java
@@ -11,10 +11,12 @@ public class HashingConfig {
    private static final Logger LOGGER = LoggerFactory.getLogger(HashingConfig.class);

    private boolean enabled = false;
-    private int pepperLength = 10;
+    private int pepperLength = 20;
    private RotationPolicyEnum rotationPolicy;
    private HashStorageEnum hashStorageType;
-    private long delay = 10;
+    private String delay = "10s";
+    private transient long delayInSeconds = 10;
+    private int requests = 10;
    private List<Algorithm> algorithms = new ArrayList<>();

    public void build() {
@@ -23,27 +25,33 @@ public class HashingConfig {
            LOGGER.info("   Pepper length: {}", getPepperLength());
            LOGGER.info("   Rotation policy: {}", getRotationPolicy());
            LOGGER.info("   Hash storage type: {}", getHashStorageType());
-            if (RotationPolicyEnum.PER_SECONDS == rotationPolicy) {
-                LOGGER.info("   Rotation delay: {}", delay);
+            if (RotationPolicyEnum.per_seconds == getRotationPolicy()) {
+                setDelayInSeconds(new DurationDeserializer().deserialize(getDelay()));
+                LOGGER.info("   Rotation delay: {}", getDelay());
+                LOGGER.info("   Rotation delay in seconds: {}", getDelayInSeconds());
            }
+            if (RotationPolicyEnum.per_requests == getRotationPolicy()) {
+                LOGGER.info("   Rotation after requests: {}", getRequests());
+            }
+            LOGGER.info("   Algorithms: {}", getAlgorithms());
        } else {
            LOGGER.info("Hash configuration disabled, used only `none` pepper.");
        }
    }

    public enum Algorithm {
-        NONE,
-        SHA256
+        none,
+        sha256
    }

    public enum RotationPolicyEnum {
-        PER_REQUESTS,
-        PER_SECONDS
+        per_requests,
+        per_seconds
    }

    public enum HashStorageEnum {
-        IN_MEMORY,
-        SQL
+        in_memory,
+        sql
    }

    public boolean isEnabled() {
@@ -78,14 +86,30 @@ public class HashingConfig {
        this.hashStorageType = hashStorageType;
    }

-    public long getDelay() {
+    public String getDelay() {
        return delay;
    }

-    public void setDelay(long delay) {
+    public void setDelay(String delay) {
        this.delay = delay;
    }

+    public long getDelayInSeconds() {
+        return delayInSeconds;
+    }
+
+    public void setDelayInSeconds(long delayInSeconds) {
+        this.delayInSeconds = delayInSeconds;
+    }
+
+    public int getRequests() {
+        return requests;
+    }
+
+    public void setRequests(int requests) {
+        this.requests = requests;
+    }
+
    public List<Algorithm> getAlgorithms() {
        return algorithms;
    }
--- a/src/main/java/io/kamax/mxisd/config/LoggingConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/LoggingConfig.java
@@ -0,0 +1,47 @@
+package io.kamax.mxisd.config;
+
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class LoggingConfig {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger("App");
+
+    private String root;
+    private String app;
+
+    public String getRoot() {
+        return root;
+    }
+
+    public void setRoot(String root) {
+        this.root = root;
+    }
+
+    public String getApp() {
+        return app;
+    }
+
+    public void setApp(String app) {
+        this.app = app;
+    }
+
+    public void build() {
+        LOGGER.info("Logging config:");
+        if (StringUtils.isNotBlank(getRoot())) {
+            LOGGER.info("  Default log level: {}", getRoot());
+            System.setProperty("org.slf4j.simpleLogger.defaultLogLevel", getRoot());
+        }
+
+        String appLevel = System.getProperty("org.slf4j.simpleLogger.log.io.kamax.mxisd");
+        if (StringUtils.isNotBlank(appLevel)) {
+            LOGGER.info("  Logging level set by environment: {}", appLevel);
+        } else if (StringUtils.isNotBlank(getApp())) {
+            System.setProperty("org.slf4j.simpleLogger.log.io.kamax.mxisd", getApp());
+            LOGGER.info("  Logging level set by the configuration: {}", getApp());
+        } else {
+            LOGGER.info("  Logging level hasn't set, use default");
+        }
+    }
+}
--- a/src/main/java/io/kamax/mxisd/config/MatrixConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/MatrixConfig.java
@@ -64,7 +64,7 @@ public class MatrixConfig {
    private String domain;
    private Identity identity = new Identity();
    private boolean v1 = true;
-    private boolean v2 = true;
+    private boolean v2 = false;

    public String getDomain() {
        return domain;
--- a/src/main/java/io/kamax/mxisd/config/MxisdConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/MxisdConfig.java
@@ -117,6 +117,7 @@ public class MxisdConfig {
    private WordpressConfig wordpress = new WordpressConfig();
    private PolicyConfig policy = new PolicyConfig();
    private HashingConfig hashing = new HashingConfig();
+    private LoggingConfig logging = new LoggingConfig();

    public AppServiceConfig getAppsvc() {
        return appsvc;
@@ -342,6 +343,14 @@ public class MxisdConfig {
        this.hashing = hashing;
    }

+    public LoggingConfig getLogging() {
+        return logging;
+    }
+
+    public void setLogging(LoggingConfig logging) {
+        this.logging = logging;
+    }
+
    public MxisdConfig inMemory() {
        getKey().setPath(":memory:");
        getStorage().getProvider().getSqlite().setDatabase(":memory:");
@@ -350,6 +359,8 @@ public class MxisdConfig {
    }

    public MxisdConfig build() {
+        getLogging().build();
+
        if (StringUtils.isBlank(getServer().getName())) {
            getServer().setName(getMatrix().getDomain());
            log.debug("server.name is empty, using matrix.domain");
@@ -359,6 +370,7 @@ public class MxisdConfig {
        getAuth().build();
        getAccountConfig().build();
        getDirectory().build();
+        getDns().build();
        getExec().build();
        getFirebase().build();
        getForward().build();
--- a/src/main/java/io/kamax/mxisd/config/PolicyConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/PolicyConfig.java
@@ -100,11 +100,13 @@ public class PolicyConfig {
                    policyObjectItem.getValue().getPatterns().add(Pattern.compile(regexp));
                }
                sb.append("  terms:\n");
+                if (policyObject.getTerms() != null) {
                    for (Map.Entry<String, TermObject> termItem : policyObject.getTerms().entrySet()) {
                        sb.append("    - lang: ").append(termItem.getKey()).append("\n");
                        sb.append("      name: ").append(termItem.getValue().getName()).append("\n");
                        sb.append("       url: ").append(termItem.getValue().getUrl()).append("\n");
                    }
+                }
                LOGGER.info(sb.toString());
            }
        }
--- a/src/main/java/io/kamax/mxisd/config/PostgresqlStorageConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/PostgresqlStorageConfig.java
@@ -0,0 +1,54 @@
+/*
+ * mxisd - Matrix Identity Server Daemon
+ * Copyright (C) 2017 Kamax Sarl
+ *
+ * https://www.kamax.io/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package io.kamax.mxisd.config;
+
+public class PostgresqlStorageConfig {
+
+    private String database;
+
+    private String username;
+
+    private String password;
+
+    public String getDatabase() {
+        return database;
+    }
+
+    public void setDatabase(String database) {
+        this.database = database;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+}
--- a/src/main/java/io/kamax/mxisd/config/StorageConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/StorageConfig.java
@@ -21,14 +21,21 @@
 package io.kamax.mxisd.config;

 import io.kamax.mxisd.exception.ConfigurationException;
-import org.apache.commons.lang.StringUtils;

 public class StorageConfig {

+    public enum BackendEnum {
+        sqlite,
+
+        postgresql
+    }
+
    public static class Provider {

        private SQLiteStorageConfig sqlite = new SQLiteStorageConfig();

+        private PostgresqlStorageConfig postgresql = new PostgresqlStorageConfig();
+
        public SQLiteStorageConfig getSqlite() {
            return sqlite;
        }
@@ -37,16 +44,23 @@ public class StorageConfig {
            this.sqlite = sqlite;
        }

