synapse/handlers/auth.py
def validate_login(self, username, login_submission):
        """Authenticates the user for the /login API

        Also used by the user-interactive auth flow to validate
        m.login.password auth types.

        Args:
            username (str): username supplied by the user
            login_submission (dict): the whole of the login submission
                (including 'type' and other relevant fields)
        Returns:
            Deferred[str, func]: canonical user id, and optional callback
                to be called once the access token and device id are issued
        Raises:
            StoreError if there was a problem accessing the database
            SynapseError if there was a problem with the request
            LoginError if there was an authentication problem.
        """

        if username.startswith('@'):
            qualified_user_id = username
        else:
            qualified_user_id = UserID(
                username, self.hs.hostname
            ).to_string()

        login_type = login_submission.get("type")
        known_login_type = False

        # special case to check for "password" for the check_password interface
        # for the auth providers
        password = login_submission.get("password")
        if login_type == LoginType.PASSWORD:
            if not self._password_enabled:
                raise SynapseError(400, "Password login has been disabled.")
            if not password:
                raise SynapseError(400, "Missing parameter: password")

        for provider in self.password_providers:
            if (hasattr(provider, "check_password")
                    and login_type == LoginType.PASSWORD):
                known_login_type = True
                is_valid = yield provider.check_password(
                    qualified_user_id, password,
                )
                if is_valid:
                    defer.returnValue((qualified_user_id, None))

            if (not hasattr(provider, "get_supported_login_types")
                    or not hasattr(provider, "check_auth")):
                # this password provider doesn't understand custom login types
                continue

            supported_login_types = provider.get_supported_login_types()
            if login_type not in supported_login_types:
                # this password provider doesn't understand this login type
                continue

            known_login_type = True
            login_fields = supported_login_types[login_type]

            missing_fields = []
            login_dict = {}
            for f in login_fields:
                if f not in login_submission:
                    missing_fields.append(f)
                else:
                    login_dict[f] = login_submission[f]
            if missing_fields:
                raise SynapseError(
                    400, "Missing parameters for login type %s: %s" % (
                        login_type,
                        missing_fields,
                    ),
                )

            result = yield provider.check_auth(
                username, login_type, login_dict,
            )
            if result:
                if isinstance(result, str):
                    result = (result, None)
                defer.returnValue(result)

        if login_type == LoginType.PASSWORD:
            known_login_type = True

            canonical_user_id = yield self._check_local_password(
                qualified_user_id, password,
            )

            if canonical_user_id:
                defer.returnValue((canonical_user_id, None))

        if not known_login_type:
            raise SynapseError(400, "Unknown login type %s" % login_type)

        # unknown username or invalid password. We raise a 403 here, but note
        # that if we're doing user-interactive login, it turns all LoginErrors
        # into a 401 anyway.
        raise LoginError(
            403, "Invalid password",
            errcode=Codes.FORBIDDEN
        )
Authenticates the user for the /login API

        Also used by the user-interactive auth flow to validate
        m.login.password auth types.

        Args:
            username (str): username supplied by the user
            login_submission (dict): the whole of the login submission
                (including 'type' and other relevant fields)
        Returns:
            Deferred[str, func]: canonical user id, and optional callback
                to be called once the access token and device id are issued
        Raises:
            StoreError if there was a problem accessing the database
            SynapseError if there was a problem with the request
            LoginError if there was an authentication problem.
        
Authenticates the user for the /login API
Also used by the user-interactive auth flow to validate
m.login.password auth types.


