From 1d6501b6ecae194e5b105c513bb412548f1d0ab6 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Thu, 29 Aug 2019 13:51:38 -0600 Subject: [PATCH 1/6] What if we allowed homeservers to deal with their own business? --- proposals/0000-id_server-now-optional.md | 57 ++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 proposals/0000-id_server-now-optional.md diff --git a/proposals/0000-id_server-now-optional.md b/proposals/0000-id_server-now-optional.md new file mode 100644 index 000000000..a066cf6ba --- /dev/null +++ b/proposals/0000-id_server-now-optional.md @@ -0,0 +1,57 @@ +# Proposal to make the `id_server` parameter on client-server APIs optional + +In order to better protect the privacy of of a user, Matrix is wanting to shift to +a model where identity servers have less control over the affairs of the homeserver. +Identity servers are currently used to reset the passwords of users on a given homeserver +as an identity verification technique, however there is no reason why the homeserver +itself can't handle the verification. This proposal allows for a homeserver to verify +the identity of users itself, without the use of an identity server. + +## Proposal + +The `id_server` parameter is to become optional on the following endpoints: + +* `/_matrix/client/:version/account/3pid/:medium/requestToken` +* `/_matrix/client/:version/register/:medium/requestToken` +* `/_matrix/client/:version/account/password/:medium/requestToken` + +The `id_server` parameter is additionally deprecated with intentions of being removed +in a future specification release on the `/register/:medium` and `/account/password/:medium` +endpoints. Once appropriate adoption has been achieved, the specification can safely +remove the parameter as supported. The reason for this deprecation is to completely +remove the identity server's ability to be involved in password resets/registration. +Users wishing to bind their 3rd party identifiers can do so after registration, and +clients can automate this if they so desire. + +Similarly, `bind_email` and `bind_msisdn` are deprecated with intentions to be removed +in a future specification version on `/register`. The flags have no effect if no `id_server` +is being used. + +As per [MSC2140](https://github.com/matrix-org/matrix-doc/pull/2140), an `id_access_token` +is required only if an `id_server` is supplied. + +Although not specified as required in the specification currently, the `id_server` +as part of User-Interactive Authentication is also optional if this proposal is accepted. +When the client requests a token without an `id_server`, it should not specify an +`id_server` in UIA. + +Homeservers can reuse HTTP 400 `M_SERVER_NOT_TRUSTED` as an error code on the `/requestToken` +endpoints listed above if they do not trust the identity server the user is supplying. + +In order to allow client implementations to determine if the homeserver they are developed +against supports `id_server` being optional, an unstable feature flag of `m.require_identity_server` +is to be added to `/versions`. When the flag is `false` or not present, clients must assume +that the homeserver requires an `id_server` (ie: it has not yet considered it optional). +If this proposal is accepted, clients are expected to use the supported specification versions +the homeserver advertises instead of the feature flag's presence. + +## Tradeoffs + +Homeservers may have to set up MSISDN/email support to their implementations. This is believed +to be of minimal risk compared to allowing the identity server to continue being involved +with password reset/registration. + +## Security considerations + +The identity server was previously involved with affairs only the homeserver cares about. +This is no longer the case. From 4e43024039e10ade0ec4e40b2396dcfa69b743b6 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Thu, 29 Aug 2019 13:54:53 -0600 Subject: [PATCH 2/6] Assign number --- ...0-id_server-now-optional.md => 2263-homeserver-pw-resets.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename proposals/{0000-id_server-now-optional.md => 2263-homeserver-pw-resets.md} (96%) diff --git a/proposals/0000-id_server-now-optional.md b/proposals/2263-homeserver-pw-resets.md similarity index 96% rename from proposals/0000-id_server-now-optional.md rename to proposals/2263-homeserver-pw-resets.md index a066cf6ba..8db52572d 100644 --- a/proposals/0000-id_server-now-optional.md +++ b/proposals/2263-homeserver-pw-resets.md @@ -1,4 +1,4 @@ -# Proposal to make the `id_server` parameter on client-server APIs optional +# MSC2263: Give homeservers the ability to handle their own 3PID registrations/password resets In order to better protect the privacy of of a user, Matrix is wanting to shift to a model where identity servers have less control over the affairs of the homeserver. From 6d5e90b1d6d01aef3afa2e630222007b4e281bb4 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Thu, 29 Aug 2019 14:51:32 -0600 Subject: [PATCH 3/6] Apply suggestions from code review Co-Authored-By: Matthew Hodgson --- proposals/2263-homeserver-pw-resets.