+        public PostgresqlStorageConfig getPostgresql() {
+            return postgresql;
        }

-    private String backend = "sqlite";
+        public void setPostgresql(PostgresqlStorageConfig postgresql) {
+            this.postgresql = postgresql;
+        }
+    }
+
+    private BackendEnum backend = BackendEnum.sqlite; // or postgresql
    private Provider provider = new Provider();

-    public String getBackend() {
+    public BackendEnum getBackend() {
        return backend;
    }

-    public void setBackend(String backend) {
+    public void setBackend(BackendEnum backend) {
        this.backend = backend;
    }

@@ -59,7 +73,7 @@ public class StorageConfig {
    }

    public void build() {
-        if (StringUtils.isBlank(getBackend())) {
+        if (getBackend() == null) {
            throw new ConfigurationException("storage.backend");
        }
    }
--- a/src/main/java/io/kamax/mxisd/config/YamlConfigLoader.java
+++ b/src/main/java/io/kamax/mxisd/config/YamlConfigLoader.java
@@ -76,4 +76,14 @@ public class YamlConfigLoader {
        }
    }

+    public static void dumpConfig(MxisdConfig cfg) {
+        Representer rep = new Representer();
+        rep.getPropertyUtils().setBeanAccess(BeanAccess.FIELD);
+        rep.getPropertyUtils().setAllowReadOnlyProperties(true);
+        rep.getPropertyUtils().setSkipMissingProperties(true);
+
+        Yaml yaml = new Yaml(new Constructor(MxisdConfig.class), rep);
+        String dump = yaml.dump(cfg);
+        log.info("Full configuration:\n{}", dump);
+    }
 }
--- a/src/main/java/io/kamax/mxisd/config/ldap/LdapConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/ldap/LdapConfig.java
@@ -233,6 +233,7 @@ public abstract class LdapConfig {
        private String filter;
        private String token = "%3pid";
        private Map<String, String> medium = new HashMap<>();
+        private boolean lookup = false;

        public String getFilter() {
            return filter;
@@ -262,6 +263,13 @@ public abstract class LdapConfig {
            this.medium = medium;
        }

+        public boolean isLookup() {
+            return lookup;
+        }
+
+        public void setLookup(boolean lookup) {
+            this.lookup = lookup;
+        }
    }

    public static class Profile {
--- a/src/main/java/io/kamax/mxisd/config/memory/MemoryStoreConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/memory/MemoryStoreConfig.java
@@ -27,6 +27,7 @@ public class MemoryStoreConfig {

    private boolean enabled;
    private List<MemoryIdentityConfig> identities = new ArrayList<>();
+    private boolean hashEnabled = false;

    public boolean isEnabled() {
        return enabled;
@@ -44,6 +45,14 @@ public class MemoryStoreConfig {
        this.identities = identities;
    }

+    public boolean isHashEnabled() {
+        return hashEnabled;
+    }
+
+    public void setHashEnabled(boolean hashEnabled) {
+        this.hashEnabled = hashEnabled;
+    }
+
    public void build() {
        // no-op
    }
--- a/src/main/java/io/kamax/mxisd/config/memory/MemoryThreePid.java
+++ b/src/main/java/io/kamax/mxisd/config/memory/MemoryThreePid.java
@@ -45,4 +45,21 @@ public class MemoryThreePid implements _ThreePid {
        this.address = address;
    }

+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        MemoryThreePid threePid = (MemoryThreePid) o;
+
+        if (!medium.equals(threePid.medium)) return false;
+        return address.equals(threePid.address);
+    }
+
+    @Override
+    public int hashCode() {
+        int result = medium.hashCode();
+        result = 31 * result + address.hashCode();
+        return result;
+    }
 }
--- a/src/main/java/io/kamax/mxisd/config/sql/SqlConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/sql/SqlConfig.java
@@ -125,7 +125,7 @@ public abstract class SqlConfig {
    }

    public static class Lookup {
-        private String query;
+        private String query = "SELECT user_id AS mxid, medium, address from user_threepids";

        public String getQuery() {
            return query;
--- a/src/main/java/io/kamax/mxisd/config/sql/synapse/SynapseSqlProviderConfig.java
+++ b/src/main/java/io/kamax/mxisd/config/sql/synapse/SynapseSqlProviderConfig.java
@@ -24,9 +24,23 @@ import io.kamax.mxisd.UserIdType;
 import io.kamax.mxisd.backend.sql.synapse.SynapseQueries;
 import io.kamax.mxisd.config.sql.SqlConfig;
 import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 public class SynapseSqlProviderConfig extends SqlConfig {

+    private transient final Logger log = LoggerFactory.getLogger(SynapseSqlProviderConfig.class);
+
+    private boolean legacyRoomNames = false;
+
+    public boolean isLegacyRoomNames() {
+        return legacyRoomNames;
+    }
+
+    public void setLegacyRoomNames(boolean legacyRoomNames) {
+        this.legacyRoomNames = legacyRoomNames;
+    }
+
    @Override
    protected String getProviderName() {
        return "Synapse SQL";
@@ -65,4 +79,12 @@ public class SynapseSqlProviderConfig extends SqlConfig {
        printConfig();
    }

+    @Override
+    protected void printConfig() {
+        super.printConfig();
+
+        if (isEnabled()) {
+            log.info("Use legacy room name query: {}", isLegacyRoomNames());
+        }
+    }
 }
--- a/src/main/java/io/kamax/mxisd/hash/HashEngine.java
+++ b/src/main/java/io/kamax/mxisd/hash/HashEngine.java
@@ -1,20 +1,25 @@
 package io.kamax.mxisd.hash;

-import io.kamax.matrix.codec.MxSha256;
 import io.kamax.mxisd.config.HashingConfig;
 import io.kamax.mxisd.hash.storage.HashStorage;
 import io.kamax.mxisd.lookup.ThreePidMapping;
 import io.kamax.mxisd.lookup.provider.IThreePidProvider;
+import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.lang3.RandomStringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

+import java.util.Base64;
 import java.util.List;

 public class HashEngine {

+    private static final Logger LOGGER = LoggerFactory.getLogger(HashEngine.class);
+
    private final List<? extends IThreePidProvider> providers;
    private final HashStorage hashStorage;
-    private final MxSha256 sha256 = new MxSha256();
    private final HashingConfig config;
+    private final Base64.Encoder base64 = Base64.getUrlEncoder().withoutPadding();
    private String pepper;

    public HashEngine(List<? extends IThreePidProvider> providers, HashStorage hashStorage, HashingConfig config) {
@@ -24,16 +29,24 @@ public class HashEngine {
    }

    public void updateHashes() {
+        LOGGER.info("Start update hashes.");
        synchronized (hashStorage) {
            this.pepper = newPepper();
            hashStorage.clear();
            for (IThreePidProvider provider : providers) {
+                try {
+                    LOGGER.info("Populate hashes from the handler: {}", provider.getClass().getCanonicalName());
                    for (ThreePidMapping pidMapping : provider.populateHashes()) {
+                        LOGGER.debug("Found 3PID: {}", pidMapping);
                        hashStorage.add(pidMapping, hash(pidMapping));
                    }
+                } catch (Exception e) {
+                    LOGGER.error("Unable to update hashes of the provider: " + provider.toString(), e);
                }
            }
        }
+        LOGGER.info("Finish update hashes.");
+    }

    public String getPepper() {
        synchronized (hashStorage) {
@@ -42,10 +55,10 @@ public class HashEngine {
    }

    protected String hash(ThreePidMapping pidMapping) {
-        return sha256.hash(pidMapping.getMedium() + " " + pidMapping.getValue() + " " + getPepper());
+        return base64.encodeToString(DigestUtils.sha256(pidMapping.getValue() + " " + pidMapping.getMedium() + " " + getPepper()));
    }

