Add passthrough_authorization_parameters support to OIDC configuration #18232

odelcroi · 2025-03-12T15:26:43Z

Add passthrough_authorization_parameters support to OIDC configuration

This PR adds the passthrough_authorization_parameters option to OIDC configuration, allowing specific query parameters (like login_hint) to be passed from the redirect endpoint to the authorization grant URL.

This enables clients to provide additional context to identity providers during authentication flows.

Pull Request Checklist

Pull request is based on the develop branch
Pull request includes a changelog file. The entry should:
- Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
- Use markdown where necessary, mostly for code blocks.
- End with either a period (.) or an exclamation mark (!).
- Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
Code style is correct
(run the linters)

sandhose · 2025-04-01T07:49:56Z

synapse/handlers/oidc.py

This would be an extension of the spec, which should go through the spec change process. Given that it's unlikely that such a spec change would land, I think it would make sense to instead have a generic option to 'passthrough' specific query parameters.

Something like

oidc_providers: - idp_id: … passthrough_authorization_parameters: - login_hint

And then passthrough any query parameter passed to /_matrix/client/v3/login/sso/redirect to the OIDC authorization request

thanks for your inputs, makes sense, I've made the corresponding changes

docs/usage/configuration/config_documentation.md

sandhose

Pretty nice and short in the end, thanks for doing this!

changelog.d/18232.feature

Co-authored-by: Quentin Gliech <[email protected]>

odelcroi · 2025-04-10T13:12:31Z

@sandhose thanks 👍

@kfiven

Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using dependencies from 2025Q2. NB: A security update to synapse is scheduled for July 22. Consult https://matrix.org/blog/2025/07/security-predisclosure/ for further details. Those running synapse in production may wish to update to 1.134.0 to reduce the magnitude of change when updating to the July 22 version (although that will be a big update regardless). Note that the usual pkgsrc pre-commit test is upgrading from the current pkgsrc version and briefly checking operation. Therefore, not upgrading has a theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when 1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok. # Synapse 1.134.0 (2025-07-15) - Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven). ([\#18070](element-hq/synapse#18070)) - Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196)) - Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241)) # Synapse 1.133.0 (2025-07-01) - Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120)) # Synapse 1.132.0 (2025-06-17) - Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288)) - Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455)) - Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\#18457](element-hq/synapse#18457)) - Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458)) - Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486)) - Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456)) - Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521)) - Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\#18513](element-hq/synapse#18513)) # Synapse 1.131.0 (2025-06-03) - Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\#18180](element-hq/synapse#18180)) - Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262)) - Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\#18318](element-hq/synapse#18318)) - Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\#18387](element-hq/synapse#18387)) # Synapse 1.130.0 (2025-05-20) - Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214)) - Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300)) - Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355)) # Synapse 1.129.0 (2025-05-06) - Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232)) - Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260)) # Synapse 1.128.0 (2025-04-08) - Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient. ([\#18231](element-hq/synapse#18231)) - Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254)) - Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277), [\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))

