element-hq/matrix-authentication-service v0.15.0

on GitHub

Upgrade notes

This update adds many database indexes, which can take time on larger deployments. It is advised to first run the database migrations before rolling out the new version, using mas-cli database migrate

Docker image

Regular image:

• Digest:

  ghcr.io/element-hq/matrix-authentication-service@sha256:c4853e7a553d85f22ece68ba9f2751523abcb746c5cf6e189c15f04709a3d433
  

• Tags:

  ghcr.io/element-hq/matrix-authentication-service:0.15.0
  ghcr.io/element-hq/matrix-authentication-service:0.15
  ghcr.io/element-hq/matrix-authentication-service:0
  ghcr.io/element-hq/matrix-authentication-service:sha-2daa9bf
  ghcr.io/element-hq/matrix-authentication-service:latest
  

Debug variant:

• Digest:

  ghcr.io/element-hq/matrix-authentication-service@sha256:8a5ebf8d0dbf7085af712616879a1cd17e918dfaf5fc8c81a96ab3cd22b1cbed
  

• Tags:

  ghcr.io/element-hq/matrix-authentication-service:0.15.0-debug
  ghcr.io/element-hq/matrix-authentication-service:0.15-debug
  ghcr.io/element-hq/matrix-authentication-service:0-debug
  ghcr.io/element-hq/matrix-authentication-service:sha-2daa9bf-debug
  ghcr.io/element-hq/matrix-authentication-service:latest-debug
  

syn2mas migration tool:

• Digest:

  ghcr.io/element-hq/matrix-authentication-service/syn2mas@sha256:61aba2f09e759257376a83b6cbf1683109f5b186c82e49b0dfdd6ea1b91384d1
  

• Tags:

  ghcr.io/element-hq/matrix-authentication-service/syn2mas:0.15.0
  ghcr.io/element-hq/matrix-authentication-service/syn2mas:0.15
  ghcr.io/element-hq/matrix-authentication-service/syn2mas:0
  ghcr.io/element-hq/matrix-authentication-service/syn2mas:sha-2daa9bf
  ghcr.io/element-hq/matrix-authentication-service/syn2mas:latest
  

What's Changed

Bug Fixes

• Fix the HTTP status code for the user creation admin endpoint by @sandhose in #4040
• Fix upstream OAuth 2.0 callbacks using the form_post method by @sandhose in #4057
• Fix some old Synapse access tokens not being recognised by @sandhose in #4093
• Allow compat session devices to have spaces by @sandhose in #4067
• Don't delete devices marked as dehydrated devices by @uhoreg in #4268
• Support database poolers: clean up LISTEN/NOTIFY state when opening a connection by @sandhose in #4367
• Clear the session cookie on logout from the GraphQL API by @sandhose in #4328
• Create missing indexes for all the foreign keys in the database. by @sandhose in #4385
• Fix starting up when no telemetry config is set by @sandhose in #4437

New Features

• Allow banning IPs and user agents through the policy by @sandhose in #4048
• Convert IPv6-mapped IPv4 addresses to IPv4 addresses by @sandhose in #4058
• Only show the password change section if the user has a password by @sandhose in #4100
• Support for allowing/banning specific username patterns during registration by @sandhose in #4131
• Allow configuring a 'read-only' connection to the homeserver by @sandhose in #4145
• Handle AS users with invalid localparts edge case by @sandhose in #4133
• Require confirming account password before changing account emails by @sandhose in #4158
• Align user deactivation behaviour with Synapse by @sandhose in #4197
• Better feedback on failure cases during login by @sandhose in #4198
• Allow users to deactivate their own account in the UI by @sandhose in #4209
• Observe metrics from the Tokio runtime by @sandhose in #4284
• Deduplicate client registrations by hashing the metadata by @sandhose in #4293
• Record auth related metrics by @sandhose in #4301
• Expose more Sentry configuration by @sandhose in #4352
• compat login: support using client-provided device ID by @reivilibre in #4342
• Allow logging in using an email address by @mcalinghee in #4337
• Always ask for consent, never for reauth by @sandhose in #4386
• Lookup usernames case insensitively by @sandhose in #4378

Changes to the admin API

• Admin API to add and delete user email addresses by @sandhose in #4039
• Admin API to dynamically set policy data by @sandhose in #4115
• Admin API for adding and removing upstream oauth links by @tonkku107 in #4255

Documentation

• Disable Verification for Microsoft Azure AD OIDC config example by @kieranlane in #4258
• Document how to setup Discord as upstream OAuth 2.0 provider, add missing token_endpoint_auth_method field in GitHub sample config by @ChurchOfTheSubgenius in #4310
• Document how to migrate passwords from Synapse with a pepper set by @speatzle in #4353

Translations

• Translations updates for main by @matrixbot in #4356
• Translations updates for main by @matrixbot in #4377
• Translations updates for main by @matrixbot in #4406
• Translations updates for main by @matrixbot in #4407
• Translations updates for v0.15 by @matrixbot in #4438

Internal Changes

• Automatic merge back to main by @matrixbot in #4035
• Automatic merge back to main by @matrixbot in #4056
• Automatic merge back to main by @matrixbot in #4070
• Allow logging in using the deprecated 'user' property on the compat login API by @sandhose in #4075
• Remove warnings about password auth not being feature complete by @wrjlewis in #4106
• Trigger the build workflow on PRs with a label by @sandhose in #4119
• Remove spuriuous ICU errors from the logs by @sandhose in #4132
• Ignore guest devices and empty IPs when migrating from Synapse by @sandhose in #4121
• Pass the MasWriter as owned to the various migration functions by @sandhose in #4120
• Properly ignore devices, threepids and access tokens from AS users by @sandhose in #4122
• Adjust the jobs retry delays and number of attempts by @sandhose in #4169
• Ignore RUSTSEC-2024-0436 and RUSTSEC-2024-0437 for now by @sandhose in #4172
• Properly accumulate form errors on the upstream register page by @sandhose in #4173
• syn2mas: better performance, output tweaks, tracing tweaks, access token fixes by @reivilibre in #4175
• Order the OAuth providers in the UI by their order in the config file by @sandhose in #4199
• syn2mas: disable logging of slow statements, better access token query perf by @reivilibre in #4208
• syn2mas: Add progress reporting to log and to opentelemetry metrics by @reivilibre in #4215
• Add expires_in to introspection responses by @reivilibre in #4241
• syn2mas: use ChaCha20 for all operations by @reivilibre in #4256
• syn2mas: Synapse configuration fixes by @reivilibre in #4266
• syn2mas: remove obsolete TODOs by @reivilibre in #4267
• Use automatic route code splitting by @sandhose in #4290
• Replace data-encoding with base64ct by @sandhose in #4294
• Speed up local docker rebuilds & CI cache exports by @sandhose in #4289
• Update governor to 0.10.0 by @sandhose in #4302
• syn2mas: Track skipped entities in the syn2mas progress by @reivilibre in #4225
• Allow requests to the compat login endpoint without a Content-Type header by @sandhose in #4369
• Fallback link in password recovery emails by @sandhose in #4375
• Allow database tests to run in parallel again by @sandhose in #4405

New Contributors

• @kieranlane made their first contribution in #4258
• @uhoreg made their first contribution in #4268
• @mcalinghee made their first contribution in #4337
• @speatzle made their first contribution in #4353

Full Changelog: v0.14.1...v0.15.0