    protected String newPepper() {
-        return RandomStringUtils.random(config.getPepperLength());
+        return RandomStringUtils.random(config.getPepperLength(), true, true);
    }
 }
--- a/src/main/java/io/kamax/mxisd/hash/HashManager.java
+++ b/src/main/java/io/kamax/mxisd/hash/HashManager.java
@@ -40,10 +40,10 @@ public class HashManager {
    private void initStorage() {
        if (config.isEnabled()) {
            switch (config.getHashStorageType()) {
-                case IN_MEMORY:
+                case in_memory:
                    this.hashStorage = new InMemoryHashStorage();
                    break;
-                case SQL:
+                case sql:
                    this.hashStorage = new SqlHashStorage(storage);
                    break;
                default:
@@ -57,11 +57,11 @@ public class HashManager {
    private void initRotationStrategy() {
        if (config.isEnabled()) {
            switch (config.getRotationPolicy()) {
-                case PER_REQUESTS:
-                    this.rotationStrategy = new RotationPerRequests();
+                case per_requests:
+                    this.rotationStrategy = new RotationPerRequests(config.getRequests());
                    break;
-                case PER_SECONDS:
-                    this.rotationStrategy = new TimeBasedRotation(config.getDelay());
+                case per_seconds:
+                    this.rotationStrategy = new TimeBasedRotation(config.getDelayInSeconds());
                    break;
                default:
                    throw new IllegalArgumentException("Unknown rotation type: " + config.getHashStorageType());
--- a/src/main/java/io/kamax/mxisd/hash/rotation/RotationPerRequests.java
+++ b/src/main/java/io/kamax/mxisd/hash/rotation/RotationPerRequests.java
@@ -8,10 +8,16 @@ public class RotationPerRequests implements HashRotationStrategy {

    private HashEngine hashEngine;
    private final AtomicInteger counter = new AtomicInteger(0);
+    private final int barrier;
+
+    public RotationPerRequests(int barrier) {
+        this.barrier = barrier;
+    }

    @Override
    public void register(HashEngine hashEngine) {
        this.hashEngine = hashEngine;
+        trigger();
    }

    @Override
@@ -22,7 +28,7 @@ public class RotationPerRequests implements HashRotationStrategy {
    @Override
    public synchronized void newRequest() {
        int newValue = counter.incrementAndGet();
-        if (newValue >= 10) {
+        if (newValue >= barrier) {
            counter.set(0);
            trigger();
        }
--- a/src/main/java/io/kamax/mxisd/hash/storage/SqlHashStorage.java
+++ b/src/main/java/io/kamax/mxisd/hash/storage/SqlHashStorage.java
@@ -12,6 +12,7 @@ public class SqlHashStorage implements HashStorage {

    public SqlHashStorage(IStorage storage) {
        this.storage = storage;
+        Runtime.getRuntime().addShutdownHook(new Thread(storage::clearHashes));
    }

    @Override
--- a/src/main/java/io/kamax/mxisd/http/undertow/handler/AuthorizationHandler.java
+++ b/src/main/java/io/kamax/mxisd/http/undertow/handler/AuthorizationHandler.java
@@ -58,7 +58,8 @@ public class AuthorizationHandler extends BasicHttpHandler {
            log.error("Account not found from request from: {}", exchange.getHostAndPort());
            throw new InvalidCredentialsException();
        }
-        if (account.getExpiresIn() < System.currentTimeMillis()) {
+        long expiredAt = (account.getCreatedAt() + account.getExpiresIn()) * 1000; // expired in milliseconds
+        if (expiredAt < System.currentTimeMillis()) {
            log.error("Account for '{}' from: {}", account.getUserId(), exchange.getHostAndPort());
            accountManager.deleteAccount(token);
            throw new InvalidCredentialsException();
--- a/src/main/java/io/kamax/mxisd/http/undertow/handler/CheckTermsHandler.java
+++ b/src/main/java/io/kamax/mxisd/http/undertow/handler/CheckTermsHandler.java
@@ -23,7 +23,6 @@ package io.kamax.mxisd.http.undertow.handler;
 import io.kamax.mxisd.auth.AccountManager;
 import io.kamax.mxisd.config.PolicyConfig;
 import io.kamax.mxisd.exception.InvalidCredentialsException;
-import io.kamax.mxisd.storage.ormlite.dao.AccountDao;
 import io.undertow.server.HttpHandler;
 import io.undertow.server.HttpServerExchange;
 import org.slf4j.Logger;
@@ -54,6 +53,11 @@ public class CheckTermsHandler extends BasicHttpHandler {

    @Override
    public void handleRequest(HttpServerExchange exchange) throws Exception {
+        if (policies == null || policies.isEmpty()) {
+            child.handleRequest(exchange);
+            return;
+        }
+
        String token = findAccessToken(exchange).orElse(null);
        if (token == null) {
            log.error("Unauthorized request from: {}", exchange.getHostAndPort());
--- a/src/main/java/io/kamax/mxisd/http/undertow/handler/auth/v2/AccountRegisterHandler.java
+++ b/src/main/java/io/kamax/mxisd/http/undertow/handler/auth/v2/AccountRegisterHandler.java
@@ -48,7 +48,7 @@ public class AccountRegisterHandler extends BasicHttpHandler {

        if (LOGGER.isInfoEnabled()) {
            LOGGER.info("Registration from domain: {}, expired at {}", openIdToken.getMatrixServerName(),
-                new Date(openIdToken.getExpiredIn()));
+                new Date(System.currentTimeMillis() + openIdToken.getExpiresIn()));
        }

        String token = accountManager.register(openIdToken);
--- a/src/main/java/io/kamax/mxisd/http/undertow/handler/identity/v2/HashLookupHandler.java
+++ b/src/main/java/io/kamax/mxisd/http/undertow/handler/identity/v2/HashLookupHandler.java
@@ -31,6 +31,8 @@ import io.kamax.mxisd.http.undertow.handler.ApiHandler;
 import io.kamax.mxisd.http.undertow.handler.identity.share.LookupHandler;
 import io.kamax.mxisd.lookup.BulkLookupRequest;
 import io.kamax.mxisd.lookup.HashLookupRequest;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
 import io.kamax.mxisd.lookup.ThreePidMapping;
 import io.kamax.mxisd.lookup.strategy.LookupStrategy;
 import io.undertow.server.HttpServerExchange;
@@ -40,6 +42,7 @@ import org.slf4j.LoggerFactory;

 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;

 public class HashLookupHandler extends LookupHandler implements ApiHandler {

@@ -60,6 +63,7 @@ public class HashLookupHandler extends LookupHandler implements ApiHandler {
        ClientHashLookupRequest input = parseJsonTo(exchange, ClientHashLookupRequest.class);
        HashLookupRequest lookupRequest = new HashLookupRequest();
        setRequesterInfo(lookupRequest, exchange);
+        lookupRequest.setHashes(input.getAddresses());
        log.info("Got bulk lookup request from {} with client {} - Is recursive? {}",
            lookupRequest.getRequester(), lookupRequest.getUserAgent(), lookupRequest.isRecursive());

@@ -81,20 +85,33 @@ public class HashLookupHandler extends LookupHandler implements ApiHandler {
            default:
                throw new InvalidParamException();
        }
+        hashManager.getRotationStrategy().newRequest();
    }

    private void noneAlgorithm(HttpServerExchange exchange, HashLookupRequest request, ClientHashLookupRequest input) throws Exception {
-        if (!hashManager.getConfig().getAlgorithms().contains(HashingConfig.Algorithm.NONE)) {
+        if (!hashManager.getConfig().getAlgorithms().contains(HashingConfig.Algorithm.none)) {
            throw new InvalidParamException();
        }

