SSO Support (also needed for ElementOne)

[ceearrbee]

SSO as the login method for servers is becoming popular - such as with Mozilla's, is there any likelihood of this being implemented anytime soon?

[alphapapa]

Hi,

I don't use SSO, so I don't plan to implement it myself (unless someone wanted to sponsor it in some way). But, patches welcome, and I'll be glad to help integrate it. :)

[Necronian]

After talking to alphapapa in matrix I wrote the following which could be a helpful jumping off point for integrating sso. According to https://matrix.org/docs/guides/sso-for-client-developers the server should support m.login.sso and m.login.token.

(defun necronian-ement-sso-api (data)
  (let* ((id (cdr (assq 'user_id data)))
         (username (save-match-data
                     (string-match "@\\(.*\\):.*" id)
                     (match-string 1 id)))
         (server (cdr (assq 'home_server data)))
         (uri-prefix (cdr (assq 'base_url
                                (cdr (assq 'm\.homeserver
                                           (cdr (assq 'well_known data)))))))
         (token (cdr (assq 'access_token data))))
    (ement-connect
     :session (make-ement-session
               :user (make-ement-user :id id :username username)
               :server (make-ement-server :name server
                                          :uri-prefix uri-prefix)
               :token token
               :events (make-hash-table :test #'equal)
               :transaction-id 0))))

(defun sso-login (uri-prefix proc msg)
  (let* ((token (save-match-data
                  (string-match "GET /\\?loginToken=\\(.*\\)\s.*" msg)
                  (match-string 1 msg)))
         (login-data (ement-alist "type" "m.login.token"
                                  "token" token)))
    (ement-api (make-ement-session
                :server (make-ement-server :uri-prefix uri-prefix))
      "login"
      :then #'necronian-ement-sso-api
      :method 'post
      :data (json-encode login-data))
    (delete-process "ement-sso")))

(defun necronian-ement-sso (uri-prefix &optional local-port)
  (make-network-process
   :name "ement-sso"
   :family 'ipv4
   :host "localhost"
   :service (or local-port 4567)
   :filter (apply-partially #'sso-login uri-prefix)
   :server t)
  (browse-url (concat uri-prefix
                      "/_matrix/client/r0/login/sso/redirect?redirectUrl=http://localhost:"
                      (number-to-string (or local-port 4567)))))

Calling (necronian-ement-sso "<homeserver-url>") should open a browser and navigate to your sso page. Log in as you would usually and ement should log in to your server.

[alphapapa]

Thanks, that is very helpful.

[wehlutyk]

This looks great! Does it have a chance of working through pantalaimon? My understanding is pantalaimon handles the login when I use it, as I don't inform ement of the home server pantalaimon is proxying to.

[alphapapa]

This looks great! Does it have a chance of working through pantalaimon? My understanding is pantalaimon handles the login when I use it, as I don't inform ement of the home server pantalaimon is proxying to.

I have no idea, since I don't use Pantalaimon myself. If you could find out and report back, that would be helpful. :)

[oneingan]

Trying this with (necronian-ement-sso "https://one.element.io")

and after sign-in into browser, emacs fails with:

#<process firefox https://one.element.io/_matrix/client/r0/login/sso/redirect?redirectUrl=http://localhost:4567>
Ement: Sync request sent, waiting for response...
Ement: Response arrived after 10.88 seconds.  Reading 2.5M JSON response...
Ement: Reading JSON took 0.85 seconds
Ement: Reading events...66% 
Ement: Sync request sent, waiting for response...
error in process sentinel: let: HTTP error
error in process sentinel: HTTP error
error in process sentinel: let: HTTP error
error in process sentinel: HTTP error [59 times]
Ement: Response arrived after 30.22 seconds.  Reading 751 JSON response...
Ement: Reading JSON took 0.00 seconds
Ement: Reading events... 
Ement: Sync request sent, waiting for response...
error in process sentinel: run-hook-with-args: Symbol’s function definition is void: ement-room-list-auto-update
error in process sentinel: Symbol’s function definition is void: ement-room-list-auto-update
error in process sentinel: HTTP error [58 times]
Ement: Response arrived after 30.18 seconds.  Reading 751 JSON response...
Ement: Reading JSON took 0.00 seconds
Ement: Reading events... 
Ement: Sync request sent, waiting for response...
error in process sentinel: run-hook-with-args: Symbol’s function definition is void: ement-room-list-auto-update
error in process sentinel: Symbol’s function definition is void: ement-room-list-auto-update
error in process sentinel: HTTP error [30 times]
error in process sentinel: Symbol’s function definition is void: ement-room-list-auto-update [2 times]
(...)

can you point me how to debug this error?
ping: @Necronian

[Necronian]

Honestly, my elisp is not very good so I'm not sure if I can help.

To start this code will always be brittle since ement doesn't really have an interface for users to create/initialize a new session. We create the session struct ourselves and need to make sure we initialize it correctly with the information ement is expecting. That has changed slightly since my last post. This is what I'm using now, which I know fixes some issues.

(defun necronian-ement-sso-api (data)
  (let* ((id (cdr (assq 'user_id data)))
         (username (save-match-data
                     (string-match "@\\(.*\\):.*" id)
                     (match-string 1 id)))
         (server (cdr (assq 'home_server data)))
         (uri-prefix (cdr (assq 'base_url
                                (cdr (assq 'm\.homeserver
                                           (cdr (assq 'well_known data)))))))
         (token (cdr (assq 'access_token data))))
    (ement-connect
     :session (make-ement-session
               :user (make-ement-user :id id
                                      :username username
                                      :room-display-names (make-hash-table))
               :server (make-ement-server :name server
                                          :uri-prefix uri-prefix)
               :token token
               :events (make-hash-table :test #'equal)
               :transaction-id (ement--initial-transaction-id)))))

(defun sso-login (uri-prefix proc msg)
  (let* ((token (save-match-data
                  (string-match "GET /\\?loginToken=\\(.*\\)\s.*" msg)
                  (match-string 1 msg)))
         (login-data (ement-alist "type" "m.login.token"
                                  "token" token)))
    (ement-api (make-ement-session
                :server (make-ement-server :uri-prefix uri-prefix))
      "login"
      :then #'necronian-ement-sso-api
      :method 'post
      :data (json-encode login-data))
    (delete-process "ement-sso")))

(defun necronian-ement-sso (uri-prefix &optional local-port)
  (make-network-process
   :name "ement-sso"
   :family 'ipv4
   :host "localhost"
   :service (or local-port 4567)
   :filter (apply-partially #'sso-login uri-prefix)
   :server t)
  (browse-url (concat uri-prefix
                      "/_matrix/client/r0/login/sso/redirect?redirectUrl=http://localhost:"
                      (number-to-string (or local-port 4567)))))

[oneingan]

Thank you so much for your fast reply. Sadly your updated SSO code is not working for me neither. At least I expect to revive this thread and some elisp expert could help in the future. I'll keep trying.

[alphapapa]

Juanjo, please be specific about what you did and what happened. Just saying that it didn't work isn't helpful.

…

On Sun, Apr 17, 2022, 14:25 Juanjo Presa ***@***.***> wrote: Thank you so much for your fast reply. Sadly your updated SSO code is not working for me neither. At least I expect to revive this thread and some elisp expert could help in the future. I'll keep trying. — Reply to this email directly, view it on GitHub <#24 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAES2FK3JH3VX2FG3PZGNLDVFRQTVANCNFSM5CCSEWJQ> . You are receiving this because you were assigned.Message ID: ***@***.***>