Matrix Authentication Service (MAS)installation fails when migrating from oidc enabled server

[tiran133]

Describe the bug
MAS installation fails when following config is used

To Reproduce
My vars.yml file looks like this:

matrix_authentication_service_enabled: true
matrix_authentication_service_migration_in_progress: true
matrix_synapse_oidc_enabled: true

The issue is the validation

matrix-docker-ansible-deploy/roles/custom/matrix-synapse/tasks/validate_config.yml

Lines 186 to 189 in 93e45e6

	- name: Fail if OpenID Connect is enabled for Synapse when auth is delegated to Matrix Authentication Service
	ansible.builtin.fail:
	msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable OpenID Connect (`matrix_synapse_oidc_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
	when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_oidc_enabled

Expected behavior
The MAS installation should go through since it will not be activated because of matrix_authentication_service_migration_in_progress: true

Possible fix

validate_config.yml

- name: Fail if OpenID Connect is enabled for Synapse when auth is delegated to Matrix Authentication Service
  ansible.builtin.fail:
    msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable OpenID Connect (`matrix_synapse_oidc_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."
  when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_oidc_enabled and not matrix_authentication_service_migration_in_progress

homeserver.yaml.j2

{% if matrix_synapse_matrix_authentication_service_enabled and not matrix_authentication_service_migration_in_progress %}
matrix_authentication_service:
  enabled: true
  endpoint: {{ matrix_synapse_matrix_authentication_service_endpoint | to_json }}
  secret: {{ matrix_synapse_matrix_authentication_service_secret | to_json }}
{% endif %}

[aaujon]

Hi,

I encountered the same issue.
If matrix_synapse_oidc_enabled is false, the migration fails because the provider is not found in homeserver.yaml file.
I tryed the first proposed fix, it is better but matrix-synapse fails to start with this configuration because it can't work with synapse oidc and MAS.
But 'just run-tags matrix-authentication-service-mas-cli-syn2mas -e matrix_authentication_service_syn2mas_migrate_dry_run=true' runs well.
Real migration fails at the end because it want to start synapse (which doesn't start).
Fixing the configuration after that (remove old oidc conf) and running the playbook again make everything OK.

Another solution, would be to generate a new homeserver.yaml file with the oidc providers to allow migration to works by referecing to this new file instead of the real homeserver.yaml file.

[unsolaci]

I just hit the same issue and can confirm that the proposed fix worked and allowed me to successfully proceed with the syn2mas migration.