+        ClientHashLookupAnswer answer = null;
+        if (input.getAddresses() != null && input.getAddresses().size() > 0) {
+            if (input.getAddresses().size() == 1) {
+                answer = noneSingleLookup(request, input);
+            } else {
+                answer = noneBulkLookup(request, input);
+            }
+        }
+        respondJson(exchange, answer != null ? answer : new ClientHashLookupAnswer());
+    }
+
+    private ClientHashLookupAnswer noneBulkLookup(HashLookupRequest request, ClientHashLookupRequest input) throws Exception {
        BulkLookupRequest bulkLookupRequest = new BulkLookupRequest();
        List<ThreePidMapping> mappings = new ArrayList<>();
        for (String address : input.getAddresses()) {
            String[] parts = address.split(" ");
            ThreePidMapping mapping = new ThreePidMapping();
-            mapping.setMedium(parts[0]);
-            mapping.setValue(parts[1]);
+            mapping.setMedium(parts[1]);
+            mapping.setValue(parts[0]);
            mappings.add(mapping);
        }
        bulkLookupRequest.setMappings(mappings);
@@ -106,19 +123,42 @@ public class HashLookupHandler extends LookupHandler implements ApiHandler {
        }
        log.info("Finished bulk lookup request from {}", request.getRequester());

-        respondJson(exchange, answer);
+        return answer;
+    }
+
+    private ClientHashLookupAnswer noneSingleLookup(HashLookupRequest request, ClientHashLookupRequest input) {
+        SingleLookupRequest singleLookupRequest = new SingleLookupRequest();
+        String address = input.getAddresses().get(0);
+        String[] parts = address.split(" ");
+        singleLookupRequest.setThreePid(parts[0]);
+        singleLookupRequest.setType(parts[1]);
+
+        ClientHashLookupAnswer answer = new ClientHashLookupAnswer();
+
+        Optional<SingleLookupReply> singleLookupReply = strategy.find(singleLookupRequest);
+        if (singleLookupReply.isPresent()) {
+            SingleLookupReply reply = singleLookupReply.get();
+            answer.getMappings().put(address, reply.getMxid().toString());
+        }
+        log.info("Finished single lookup request from {}", request.getRequester());
+
+        return answer;
    }

    private void sha256Algorithm(HttpServerExchange exchange, HashLookupRequest request, ClientHashLookupRequest input) {
-        if (!hashManager.getConfig().getAlgorithms().contains(HashingConfig.Algorithm.SHA256)) {
+        if (!hashManager.getConfig().getAlgorithms().contains(HashingConfig.Algorithm.sha256)) {
            throw new InvalidParamException();
        }

        ClientHashLookupAnswer answer = new ClientHashLookupAnswer();
+        if (request.getHashes() != null && !request.getHashes().isEmpty()) {
            for (Pair<String, ThreePidMapping> pair : hashManager.getHashStorage().find(request.getHashes())) {
                answer.getMappings().put(pair.getKey(), pair.getValue().getMxid());
            }
            log.info("Finished bulk lookup request from {}", request.getRequester());
+        } else {
+            log.warn("Empty request");
+        }

        respondJson(exchange, answer);
    }
--- a/src/main/java/io/kamax/mxisd/http/undertow/handler/term/v2/AcceptTermsHandler.java
+++ b/src/main/java/io/kamax/mxisd/http/undertow/handler/term/v2/AcceptTermsHandler.java
@@ -2,7 +2,6 @@ package io.kamax.mxisd.http.undertow.handler.term.v2;

 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
-import io.kamax.matrix.json.GsonUtil;
 import io.kamax.mxisd.auth.AccountManager;
 import io.kamax.mxisd.exception.InvalidCredentialsException;
 import io.kamax.mxisd.http.undertow.handler.BasicHttpHandler;
@@ -28,7 +27,7 @@ public class AcceptTermsHandler extends BasicHttpHandler {
        String token = getAccessToken(exchange);

        JsonObject request = parseJsonObject(exchange);
-        JsonObject accepts = GsonUtil.getObj(request, "user_accepts");
+        JsonElement accepts = request.get("user_accepts");
        AccountDao account = accountManager.findAccount(token);

        if (account == null) {
--- a/src/main/java/io/kamax/mxisd/invitation/InvitationManager.java
+++ b/src/main/java/io/kamax/mxisd/invitation/InvitationManager.java
@@ -29,7 +29,11 @@ import io.kamax.matrix.json.GsonUtil;
 import io.kamax.mxisd.config.InvitationConfig;
 import io.kamax.mxisd.config.MxisdConfig;
 import io.kamax.mxisd.config.ServerConfig;
-import io.kamax.mxisd.crypto.*;
+import io.kamax.mxisd.crypto.GenericKeyIdentifier;
+import io.kamax.mxisd.crypto.KeyIdentifier;
+import io.kamax.mxisd.crypto.KeyManager;
+import io.kamax.mxisd.crypto.KeyType;
+import io.kamax.mxisd.crypto.SignatureManager;
 import io.kamax.mxisd.exception.BadRequestException;
 import io.kamax.mxisd.exception.ConfigurationException;
 import io.kamax.mxisd.exception.MappingAlreadyExistsException;
@@ -38,6 +42,7 @@ import io.kamax.mxisd.lookup.SingleLookupReply;
 import io.kamax.mxisd.lookup.ThreePidMapping;
 import io.kamax.mxisd.lookup.strategy.LookupStrategy;
 import io.kamax.mxisd.matrix.HomeserverFederationResolver;
+import io.kamax.mxisd.matrix.HomeserverVerifier;
 import io.kamax.mxisd.notification.NotificationManager;
 import io.kamax.mxisd.profile.ProfileManager;
 import io.kamax.mxisd.storage.IStorage;
@@ -48,23 +53,26 @@ import org.apache.commons.lang3.RandomStringUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpPost;
-import org.apache.http.conn.ssl.NoopHostnameVerifier;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
 import org.apache.http.entity.StringEntity;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
-import org.apache.http.ssl.SSLContextBuilder;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.SSLContext;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.time.DateTimeException;
 import java.time.Instant;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Timer;
+import java.util.TimerTask;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ForkJoinPool;
 import java.util.concurrent.TimeUnit;
@@ -86,7 +94,6 @@ public class InvitationManager {
    private NotificationManager notifMgr;
    private ProfileManager profileMgr;

-    private CloseableHttpClient client;
    private Timer refreshTimer;

    private Map<String, IThreePidInviteReply> invitations = new ConcurrentHashMap<>();
@@ -129,17 +136,6 @@ public class InvitationManager {
        });
        log.info("Loaded saved invites");

-        // FIXME export such madness into matrix-java-sdk with a nice wrapper to talk to a homeserver
-        try {
-            SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(new TrustSelfSignedStrategy()).build();
-            HostnameVerifier hostnameVerifier = new NoopHostnameVerifier();
-            SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
-            client = HttpClients.custom().setSSLSocketFactory(sslSocketFactory).build();
-        } catch (Exception e) {
-            // FIXME do better...
-            throw new RuntimeException(e);
-        }
-
        log.info("Setting up invitation mapping refresh timer");
        refreshTimer = new Timer();

@@ -423,11 +419,11 @@ public class InvitationManager {
        String address = reply.getInvite().getAddress();
        String domain = reply.getInvite().getSender().getDomain();
        log.info("Discovering HS for domain {}", domain);
-        String hsUrlOpt = resolver.resolve(domain).toString();
+        HomeserverFederationResolver.HomeserverTarget hsUrlOpt = resolver.resolve(domain);

