The OIDC code is quite hard to follow, but I have done my best to understand it. The flow I believe is as follows:
/_synapse/client/oidc/callback
The user logs in, and does the OIDC authentication part. They are sent to /_synapse/client/oidc/callback.
Synapse sees this, works out that the user doesn't exist yet (here).
Because user_consent_at_registration is true, the user is directed to /_synapse/client/new_user_consent in _get_url_for_next_new_user_step.
_redirect_to_next_new_user_step will store the mapped emails in the session object.
/_synapse/client/new_user_consent
The user is asked to consent, and does so.
Nothing terribly exciting happens to the session state but eventually a new url is generated via _get_url_for_next_new_user_step. Because the current stage passes in a session object, we are sent to /_synapse/client/sso_register.
/_synapse/client/sso_register
This calls register_sso_user, which looks at session.emails_to_use, rather than session.emails that was set in /_synapse/client/oidc/callback. emails_to_use is expected to be set during /_synapse/client/pick_username but because we define a localpart template already, we are never sent to this page.
The user is created with no bound emails because emails_to_use is not set.
Proposal
We should probably fall back to session.emails when session.emails_to_use has not been defined.
This issue has been migrated from #16317.
This is a bit of an edge case, so please bear with. The parameters are:
consent.user_consent_at_registration
in your config.localpart_template
,displayname_template
andemail_template
in the OIDC config so that users can automatically map their emails.When this is set, the mapped email is always ignored on registration. Specifically you'll get a log line like:
The OIDC code is quite hard to follow, but I have done my best to understand it. The flow I believe is as follows:
/_synapse/client/oidc/callback
/_synapse/client/oidc/callback
.user_consent_at_registration
istrue
, the user is directed to/_synapse/client/new_user_consent
in_get_url_for_next_new_user_step
._redirect_to_next_new_user_step
will store the mapped emails in the session object./_synapse/client/new_user_consent
_get_url_for_next_new_user_step
. Because the current stage passes in asession
object, we are sent to/_synapse/client/sso_register
./_synapse/client/sso_register
register_sso_user
, which looks atsession.emails_to_use
, rather thansession.emails
that was set in/_synapse/client/oidc/callback
.emails_to_use
is expected to be set during/_synapse/client/pick_username
but because we define a localpart template already, we are never sent to this page.emails_to_use
is not set.Proposal
We should probably fall back to
session.emails
whensession.emails_to_use
has not been defined.