@kfiven

chat/matrix-synapse: Update package in anticipation of security fix Revisions pulled up: - chat/matrix-synapse/Makefile 1.112 - chat/matrix-synapse/PLIST 1.59 - chat/matrix-synapse/cargo-depends.mk 1.27 - chat/matrix-synapse/distinfo 1.80 --- Module Name: pkgsrc Committed By: gdt Date: Thu Jul 17 11:24:44 UTC 2025 Modified Files: pkgsrc/chat/matrix-synapse: Makefile PLIST cargo-depends.mk distinfo Log Message: chat/matrix-synapse: Update to 1.134.0 Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using dependencies from 2025Q2. NB: A security update to synapse is scheduled for July 22. Consult https://matrix.org/blog/2025/07/security-predisclosure/ for further details. Those running synapse in production may wish to update to 1.134.0 to reduce the magnitude of change when updating to the July 22 version (although that will be a big update regardless). Note that the usual pkgsrc pre-commit test is upgrading from the current pkgsrc version and briefly checking operation. Therefore, not upgrading has a theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when 1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok. # Synapse 1.134.0 (2025-07-15) - Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven). ([\#18070](element-hq/synapse#18070)) - Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196)) - Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241)) # Synapse 1.133.0 (2025-07-01) - Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120)) # Synapse 1.132.0 (2025-06-17) - Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288)) - Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455)) - Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\#18457](element-hq/synapse#18457)) - Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458)) - Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486)) - Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456)) - Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521)) - Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\#18513](element-hq/synapse#18513)) # Synapse 1.131.0 (2025-06-03) - Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\#18180](element-hq/synapse#18180)) - Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262)) - Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\#18318](element-hq/synapse#18318)) - Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\#18387](element-hq/synapse#18387)) # Synapse 1.130.0 (2025-05-20) - Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214)) - Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300)) - Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355)) # Synapse 1.129.0 (2025-05-06) - Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232)) - Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260)) # Synapse 1.128.0 (2025-04-08) - Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient. ([\#18231](element-hq/synapse#18231)) - Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254)) - Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277), [\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))

@kfiven

chat/matrix-synapse: Update package in anticipation of security fix Revisions pulled up: - chat/matrix-synapse/Makefile 1.112 - chat/matrix-synapse/PLIST 1.59 - chat/matrix-synapse/cargo-depends.mk 1.27 - chat/matrix-synapse/distinfo 1.80 --- Module Name: pkgsrc Committed By: gdt Date: Thu Jul 17 11:24:44 UTC 2025 Modified Files: pkgsrc/chat/matrix-synapse: Makefile PLIST cargo-depends.mk distinfo Log Message: chat/matrix-synapse: Update to 1.134.0 Builds on NetBSD 10 amd64, and builds/tests-ok on NetBSD 9 amd64 using dependencies from 2025Q2. NB: A security update to synapse is scheduled for July 22. Consult https://matrix.org/blog/2025/07/security-predisclosure/ for further details. Those running synapse in production may wish to update to 1.134.0 to reduce the magnitude of change when updating to the July 22 version (although that will be a big update regardless). Note that the usual pkgsrc pre-commit test is upgrading from the current pkgsrc version