        // TODO this is needed as this will block if called during authentication cycle due to synapse implementation
        new Thread(() -> { // FIXME need to make this retry-able and within a general background working pool
-            HttpPost req = new HttpPost(hsUrlOpt + "/_matrix/federation/v1/3pid/onbind");
+            HttpPost req = new HttpPost(hsUrlOpt.getUrl().toString() + "/_matrix/federation/v1/3pid/onbind");
            // Expected body: https://matrix.to/#/!HUeDbmFUsWAhxHHvFG:matrix.org/$150469846739DCLWc:matrix.trancendances.fr
            JsonObject obj = new JsonObject();
            obj.addProperty("mxid", mxid);
@@ -459,9 +455,11 @@ public class InvitationManager {
            Instant resolvedAt = Instant.now();
            boolean couldPublish = false;
            boolean shouldArchive = true;
+            try (CloseableHttpClient httpClient = HttpClients.custom().setSSLHostnameVerifier(new HomeserverVerifier(hsUrlOpt.getDomain()))
+                .build()) {
                try {
                    log.info("Posting onBind event to {}", req.getURI());
-                CloseableHttpResponse response = client.execute(req);
+                    CloseableHttpResponse response = httpClient.execute(req);
                    int statusCode = response.getStatusLine().getStatusCode();
                    log.info("Answer code: {}", statusCode);
                    if (statusCode >= 300 && statusCode != 403) {
@@ -490,6 +488,9 @@ public class InvitationManager {
                        }
                    }
                }
+            } catch (IOException e) {
+                log.error("Unable to create client to the " + hsUrlOpt.getUrl().toString(), e);
+            }
        }).start();
    }

--- a/src/main/java/io/kamax/mxisd/lookup/strategy/LookupStrategy.java
+++ b/src/main/java/io/kamax/mxisd/lookup/strategy/LookupStrategy.java
@@ -46,6 +46,4 @@ public interface LookupStrategy {
    Optional<SingleLookupReply> findRecursive(SingleLookupRequest request);

    CompletableFuture<List<ThreePidMapping>> find(BulkLookupRequest requests);
-
-    CompletableFuture<List<ThreePidMapping>> find(HashLookupRequest request);
 }
--- a/src/main/java/io/kamax/mxisd/lookup/strategy/RecursivePriorityLookupStrategy.java
+++ b/src/main/java/io/kamax/mxisd/lookup/strategy/RecursivePriorityLookupStrategy.java
@@ -26,17 +26,23 @@ import io.kamax.matrix.json.MatrixJson;
 import io.kamax.mxisd.config.MxisdConfig;
 import io.kamax.mxisd.exception.ConfigurationException;
 import io.kamax.mxisd.hash.HashManager;
-import io.kamax.mxisd.hash.storage.HashStorage;
-import io.kamax.mxisd.lookup.*;
+import io.kamax.mxisd.lookup.ALookupRequest;
+import io.kamax.mxisd.lookup.BulkLookupRequest;
+import io.kamax.mxisd.lookup.SingleLookupReply;
+import io.kamax.mxisd.lookup.SingleLookupRequest;
+import io.kamax.mxisd.lookup.ThreePidMapping;
 import io.kamax.mxisd.lookup.fetcher.IBridgeFetcher;
 import io.kamax.mxisd.lookup.provider.IThreePidProvider;
 import org.apache.commons.codec.digest.DigestUtils;
-import org.apache.commons.lang3.tuple.Pair;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.net.UnknownHostException;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
@@ -238,13 +244,4 @@ public class RecursivePriorityLookupStrategy implements LookupStrategy {
        result.complete(mapFoundAll);
        return bulkLookupInProgress.remove(payloadId);
    }
-
-    @Override
-    public CompletableFuture<List<ThreePidMapping>> find(HashLookupRequest request) {
-        HashStorage hashStorage = hashManager.getHashStorage();
-        CompletableFuture<List<ThreePidMapping>> result = new CompletableFuture<>();
-        result.complete(hashStorage.find(request.getHashes()).stream().map(Pair::getValue).collect(Collectors.toList()));
-        hashManager.getRotationStrategy().newRequest();
-        return result;
-    }
 }
--- a/src/main/java/io/kamax/mxisd/matrix/HomeserverFederationResolver.java
+++ b/src/main/java/io/kamax/mxisd/matrix/HomeserverFederationResolver.java
@@ -178,26 +178,26 @@ public class HomeserverFederationResolver {
        }
    }

-    public URL resolve(String domain) {
+    public HomeserverTarget resolve(String domain) {
        Optional<URL> s1 = resolveOverwrite(domain);
        if (s1.isPresent()) {
            URL dest = s1.get();
            log.info("Resolution of {} via DNS overwrite to {}", domain, dest);
-            return dest;
+            return new HomeserverTarget(dest.getHost(), dest);
        }

        Optional<URL> s2 = resolveLiteral(domain);
        if (s2.isPresent()) {
            URL dest = s2.get();
            log.info("Resolution of {} as IP literal or IP/hostname with explicit port to {}", domain, dest);
-            return dest;
+            return new HomeserverTarget(dest.getHost(), dest);
        }

        Optional<URL> s3 = resolveWellKnown(domain);
        if (s3.isPresent()) {
            URL dest = s3.get();
            log.info("Resolution of {} via well-known to {}", domain, dest);
-            return dest;
+            return new HomeserverTarget(dest.getHost(), dest);
        }
        // The domain needs to be resolved

@@ -205,12 +205,30 @@ public class HomeserverFederationResolver {
        if (s4.isPresent()) {
            URL dest = s4.get();
            log.info("Resolution of {} via DNS SRV record to {}", domain, dest);
-            return dest;
+            return new HomeserverTarget(domain, dest);
        }

        URL dest = build(domain + ":" + getDefaultPort());
        log.info("Resolution of {} to {}", domain, dest);
-        return dest;
+        return new HomeserverTarget(dest.getHost(), dest);
    }

+    public static class HomeserverTarget {
+
+        private final String domain;
+        private final URL url;
+
+        HomeserverTarget(String domain, URL url) {
+            this.domain = domain;
+            this.url = url;
+        }
+
+        public String getDomain() {
+            return domain;
+        }
+
+        public URL getUrl() {
+            return url;
+        }
+    }
 }
--- a/src/main/java/io/kamax/mxisd/matrix/HomeserverVerifier.java
+++ b/src/main/java/io/kamax/mxisd/matrix/HomeserverVerifier.java
@@ -0,0 +1,86 @@
+package io.kamax.mxisd.matrix;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.cert.Certificate;
+import java.security.cert.CertificateParsingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.net.ssl.SSLSession;
+
+public class HomeserverVerifier implements HostnameVerifier {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(HomeserverVerifier.class);
+    private static final String ALT_DNS_NAME_TYPE = "2";
+    private static final String ALT_IP_ADDRESS_TYPE = "7";
+
+    private final String matrixHostname;
+
+    public HomeserverVerifier(String matrixHostname) {
+        this.matrixHostname = matrixHostname;
+    }
+
+    @Override
+    public boolean verify(String hostname, SSLSession session) {
+        try {
+            Certificate peerCertificate = session.getPeerCertificates()[0];
+            if (peerCertificate instanceof X509Certificate) {
+                X509Certificate x509Certificate = (X509Certificate) peerCertificate;
+                if (x509Certificate.getSubjectAlternativeNames() == null) {
+                    return false;
+                }
+                for (String altSubjectName : getAltSubjectNames(x509Certificate)) {
+                    if (match(altSubjectName)) {
+                        return true;
+                    }
+                }
+            }
+        } catch (SSLPeerUnverifiedException | CertificateParsingException e) {
+            LOGGER.error("Unable to check remote host", e);
+            return false;
+        }
+
+        return false;
+    }
+
+    private List<String> getAltSubjectNames(X509Certificate x509Certificate) {
+        List<String> subjectNames = new ArrayList<>();
+        try {
+            for (List<?> subjectAlternativeNames : x509Certificate.getSubjectAlternativeNames()) {
+                if (subjectAlternativeNames == null
+                    || subjectAlternativeNames.size() < 2
+                    || subjectAlternativeNames.get(0) == null
+                    || subjectAlternativeNames.get(1) == null) {
+                    continue;
+                }
+                String subjectType = subjectAlternativeNames.get(0).toString();
+                switch (subjectType) {
+                    case ALT_DNS_NAME_TYPE:
+                    case ALT_IP_ADDRESS_TYPE:
+                        subjectNames.add(subjectAlternativeNames.get(1).toString());
+                        break;
+                    default:
+                        LOGGER.trace("Unusable subject type: " + subjectType);
+                }
+            }
+        } catch (CertificateParsingException e) {
+            LOGGER.error("Unable to parse the certificate", e);
+            return Collections.emptyList();
+        }
+        return subjectNames;
+    }
+
+    private boolean match(String altSubjectName) {
+        if (altSubjectName.startsWith("*.")) {
+            String subjectNameWithoutMask = altSubjectName.substring(1); // remove wildcard
+            return matrixHostname.toLowerCase().endsWith(subjectNameWithoutMask.toLowerCase());
+        } else {
+            return matrixHostname.equalsIgnoreCase(altSubjectName);
+        }
+    }
+}
--- a/src/main/java/io/kamax/mxisd/session/SessionManager.java
+++ b/src/main/java/io/kamax/mxisd/session/SessionManager.java
@@ -39,6 +39,7 @@ import io.kamax.mxisd.lookup.SingleLookupReply;
 import io.kamax.mxisd.lookup.SingleLookupRequest;
 import io.kamax.mxisd.lookup.ThreePidValidation;
 import io.kamax.mxisd.matrix.HomeserverFederationResolver;
+import io.kamax.mxisd.matrix.HomeserverVerifier;
 import io.kamax.mxisd.notification.NotificationManager;
 import io.kamax.mxisd.storage.IStorage;
 import io.kamax.mxisd.storage.dao.IThreePidSessionDao;
@@ -53,6 +54,7 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -73,7 +75,6 @@ public class SessionManager {
    private IStorage storage;
    private NotificationManager notifMgr;
    private HomeserverFederationResolver resolver;
-    private CloseableHttpClient client;
    private SignatureManager signatureManager;

