MSC2284: Making the identity server optional during discovery #2284

turt2live · 2019-09-06T02:24:56Z

jryans

This seems reasonable to me from a client perspective... The IS should (soon) be optional for all authentication flows, so it's only needed lazily for lookups and binding.

joepie91 · 2019-09-06T11:08:38Z

proposals/2284-optional-identity-server-discovery.md

+Clients can end up being configured with an invalid or inoperable identity server. This is
+considered a feature by this proposal to allow for less intelligent clients to have their
+identity server disabled. Intelligent clients could interpret the lack of identity server
+as the homeserver/user asking that identity server functionality be disabled in the client.


I feel like in the interest of infrastructure debuggability and general client UX, there should be a flag that indicates whether the identity server is intentionally disabled, so that intelligent clients can distinguish between this and an erroneous misconfiguration (or transient unavailability due to infrastructural issues).

I'm not sure I agree. In terms of transient unavailability, users won't be able to log in in the first place because the homeserver information will also be missing. Spelling errors, structural problems, etc are easily debugged by a community member in a support channel - the problem should be obvious. For instance, if you end up with a user experience that doesn't involve the identity server you were expecting, you can probably guess that it has to do with your config. Hopefully people these days are still testing their configuration changes before going live.

The other point for defaulting to no identity server instead of wanting an explicit flag is to protect user privacy. Where possible, the spec should be heavily suggesting to clients that a default identity server not be used. When the spec says that lack of useful identity server information means that none is selected, the client can't reasonably default to an identity server which might be risky to the user. Not to mention a flag saying "I absolutely don't want to use an identity server" is more fiddly to implement, particularly when the interaction between users and homeservers is already insanely complicated during login.

ara4n · 2019-09-06T12:50:54Z

This feels very sane indeed to me - we've been bitten multiple times by inexplicable client failures just because the IS was unavailable, and given an IS isn't even compulsory, an invalid IS shouldn't block anything.

As discussed in MSC2284, this relaxes the identity server discovery to a `FAIL_PROMPT` state so that clients can choose to warn and continue. Part of element-hq/element-web#11102 Implements matrix-org/matrix-spec-proposals#2284

turt2live · 2019-11-01T19:44:40Z

This seems largely accepted by the spec core team and surrounding teams, so to try and push it forward/get more feedback:

@mscbot fcp merge

mscbot · 2019-11-01T19:44:44Z

Team member @turt2live has proposed to merge this. The next step is review by the rest of the tagged people:

No concerns currently listed.

Once at least 75% of reviewers approve (and none object), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

KitsuneRal

I'm generally not a fan of adding prompts to UX but I agree that FAIL_ERROR is a bit too harsh and that client applications can do some further intelligence on whether/how they should interact with the user on the matter.

proposals/2284-optional-identity-server-discovery.md

mscbot · 2019-11-13T17:09:05Z

🔔 This is now entering its final comment period, as per the review above. 🔔

turt2live · 2019-11-18T17:11:20Z

hello @mscbot, it is time.

mscbot · 2019-11-18T17:14:20Z

The final comment period, with a disposition to merge, as per the review above, is now complete.

As discussed in MSC2284, this relaxes the identity server discovery to a `FAIL_PROMPT` state so that clients can choose to warn and continue. Part of element-hq/element-web#11102 Implements matrix-org/matrix-spec-proposals#2284

turt2live · 2021-05-02T04:31:12Z

Historical implementation on this is here: matrix-org/matrix-js-sdk#1062

Spec for #2284

turt2live · 2021-05-02T20:13:28Z

Merged 🎉

Spec for #2284

Proposal to make the identity server optional during discovery

738fa68

turt2live added the proposal A matrix spec change proposal label Sep 6, 2019

turt2live changed the title ~~Proposal to make the identity server optional during discovery~~ MSC2284: Making the identity server optional during discovery Sep 6, 2019

Assign number

6baeb6c

turt2live mentioned this pull request Sep 6, 2019

Spec violation: invalid identity server is seemingly quietly ignored element-hq/element-web#10763

Closed

turt2live added the proposal-in-review label Sep 6, 2019

jryans approved these changes Sep 6, 2019

View reviewed changes

joepie91 reviewed Sep 6, 2019

View reviewed changes

jryans mentioned this pull request Oct 9, 2019

Make the IS optional during discovery element-hq/element-web#11102

Closed

turt2live added phase:2 privacy-sprint Temporary label: privacy-related stuff labels Oct 9, 2019

jryans mentioned this pull request Nov 1, 2019

Relax identity server discovery checks to FAIL_PROMPT matrix-org/matrix-js-sdk#1062