and briefly checking operation. Therefore, not upgrading has a theoretical risk of encountering a 1.127.1 to 1.135.0 update bug when 1.127.1 to 134.0 and 1.134.0 to 1.135.0 are ok. # Synapse 1.134.0 (2025-07-15) - Support for [MSC4235](matrix-org/matrix-spec-proposals#4235): `via` query param for hierarchy endpoint. Contributed by Krishan (@kfiven). ([\#18070](element-hq/synapse#18070)) - Add `forget_forced_upon_leave` capability as per [MSC4267](matrix-org/matrix-spec-proposals#4267). ([\#18196](element-hq/synapse#18196)) - Add `federated_user_may_invite` spam checker callback which receives the entire invite event. Contributed by @tulir @ Beeper. ([\#18241](element-hq/synapse#18241)) # Synapse 1.133.0 (2025-07-01) - Add support for the [MSC4260 user report API](matrix-org/matrix-spec-proposals#4260). ([\#18120](element-hq/synapse#18120)) # Synapse 1.132.0 (2025-06-17) - Add support for [MSC4155](matrix-org/matrix-spec-proposals#4155) Invite Filtering. ([\#18288](element-hq/synapse#18288)) - Add experimental `user_may_send_state_event` module API callback. ([\#18455](element-hq/synapse#18455)) - Add experimental `get_media_config_for_user` and `is_user_allowed_to_upload_media_of_size` module API callbacks that allow overriding of media repository maximum upload size. ([\#18457](element-hq/synapse#18457)) - Add experimental `get_ratelimit_override_for_user` module API callback that allows overriding of per-user ratelimits. ([\#18458](element-hq/synapse#18458)) - Pass `room_config` argument to `user_may_create_room` spam checker module callback. ([\#18486](element-hq/synapse#18486)) - Support configuration of default and extra user types. ([\#18456](element-hq/synapse#18456)) - Successful requests to `/_matrix/app/v1/ping` will now force Synapse to reattempt delivering transactions to appservices. ([\#18521](element-hq/synapse#18521)) - Support the import of the `RatelimitOverride` type from `synapse.module_api` in modules and rename `messages_per_second` to `per_second`. ([\#18513](element-hq/synapse#18513)) # Synapse 1.131.0 (2025-06-03) - Add `msc4263_limit_key_queries_to_users_who_share_rooms` config option as per [MSC4263](matrix-org/matrix-spec-proposals#4263). ([\#18180](element-hq/synapse#18180)) - Add option to allow registrations that begin with `_`. Contributed by `_` (@hex5f). ([\#18262](element-hq/synapse#18262)) - Include room ID in response to the [Room Deletion Status Admin API](https://element-hq.github.io/synapse/latest/admin_api/rooms.html#status-of-deleting-rooms). ([\#18318](element-hq/synapse#18318)) - Add support for calling Policy Servers ([MSC4284](matrix-org/matrix-spec-proposals#4284)) to mark events as spam. ([\#18387](element-hq/synapse#18387)) # Synapse 1.130.0 (2025-05-20) - Add an Admin API endpoint `GET /_synapse/admin/v1/scheduled_tasks` to fetch scheduled tasks. ([\#18214](element-hq/synapse#18214)) - Add config option `user_directory.exclude_remote_users` which, when enabled, excludes remote users from user directory search results. ([\#18300](element-hq/synapse#18300)) - Add support for handling `GET /devices/` on workers. ([\#18355](element-hq/synapse#18355)) # Synapse 1.129.0 (2025-05-06) - Add `passthrough_authorization_parameters` in OIDC configuration to allow passing parameters to the authorization grant URL. ([\#18232](element-hq/synapse#18232)) - Add `total_event_count`, `total_message_count`, and `total_e2ee_event_count` fields to the homeserver usage statistics. ([\#18260](element-hq/synapse#18260)) # Synapse 1.128.0 (2025-04-08) - Add an access token introspection cache to make Matrix Authentication Service integration ([MSC3861](matrix-org/matrix-spec-proposals#3861)) more efficient. ([\#18231](element-hq/synapse#18231)) - Add background job to clear unreferenced state groups. ([\#18254](element-hq/synapse#18254)) - Hashes of media files are now tracked by Synapse. Media quarantines will now apply to all files with the same hash. ([\#18277](element-hq/synapse#18277), [\#18302](element-hq/synapse#18302), [\#18296](element-hq/synapse#18296))