    public SessionManager(
@@ -81,14 +82,12 @@ public class SessionManager {
        IStorage storage,
        NotificationManager notifMgr,
        HomeserverFederationResolver resolver,
-        CloseableHttpClient client,
        SignatureManager signatureManager
    ) {
        this.cfg = cfg;
        this.storage = storage;
        this.notifMgr = notifMgr;
        this.resolver = resolver;
-        this.client = client;
        this.signatureManager = signatureManager;
    }

@@ -308,19 +307,23 @@ public class SessionManager {

        String canonical = MatrixJson.encodeCanonical(jsonObject);

-        String originUrl = resolver.resolve(origin).toString();
+        HomeserverFederationResolver.HomeserverTarget homeserverTarget = resolver.resolve(origin);

-        validateServerKey(key, sig, canonical, originUrl);
+        validateServerKey(key, sig, canonical, homeserverTarget);
    }

    private String removeQuotes(String origin) {
        return origin.startsWith("\"") && origin.endsWith("\"") ? origin.substring(1, origin.length() - 1) : origin;
    }

-    private void validateServerKey(String key, String signature, String canonical, String originUrl) {
+    private void validateServerKey(String key, String signature, String canonical,
+                                   HomeserverFederationResolver.HomeserverTarget homeserverTarget) {
+        String originUrl = homeserverTarget.getUrl().toString();
        HttpGet request = new HttpGet(originUrl + "/_matrix/key/v2/server");
        log.info("Get keys from the server {}", request.getURI());
-        try (CloseableHttpResponse response = client.execute(request)) {
+        try (CloseableHttpClient httpClient = HttpClients.custom()
+            .setSSLHostnameVerifier(new HomeserverVerifier(homeserverTarget.getDomain())).build()) {
+            try (CloseableHttpResponse response = httpClient.execute(request)) {
                int statusCode = response.getStatusLine().getStatusCode();
                log.info("Answer code: {}", statusCode);
                if (statusCode == 200) {
@@ -333,6 +336,11 @@ public class SessionManager {
                log.error(message, e);
                throw new IllegalArgumentException(message);
            }
+        } catch (IOException e) {
+            String message = "Unable to get server keys: " + originUrl;
+            log.error(message, e);
+            throw new IllegalArgumentException(message);
+        }
    }

    private void verifyKey(String key, String signature, String canonical, CloseableHttpResponse response) throws IOException {
--- a/src/main/java/io/kamax/mxisd/storage/ormlite/OrmLiteSqlStorage.java
+++ b/src/main/java/io/kamax/mxisd/storage/ormlite/OrmLiteSqlStorage.java
@@ -28,8 +28,8 @@ import com.j256.ormlite.stmt.QueryBuilder;
 import com.j256.ormlite.support.ConnectionSource;
 import com.j256.ormlite.table.TableUtils;
 import io.kamax.matrix.ThreePid;
-import io.kamax.mxisd.config.MxisdConfig;
 import io.kamax.mxisd.config.PolicyConfig;
+import io.kamax.mxisd.config.StorageConfig;
 import io.kamax.mxisd.exception.ConfigurationException;
 import io.kamax.mxisd.exception.InternalServerError;
 import io.kamax.mxisd.exception.InvalidCredentialsException;
@@ -39,6 +39,7 @@ import io.kamax.mxisd.storage.IStorage;
 import io.kamax.mxisd.storage.dao.IThreePidSessionDao;
 import io.kamax.mxisd.storage.ormlite.dao.ASTransactionDao;
 import io.kamax.mxisd.storage.ormlite.dao.AccountDao;
+import io.kamax.mxisd.storage.ormlite.dao.ChangelogDao;
 import io.kamax.mxisd.storage.ormlite.dao.HashDao;
 import io.kamax.mxisd.storage.ormlite.dao.HistoricalThreePidInviteIO;
 import io.kamax.mxisd.storage.ormlite.dao.AcceptedDao;
@@ -46,12 +47,15 @@ import io.kamax.mxisd.storage.ormlite.dao.ThreePidInviteIO;
 import io.kamax.mxisd.storage.ormlite.dao.ThreePidSessionDao;
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 import java.io.IOException;
 import java.sql.SQLException;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Date;
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
@@ -59,6 +63,8 @@ import java.util.stream.Collectors;

 public class OrmLiteSqlStorage implements IStorage {

+    private static final Logger LOGGER = LoggerFactory.getLogger(OrmLiteSqlStorage.class);
+
    @FunctionalInterface
    private interface Getter<T> {

@@ -73,42 +79,84 @@ public class OrmLiteSqlStorage implements IStorage {

    }

+    public static class Migrations {
+        public static final String FIX_ACCEPTED_DAO = "2019_12_09__2254__fix_accepted_dao";
+    }
+
    private Dao<ThreePidInviteIO, String> invDao;
    private Dao<HistoricalThreePidInviteIO, String> expInvDao;
    private Dao<ThreePidSessionDao, String> sessionDao;
    private Dao<ASTransactionDao, String> asTxnDao;
    private Dao<AccountDao, String> accountDao;
-    private Dao<AcceptedDao, String> acceptedDao;
+    private Dao<AcceptedDao, Long> acceptedDao;
    private Dao<HashDao, String> hashDao;
+    private Dao<ChangelogDao, String> changelogDao;
+    private StorageConfig.BackendEnum backend;

-    public OrmLiteSqlStorage(MxisdConfig cfg) {
-        this(cfg.getStorage().getBackend(), cfg.getStorage().getProvider().getSqlite().getDatabase());
+    public OrmLiteSqlStorage(StorageConfig.BackendEnum backend, String path) {
+        this(backend, path, null, null);
    }

-    public OrmLiteSqlStorage(String backend, String path) {
-        if (StringUtils.isBlank(backend)) {
+    public OrmLiteSqlStorage(StorageConfig.BackendEnum backend, String database, String username, String password) {
+        if (backend == null) {
            throw new ConfigurationException("storage.backend");
        }
+        this.backend = backend;