Merged

mscbot added proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. disposition-merge labels Nov 1, 2019

turt2live added privacy-sprint Temporary label: privacy-related stuff and removed privacy-sprint Temporary label: privacy-related stuff proposal-in-review labels Nov 1, 2019

KitsuneRal approved these changes Nov 2, 2019

View reviewed changes

dbkr reviewed Nov 8, 2019

View reviewed changes

proposals/2284-optional-identity-server-discovery.md Show resolved Hide resolved

Add explanation

dcbdb94

mscbot added the final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. label Nov 13, 2019

mscbot removed the proposed-final-comment-period Currently awaiting signoff of a majority of team members in order to enter the final comment period. label Nov 13, 2019

mscbot added the finished-final-comment-period label Nov 18, 2019

mscbot removed the final-comment-period This MSC has entered a final comment period in interest to approval, postpone, or delete in 5 days. label Nov 18, 2019

turt2live merged commit f1ff31d into master Nov 18, 2019

turt2live deleted the travis/msc/optional-is-discover branch November 18, 2019 17:15

jryans mentioned this pull request Nov 26, 2019

Your Riot is misconfigured - Identity server URL does not appear to be a valid identity server element-hq/element-web#11508

Closed

turt2live added the kind:maintenance MSC which clarifies/updates existing spec label Apr 20, 2020

bmarty mentioned this pull request Aug 31, 2020

Login with mxid | Autodiscovery fails if identity server is invalid and Homeserver ok element-hq/element-android#2027

Closed

turt2live added spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec and removed finished-final-comment-period labels May 1, 2021

turt2live self-assigned this May 1, 2021

turt2live added a commit that referenced this pull request May 2, 2021

Downgrade identity server failure to FAIL_PROMPT instead of FAIL_ERROR

7458ce9

Spec for #2284

turt2live mentioned this pull request May 2, 2021

Downgrade identity server failure to FAIL_PROMPT instead of FAIL_ERROR #3169

Merged

turt2live added spec-pr-in-review A proposal which has been PR'd against the spec and is in review and removed spec-pr-missing Proposal has been implemented and is being used in the wild but hasn't yet been added to the spec labels May 2, 2021

turt2live added merged A proposal whose PR has merged into the spec! and removed spec-pr-in-review A proposal which has been PR'd against the spec and is in review labels May 2, 2021

richvdh pushed a commit that referenced this pull request Aug 23, 2021

Downgrade identity server failure to FAIL_PROMPT instead of FAIL_ERROR

2ff5591

Spec for #2284

richvdh pushed a commit that referenced this pull request Aug 27, 2021

Downgrade identity server failure to FAIL_PROMPT instead of FAIL_ERROR

49a5ca3

Spec for #2284

jonaharagon mentioned this pull request May 6, 2022

chat.privacytools.io / Riot tracking issue privacytools/services#17

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MSC2284: Making the identity server optional during discovery #2284

MSC2284: Making the identity server optional during discovery #2284

turt2live commented Sep 6, 2019 •

edited by babolivier

jryans left a comment

joepie91 Sep 6, 2019 •

edited

turt2live Nov 1, 2019

ara4n commented Sep 6, 2019

turt2live commented Nov 1, 2019

mscbot commented Nov 1, 2019 •

edited by erikjohnston

KitsuneRal left a comment

mscbot commented Nov 13, 2019

turt2live commented Nov 18, 2019

mscbot commented Nov 18, 2019

turt2live commented May 2, 2021

turt2live commented May 2, 2021

MSC2284: Making the identity server optional during discovery #2284

MSC2284: Making the identity server optional during discovery #2284

Conversation

turt2live commented Sep 6, 2019 • edited by babolivier

jryans left a comment

Choose a reason for hiding this comment

joepie91 Sep 6, 2019 • edited

Choose a reason for hiding this comment

turt2live Nov 1, 2019

Choose a reason for hiding this comment

ara4n commented Sep 6, 2019

turt2live commented Nov 1, 2019

mscbot commented Nov 1, 2019 • edited by erikjohnston

KitsuneRal left a comment

Choose a reason for hiding this comment

mscbot commented Nov 13, 2019

turt2live commented Nov 18, 2019

mscbot commented Nov 18, 2019

turt2live commented May 2, 2021

turt2live commented May 2, 2021

turt2live commented Sep 6, 2019 •

edited by babolivier

joepie91 Sep 6, 2019 •

edited

mscbot commented Nov 1, 2019 •

edited by erikjohnston