Add support for the login_hint parameter in OIDC authentication flow

d67b6d5

odelcroi requested a review from a team as a code owner March 12, 2025 15:26

rename feature log

a3d8668

odelcroi closed this Mar 18, 2025

odelcroi reopened this Mar 18, 2025

odelcroi added 2 commits March 18, 2025 09:21

Merge branch 'develop' into add_login_hint

2b63ce4

Merge branch 'develop' into add_login_hint

c02e747

odelcroi closed this Mar 21, 2025

odelcroi reopened this Mar 21, 2025

odelcroi added 2 commits March 25, 2025 14:10

Merge branch 'develop' into add_login_hint

6f87069

Merge branch 'develop' into add_login_hint

dabcdc5

sandhose requested changes Apr 1, 2025

View reviewed changes

odelcroi added 2 commits April 1, 2025 16:13

add passthrough_authorization_parameters to oidc config

d6c7dfe

Merge branch 'develop' into add_login_hint

ab4c555

github-actions bot deployed to PR Documentation Preview April 1, 2025 14:14 Active

update changelog

cc0537e

github-actions bot deployed to PR Documentation Preview April 1, 2025 14:17 Active

lint

539edc8

github-actions bot deployed to PR Documentation Preview April 1, 2025 14:19 Active

update changelog

92b4617

github-actions bot deployed to PR Documentation Preview April 1, 2025 14:22 Active

odelcroi requested a review from sandhose April 1, 2025 15:19

odelcroi commented Apr 1, 2025

View reviewed changes

docs/usage/configuration/config_documentation.md Outdated Show resolved Hide resolved

odelcroi commented Apr 1, 2025

View reviewed changes

docs/usage/configuration/config_documentation.md Outdated Show resolved Hide resolved

odelcroi added 2 commits April 1, 2025 17:24

Update docs/usage/configuration/config_documentation.md

2268623

Update docs/usage/configuration/config_documentation.md

6c80e5a

github-actions bot deployed to PR Documentation Preview April 1, 2025 15:25 Active

odelcroi changed the title ~~Add support for the login_hint parameter in OIDC authentication flow~~ Add passthrough_authorization_parameters support to OIDC configuration Apr 2, 2025

Merge branch 'develop' into add_login_hint

6510d43

github-actions bot deployed to PR Documentation Preview April 2, 2025 07:35 Active

odelcroi mentioned this pull request Apr 2, 2025

add login hint parameter tchapgouv/synapse#2

Closed

3 tasks

remove login_hint docs

5b44af1

github-actions bot deployed to PR Documentation Preview April 2, 2025 12:21 Active

Merge branch 'develop' into add_login_hint

47307c1

github-actions bot deployed to PR Documentation Preview April 3, 2025 08:11 Active

odelcroi closed this Apr 8, 2025

odelcroi reopened this Apr 8, 2025

github-actions bot deployed to PR Documentation Preview April 8, 2025 12:15 Active

Merge branch 'develop' into add_login_hint

13073da

github-actions bot deployed to PR Documentation Preview April 9, 2025 08:45 Active

odelcroi closed this Apr 10, 2025

odelcroi reopened this Apr 10, 2025

github-actions bot deployed to PR Documentation Preview April 10, 2025 07:20 Active

sandhose approved these changes Apr 10, 2025

View reviewed changes

sandhose reviewed Apr 10, 2025

View reviewed changes

changelog.d/18232.feature Outdated Show resolved Hide resolved

odelcroi requested a review from sandhose April 10, 2025 13:11

Update changelog.d/18232.feature

0aed597

Co-authored-by: Quentin Gliech <[email protected]>

odelcroi closed this Apr 10, 2025

odelcroi reopened this Apr 10, 2025

sandhose enabled auto-merge (squash) April 10, 2025 13:13

sandhose approved these changes Apr 10, 2025

View reviewed changes

github-actions bot deployed to PR Documentation Preview April 10, 2025 13:13 Active

sandhose merged commit dd05cc5 into element-hq:develop Apr 10, 2025
52 of 73 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add passthrough_authorization_parameters support to OIDC configuration #18232

Add passthrough_authorization_parameters support to OIDC configuration #18232

Uh oh!

odelcroi commented Mar 12, 2025 •

edited

Loading

Uh oh!

sandhose Apr 1, 2025

Uh oh!

odelcroi Apr 2, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

sandhose left a comment

Uh oh!

Uh oh!

odelcroi commented Apr 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add passthrough_authorization_parameters support to OIDC configuration #18232

Add passthrough_authorization_parameters support to OIDC configuration #18232

Uh oh!

Conversation

odelcroi commented Mar 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add passthrough_authorization_parameters support to OIDC configuration

Pull Request Checklist

Uh oh!

sandhose Apr 1, 2025

Choose a reason for hiding this comment

Uh oh!

odelcroi Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sandhose left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

odelcroi commented Apr 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

odelcroi commented Mar 12, 2025 •

edited

Loading

odelcroi Apr 2, 2025 •

edited

Loading