-        if (StringUtils.isBlank(path)) {
+        if (StringUtils.isBlank(database)) {
            throw new ConfigurationException("Storage destination cannot be empty");
        }

        withCatcher(() -> {
-            ConnectionSource connPool = new JdbcConnectionSource("jdbc:" + backend + ":" + path);
+            ConnectionSource connPool = new JdbcConnectionSource("jdbc:" + backend + ":" + database, username, password);
+            changelogDao = createDaoAndTable(connPool, ChangelogDao.class);
            invDao = createDaoAndTable(connPool, ThreePidInviteIO.class);
            expInvDao = createDaoAndTable(connPool, HistoricalThreePidInviteIO.class);
            sessionDao = createDaoAndTable(connPool, ThreePidSessionDao.class);
            asTxnDao = createDaoAndTable(connPool, ASTransactionDao.class);
            accountDao = createDaoAndTable(connPool, AccountDao.class);
-            acceptedDao = createDaoAndTable(connPool, AcceptedDao.class);
+            acceptedDao = createDaoAndTable(connPool, AcceptedDao.class, true);
            hashDao = createDaoAndTable(connPool, HashDao.class);
+            runMigration(connPool);
        });
    }

+    private void runMigration(ConnectionSource connPol) throws SQLException {
+        ChangelogDao fixAcceptedDao = changelogDao.queryForId(Migrations.FIX_ACCEPTED_DAO);
+        if (fixAcceptedDao == null) {
+            fixAcceptedDao(connPol);
+            changelogDao.create(new ChangelogDao(Migrations.FIX_ACCEPTED_DAO, new Date(), "Recreate the accepted table."));
+        }
+    }
+
+    private void fixAcceptedDao(ConnectionSource connPool) throws SQLException {
+        LOGGER.info("Migration: {}", Migrations.FIX_ACCEPTED_DAO);
+        TableUtils.dropTable(acceptedDao, true);
+        TableUtils.createTableIfNotExists(connPool, AcceptedDao.class);
+    }
+
    private <V, K> Dao<V, K> createDaoAndTable(ConnectionSource connPool, Class<V> c) throws SQLException {
+        return createDaoAndTable(connPool, c, false);
+    }
+
+    /**
+     * Workaround for https://github.com/j256/ormlite-core/issues/20.
+     */
+    private <V, K> Dao<V, K> createDaoAndTable(ConnectionSource connPool, Class<V> c, boolean workaround) throws SQLException {
+        LOGGER.info("Create the dao: {}", c.getSimpleName());
        Dao<V, K> dao = DaoManager.createDao(connPool, c);
+        if (workaround && StorageConfig.BackendEnum.postgresql.equals(backend)) {
+            LOGGER.info("Workaround for postgresql on dao: {}", c.getSimpleName());
+            try {
+                dao.countOf();
+                LOGGER.info("Table exists, do nothing");
+            } catch (SQLException e) {
+                LOGGER.info("Table doesn't exist, create");
                TableUtils.createTableIfNotExists(connPool, c);
+            }
+        } else {
+            TableUtils.createTableIfNotExists(connPool, c);
+        }
        return dao;
    }

@@ -294,6 +342,13 @@ public class OrmLiteSqlStorage implements IStorage {
    public void acceptTerm(String token, String url) {
        withCatcher(() -> {
            AccountDao account = findAccount(token).orElseThrow(InvalidCredentialsException::new);
+            List<AcceptedDao> acceptedTerms = acceptedDao.queryForEq("userId", account.getUserId());
+            for (AcceptedDao acceptedTerm : acceptedTerms) {
+                if (acceptedTerm.getUrl().equalsIgnoreCase(url)) {
+                    // already accepted
+                    return;
+                }
+            }
            int created = acceptedDao.create(new AcceptedDao(url, account.getUserId(), System.currentTimeMillis()));
            if (created != 1) {
                throw new RuntimeException("Unexpected row count after DB action: " + created);
--- a/src/main/java/io/kamax/mxisd/storage/ormlite/dao/AcceptedDao.java
+++ b/src/main/java/io/kamax/mxisd/storage/ormlite/dao/AcceptedDao.java
@@ -26,7 +26,10 @@ import com.j256.ormlite.table.DatabaseTable;
@DatabaseTable(tableName = "accepted")
 public class AcceptedDao {

-    @DatabaseField(canBeNull = false, id = true)
+    @DatabaseField(generatedId = true)
+    private Long id;
+
+    @DatabaseField(canBeNull = false)
    private String url;

    @DatabaseField(canBeNull = false)
@@ -45,6 +48,14 @@ public class AcceptedDao {
        this.acceptedAt = acceptedAt;
    }

+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
    public String getUrl() {
        return url;
    }
--- a/src/main/java/io/kamax/mxisd/storage/ormlite/dao/ChangelogDao.java
+++ b/src/main/java/io/kamax/mxisd/storage/ormlite/dao/ChangelogDao.java
@@ -0,0 +1,52 @@
+package io.kamax.mxisd.storage.ormlite.dao;
+
+import com.j256.ormlite.field.DatabaseField;
+import com.j256.ormlite.table.DatabaseTable;
+
+import java.util.Date;
+
+@DatabaseTable(tableName = "changelog")
+public class ChangelogDao {
+
+    @DatabaseField(id = true)
+    private String id;
+
+    @DatabaseField
+    private Date createdAt;
+
+    @DatabaseField
+    private String comment;
+
+    public ChangelogDao() {
+    }
+
+    public ChangelogDao(String id, Date createdAt, String comment) {
+        this.id = id;
+        this.createdAt = createdAt;
+        this.comment = comment;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public Date getCreatedAt() {
+        return createdAt;
+    }
+
+    public void setCreatedAt(Date createdAt) {
+        this.createdAt = createdAt;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+}
--- a/src/test/java/io/kamax/mxisd/test/config/DurationDeserializerTest.java
+++ b/src/test/java/io/kamax/mxisd/test/config/DurationDeserializerTest.java
@@ -0,0 +1,20 @@
+package io.kamax.mxisd.test.config;
+
+import static org.junit.Assert.assertEquals;
+
+import io.kamax.mxisd.config.DurationDeserializer;
+import org.junit.Test;
+
+public class DurationDeserializerTest {
+
+    @Test
+    public void durationLoadTest() {
+        DurationDeserializer deserializer = new DurationDeserializer();
+
+        assertEquals(4, deserializer.deserialize("4s"));
+        assertEquals((60 * 60) + 4, deserializer.deserialize("1h 4s"));
+        assertEquals((2 * 60) + 4, deserializer.deserialize("2m 4s"));
+        assertEquals((2 * 60 * 60) + (7 * 60) + 4, deserializer.deserialize("2h 7m 4s"));
+        assertEquals((60 * 60 * 24) + (2 * 60 * 60) + (7 * 60) + 4, deserializer.deserialize("1d 2h 7m 4s"));
+    }
+}
--- a/src/test/java/io/kamax/mxisd/test/hash/HashEngineTest.java
+++ b/src/test/java/io/kamax/mxisd/test/hash/HashEngineTest.java
@@ -0,0 +1,18 @@
+package io.kamax.mxisd.test.hash;
+
+import static org.junit.Assert.assertEquals;
+
+import org.apache.commons.codec.digest.DigestUtils;
+import org.junit.Test;
+
+import java.util.Base64;
+
+public class HashEngineTest {
+
+    @Test
+    public void sha256test() {
+        Base64.Encoder encoder = Base64.getUrlEncoder().withoutPadding();
+        assertEquals("rujYzy1w0JxulN_rVlErGUmkdXT5znL0sjSF_IWreko",
+            encoder.encodeToString(DigestUtils.sha256("user@mail.homeserver.tld email I9x4vpcWjqp9X8iiOY4a")));
+    }
+}
--- a/src/test/java/io/kamax/mxisd/test/matrix/HomeserverFederationResolverTest.java
+++ b/src/test/java/io/kamax/mxisd/test/matrix/HomeserverFederationResolverTest.java
@@ -51,13 +51,13 @@ public class HomeserverFederationResolverTest {

    @Test
    public void hostnameWithoutPort() {
-        URL url = resolver.resolve("example.org");
+        URL url = resolver.resolve("example.org").getUrl();
        assertEquals("https://example.org:8448", url.toString());
    }

    @Test
    public void hostnameWithPort() {
-        URL url = resolver.resolve("example.org:443");
+        URL url = resolver.resolve("example.org:443").getUrl();
        assertEquals("https://example.org:443", url.toString());
    }