Authenticates the user for the / login API Also used by the user - interactive auth flow to validate m . login . password auth types .
def validate_login(self, username, login_submission):
        if username.startswith('@'):
            qualified_user_id = username
        else:
            qualified_user_id = UserID(
                username, self.hs.hostname
            ).to_string()
        login_type = login_submission.get("type")
        known_login_type = False
        password = login_submission.get("password")
        if login_type == LoginType.PASSWORD:
            if not self._password_enabled:
                raise SynapseError(400, "Password login has been disabled.")
            if not password:
                raise SynapseError(400, "Missing parameter: password")
        for provider in self.password_providers:
            if (hasattr(provider, "check_password")
                    and login_type == LoginType.PASSWORD):
                known_login_type = True
                is_valid = yield provider.check_password(
                    qualified_user_id, password,
                )
                if is_valid:
                    defer.returnValue((qualified_user_id, None))
            if (not hasattr(provider, "get_supported_login_types")
                    or not hasattr(provider, "check_auth")):
                continue
            supported_login_types = provider.get_supported_login_types()
            if login_type not in supported_login_types:
                continue
            known_login_type = True
            login_fields = supported_login_types[login_type]
            missing_fields = []
            login_dict = {}
            for f in login_fields:
                if f not in login_submission:
                    missing_fields.append(f)
                else:
                    login_dict[f] = login_submission[f]
            if missing_fields:
                raise SynapseError(
                    400, "Missing parameters for login type %s: %s" % (
                        login_type,
                        missing_fields,
                    ),
                )
            result = yield provider.check_auth(
                username, login_type, login_dict,
            )
            if result:
                if isinstance(result, str):
                    result = (result, None)
                defer.returnValue(result)
        if login_type == LoginType.PASSWORD:
            known_login_type = True
            canonical_user_id = yield self._check_local_password(
                qualified_user_id, password,
            )
            if canonical_user_id:
                defer.returnValue((canonical_user_id, None))
        if not known_login_type:
            raise SynapseError(400, "Unknown login type %s" % login_type)
        raise LoginError(
            403, "Invalid password",
            errcode=Codes.FORBIDDEN
        )
def validate_login ( self , username , login_submission ) : if username . startswith ( '@' ) : qualified_user_id = username else : qualified_user_id = UserID ( username , self . hs . hostname ) . to_string ( ) login_type = login_submission . get ( "type" ) known_login_type = False password = login_submission . get ( "password" ) if login_type == LoginType . PASSWORD : if not self . _password_enabled : raise SynapseError ( 400 , "Password login has been disabled." ) if not password : raise SynapseError ( 400 , "Missing parameter: password" ) for provider in self . password_providers : if ( hasattr ( provider , "check_password" ) and login_type == LoginType . PASSWORD ) : known_login_type = True is_valid = yield provider . check_password ( qualified_user_id , password , ) if is_valid : defer . returnValue ( ( qualified_user_id , None ) ) if ( not hasattr ( provider , "get_supported_login_types" ) or not hasattr ( provider , "check_auth" ) ) : continue supported_login_types = provider . get_supported_login_types ( ) if login_type not in supported_login_types : continue known_login_type = True login_fields = supported_login_types [ login_type ] missing_fields = [ ] login_dict = { } for f in login_fields : if f not in login_submission : missing_fields . append ( f ) else : login_dict [ f ] = login_submission [ f ] if missing_fields : raise SynapseError ( 400 , "Missing parameters for login type %s: %s" % ( login_type , missing_fields , ) , ) result = yield provider . check_auth ( username , login_type , login_dict , ) if result : if isinstance ( result , str ) : result = ( result , None ) defer . returnValue ( result ) if login_type == LoginType . PASSWORD : known_login_type = True canonical_user_id = yield self . _check_local_password ( qualified_user_id , password , ) if canonical_user_id : defer . returnValue ( ( canonical_user_id , None ) ) if not known_login_type : raise SynapseError ( 400 , "Unknown login type %s" % login_type ) raise LoginError ( 403 , "Invalid password" , errcode = Codes . FORBIDDEN )
Authenticates the user for the /login API
Also used by the user-interactive auth flow to validate
m.login.password auth types.
Authenticates the user for the / login API Also used by the user - interactive auth flow to validate m . login . password auth types .
"""Authenticates the user for the /login API

        Also used by the user-interactive auth flow to validate
        m.login.password auth types.

        Args:
            username (str): username supplied by the user
            login_submission (dict): the whole of the login submission
                (including 'type' and other relevant fields)
        Returns:
            Deferred[str, func]: canonical user id, and optional callback
                to be called once the access token and device id are issued
        Raises:
            StoreError if there was a problem accessing the database
            SynapseError if there was a problem with the request
            LoginError if there was an authentication problem.
        """ # special case to check for "password" for the check_password interface # for the auth providers # this password provider doesn't understand custom login types # this password provider doesn't understand this login type # unknown username or invalid password. We raise a 403 here, but note # that if we're doing user-interactive login, it turns all LoginErrors # into a 401 anyway.
self
username
login_submission