This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

فارسی · Components · Home

Authentication

How people log in, the admin panels, and the antispam module.

How to add any of these: Components.

MAS or a password provider, not both. With MAS, MAS handles every login, so Synapse's own password providers (REST auth, Shared Secret Auth, LDAP auth, and Matrix Corporal, which uses two of them) can't run. Review stops the deploy if both are ticked. MAS can't be switched on or off once the server is installed, so choose before the first deploy.

Matrix Authentication Service (MAS)

Synapse only. Takes over logins and accounts: the sign-in page, sessions, and sign-up. Element X, the new Element phone app, needs it. Every Synapse preset ticks it.

Settings: none.

After deploy: apps send people to a sign-in page on matrix.example.org, then back. Add accounts with Manage › Add a user (a). To let people sign up by themselves, Manage › Open registration (g) makes a sign-up token; give it to the people you want in, and close it again whenever you like.

Good to know: with MAS on, it can't be turned off later without locking everyone out, and turning it on for a server that already has users needs a migration (the playbook's syn2mas). interzone stops both. Playbook doc

Appservice Double Puppet

For bridges. Without it, a message you send on Telegram itself shows up in the Matrix room as sent by a stand-in "Telegram user", not by you. With it, it shows as yours, and read receipts sync too.

Settings: none. After deploy: nothing; every bridge that supports it uses it. Playbook doc

Ketesa admin panel

Synapse only. An admin panel in the browser: users (create, reset passwords, deactivate), rooms, media, reports, sessions.

Settings: none. No DNS of its own.

After deploy: open https://matrix.example.org/synapse-admin, and sign in with your admin account. Only server admins can use it; make someone one with Manage › Manage users (m). Playbook doc

Element Admin

Element's own admin web app. Younger than Ketesa, with fewer features, and made for servers with MAS.

DNS: admin.element.example.org.

After deploy: open https://admin.element.example.org and sign in with your admin account. Playbook doc

REST auth password provider

Synapse only, not with MAS. Checks usernames and passwords against a web service you run yourself, for when your accounts already live in another system.

Settings: Endpoint URL: your service's address. It has to speak the REST auth protocol. Playbook doc

Shared Secret Auth

Synapse only, not with MAS. Lets a program that knows a secret log in as any user. Some older bridges and Matrix Corporal use it; bridges today use Appservice Double Puppet instead.

Settings: Shared secret: made up for you; ctrl+r shows it. Playbook doc

LDAP auth password provider

Synapse only, not with MAS. People log in with their accounts from an LDAP directory (Active Directory, OpenLDAP…), and their Matrix account is made on first login.

Settings:

• LDAP URIs: e.g. ldaps://ldap.example.org:636, comma-separated if more than one.
• Use StartTLS: on for ldap:// addresses; off with ldaps://.
• Base DN: where the accounts are, e.g. ou=users,dc=example,dc=org.
• UID / Mail / Name attribute: which LDAP attributes hold the username, email and display name. The defaults (uid, mail, cn) suit OpenLDAP; Active Directory uses sAMAccountName for the username.
• Bind DN and Bind password: an account allowed to search the directory, if it doesn't allow anonymous searches. Playbook doc

Synapse Simple Antispam

Synapse only. Drops invites from the servers you list, the usual source of invite spam.

Settings: Blocked homeservers: their names, comma-separated, e.g. spam.example.com, badserver.net. Playbook doc

User Verification Service

Lets a Jitsi server check that whoever joins a call is really a member of the Matrix room it belongs to.

Settings:

• Access token of a bot user: make an account for it with Manage › Add a user (a), sign in with it in Element, and copy its token from Settings › Help & About › Advanced › Access Token. Don't sign that session out.
• Auth token: made up for you.

After deploy: for the playbook's own Jitsi to use it, Jitsi needs its Matrix login turned on: see the Jitsi doc's Matrix section and add those lines under Advanced on Settings. Playbook doc