--- a/src/test/java/io/kamax/mxisd/test/storage/OrmLiteSqlStorageTest.java
+++ b/src/test/java/io/kamax/mxisd/test/storage/OrmLiteSqlStorageTest.java
@@ -20,6 +20,7 @@

 package io.kamax.mxisd.test.storage;

+import io.kamax.mxisd.config.StorageConfig;
 import io.kamax.mxisd.storage.ormlite.OrmLiteSqlStorage;
 import org.junit.Test;

@@ -29,14 +30,14 @@ public class OrmLiteSqlStorageTest {

    @Test
    public void insertAsTxnDuplicate() {
-        OrmLiteSqlStorage store = new OrmLiteSqlStorage("sqlite", ":memory:");
+        OrmLiteSqlStorage store = new OrmLiteSqlStorage(StorageConfig.BackendEnum.sqlite, ":memory:");
        store.insertTransactionResult("mxisd", "1", Instant.now(), "{}");
        store.insertTransactionResult("mxisd", "2", Instant.now(), "{}");
    }

    @Test(expected = RuntimeException.class)
    public void insertAsTxnSame() {
-        OrmLiteSqlStorage store = new OrmLiteSqlStorage("sqlite", ":memory:");
+        OrmLiteSqlStorage store = new OrmLiteSqlStorage(StorageConfig.BackendEnum.sqlite, ":memory:");
        store.insertTransactionResult("mxisd", "1", Instant.now(), "{}");
        store.insertTransactionResult("mxisd", "1", Instant.now(), "{}");
    }
Author	SHA1	Message	Date
Anatoly Sablin	9b4aff58c7	Add migration documentation.	2020-01-30 23:17:01 +03:00
Anatoly Sablin	a20e41574d	Update docs. Add a new options and configuration.	2020-01-28 23:20:29 +03:00
Anatoly Sablin	72977d65ae	Workaround for postgresql.	2020-01-28 23:18:39 +03:00
Anatoly Sablin	7555fff1a5	Add the postgresql backend for internal storage.	2020-01-28 22:15:26 +03:00
Anatoly Sablin	aed12e5536	Add the --dump-and-exit option to exit after printing the full configuration.	2020-01-28 01:02:43 +03:00
Anatoly Sablin	75efd9921d	Improve logging configuration. Introduce the root and the app log levels.	2020-01-28 00:55:39 +03:00
Anatoly Sablin	9219bd4723	Add logging configuration. Add `--dump` option to just print the full configuration.	2020-01-25 14:57:22 +03:00
Anatoly Sablin	73526be2ac	Add configuration to use the legacy query for old synapse to get room names.	2020-01-25 14:04:40 +03:00
ma1uta	b827efca2c	Merge pull request #13 from NullIsNot0/fix-room-names-patch Fix room name retrieval after Synapse dropped table room_names	2020-01-25 10:50:55 +00:00
NullIsNot0	6b7a4c8a23	Fix room name retrieval after Synapse dropped table room_names Recently Synapse dropped unused (by Synapse itself) table "room_names" which brakes room name retrieval for ma1sd. There is a table "room_stats_state" from which we can retrieve room name by it's ID. Note that people to people conversations do not contain room names, because they are generated on-the-fly by setting other participants names separated by word "and". That's why this query will only get names for rooms where room names are set during creation process (or changed later) and are the same for all participants. Link to Synapse code where it drops "room_names" table: https://github.com/matrix-org/synapse/blob/master/synapse/storage/data_stores/main/schema/delta/56/drop_unused_event_tables.sql#L17	2020-01-10 18:23:29 +02:00
Anatoly Sablin	47f6239268	Add equals and hashCode methods for the MemoryThreePid.	2020-01-09 22:28:44 +03:00
ma1uta	0d6f65b469	Merge pull request #11 from NullIsNot0/master Load DNS overwrite config on startup and remove duplicates from identity store before email notifications	2020-01-09 19:25:13 +00:00
Edgars Voroboks	be915aed94	Remove duplicates from identity store before email notifications I use LDAP for user store. I have set up "mail" and "otherMailbox" as threepid email attributes. When people get invited to rooms, they receive 2 (sometimes 3) invitation e-mails if they have the same e-mail address in LDAP "mail" and "otherMailbox" fields. I think it's a good idea to check identity store for duplicates before sending invitation e-mails.	2020-01-09 20:14:56 +02:00
NullIsNot0	ce938bb4a5	Load DNS overwrite config on startup I recently noticed that DNS overwrite does not happen. There are messages in logs: "No DNS overwrite for <REDACTED>", but I definitely have configured DNS overwrithng. I think it's because DNS overwriting config is not loaded when ma1sd starts up. Documented here: https://github.com/ma1uta/ma1sd/blob/master/docs/features/authentication.md#dns-overwrite and here: https://github.com/ma1uta/ma1sd/blob/master/docs/features/directory.md#dns-overwrite	2020-01-07 22:24:26 +02:00
Anatoly Sablin	15db563e8d	Add documentation.	2019-12-26 22:49:25 +03:00
Anatoly Sablin	82a538c750	Add an option to enable/disable hash lookup via the LDAP provider.	2019-12-25 22:51:44 +03:00
Anatoly Sablin	84ca8ebbd9	Add support of the MSC2134 (Identity hash lookup) for the LDAP provider.	2019-12-25 00:13:07 +03:00
Anatoly Sablin	774ebf4fa8	Fix for #9 . Proper wrap the handles with the sanitize handler.	2019-12-16 22:47:24 +03:00
Anatoly Sablin	eb1326c56a	Add unique id for the accepted table. Add a little more logs.	2019-12-10 22:29:00 +03:00
Anatoly Sablin	10cdb4360e	Fix homeserver verification with wildcards certificates. Disable v2 by default. Add migration to fix the accepted table (due to sqlite unable to change constraint, drop table and create again). Fix displaying the expiration period of the new token. Remove duplicated code. Use v1 single lookup when receive the request with `none` algorithm and the only one argument. Hide v2 endpoint if v2 API disabled.	2019-12-10 00:10:13 +03:00
Anatoly Sablin	17ebc2a421	Fix hash generation.	2019-12-06 23:15:00 +03:00
Anatoly Sablin	cbb9fced8d	Clarify the documentation. Add the hash config to the example config. Uses duration in the delay field instead of the seconds.	2019-12-05 23:27:13 +03:00
Anatoly Sablin	7509174611	Add documentation. Add options to enable/disable the hash providers. Add the option for setup barrier for rotation per requests strategy.	2019-12-02 23:23:17 +03:00
Anatoly Sablin	51d9225dda	Don't wrap the AcceptTermsHandler with terms checking. Clear the sql hash storage on shutdown.	2019-12-02 22:31:36 +03:00
Anatoly Sablin	6216113400	FIx terms.	2019-11-29 23:38:52 +03:00
Anatoly Sablin	cb32441959	Fix sha256 hashing. Fix v2 lookup.	2019-11-29 00:26:08 +03:00
Anatoly Sablin	0ec4df2c06	Fix bug with token expiration. Increase the default length of the pepper. Update hashes on startup with RotationPerRequest strategy. Don't check for existing pepper on the `none` hash algorithm.	2019-11-28 00:28:11 +03:00
Anatoly Sablin	86b880069b	Wrap with the CheckTermsHandler handlers only with authorization.	2019-11-27 22:55:34 +03:00
Anatoly Sablin	a97273fe77	Wrap with the CheckTermsHandler is necessary.	2019-11-25 23:35:56 +03:00
Anatoly Sablin	f9daf4d58a	Make configuration enums in lowercase. Wrap create hashes by try-catch. Add initial part of the documentation.	2019-11-15 23:39:45 +03:00
Anatoly Sablin	9e4cabb69b	Fix the token expiration period.	2019-11-15 22:50:08 +03:00
Anatoly Sablin	0b81de3cd0	Make the federation homeserver resolve more accurate (on resolve via DNS record check that the certificate present for the original host).	2019-11-13 23:08:34 +03:00