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/proposals/2263-homeserver-pw-resets.md b/proposals/2263-homeserver-pw-resets.md index 8db52572d..1bb55da0d 100644 --- a/proposals/2263-homeserver-pw-resets.md +++ b/proposals/2263-homeserver-pw-resets.md @@ -1,6 +1,6 @@ # MSC2263: Give homeservers the ability to handle their own 3PID registrations/password resets -In order to better protect the privacy of of a user, Matrix is wanting to shift to +In order to better protect the privacy of a user, Matrix is wanting to shift to a model where identity servers have less control over the affairs of the homeserver. Identity servers are currently used to reset the passwords of users on a given homeserver as an identity verification technique, however there is no reason why the homeserver @@ -15,7 +15,7 @@ The `id_server` parameter is to become optional on the following endpoints: * `/_matrix/client/:version/register/:medium/requestToken` * `/_matrix/client/:version/account/password/:medium/requestToken` -The `id_server` parameter is additionally deprecated with intentions of being removed +The `id_server` parameter is additionally deprecated with intention of being removed in a future specification release on the `/register/:medium` and `/account/password/:medium` endpoints. Once appropriate adoption has been achieved, the specification can safely remove the parameter as supported. The reason for this deprecation is to completely @@ -23,7 +23,7 @@ remove the identity server's ability to be involved in password resets/registrat Users wishing to bind their 3rd party identifiers can do so after registration, and clients can automate this if they so desire. -Similarly, `bind_email` and `bind_msisdn` are deprecated with intentions to be removed +Similarly, `bind_email` and `bind_msisdn` are deprecated with intention to be removed in a future specification version on `/register`. The flags have no effect if no `id_server` is being used. From 1a6eb9a4131a0683f095c142934bc45b8a2a71ad Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Thu, 29 Aug 2019 15:19:12 -0600 Subject: [PATCH 4/6] Update proposals/2263-homeserver-pw-resets.md Co-Authored-By: J. Ryan Stinnett --- proposals/2263-homeserver-pw-resets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proposals/2263-homeserver-pw-resets.md b/proposals/2263-homeserver-pw-resets.md index 1bb55da0d..564d1e453 100644 --- a/proposals/2263-homeserver-pw-resets.md +++ b/proposals/2263-homeserver-pw-resets.md @@ -40,7 +40,7 @@ endpoints listed above if they do not trust the identity server the user is supp In order to allow client implementations to determine if the homeserver they are developed against supports `id_server` being optional, an unstable feature flag of `m.require_identity_server` -is to be added to `/versions`. When the flag is `false` or not present, clients must assume +is to be added to `/versions`. When the flag is `true` or not present, clients must assume that the homeserver requires an `id_server` (ie: it has not yet considered it optional). If this proposal is accepted, clients are expected to use the supported specification versions the homeserver advertises instead of the feature flag's presence. From b36fe24f1b719d8650de39187f112ebe0fada041 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Fri, 30 Aug 2019 08:27:44 -0600 Subject: [PATCH 6/6] Let's not doubly remove things --- proposals/2263-homeserver-pw-resets.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/proposals/2263-homeserver-pw-resets.md b/proposals/2263-homeserver-pw-resets.md index 564d1e453..3b58af172 100644 --- a/proposals/2263-homeserver-pw-resets.md +++ b/proposals/2263-homeserver-pw-resets.md @@ -23,9 +23,8 @@ remove the identity server's ability to be involved in password resets/registrat Users wishing to bind their 3rd party identifiers can do so after registration, and clients can automate this if they so desire. -Similarly, `bind_email` and `bind_msisdn` are deprecated with intention to be removed -in a future specification version on `/register`. The flags have no effect if no `id_server` -is being used. +Note that `bind_email` and `bind_msisdn` on `/register` have already been removed +by [MSC2140](https://github.com/matrix-org/matrix-doc/pull/2140). As per [MSC2140](https://github.com/matrix-org/matrix-doc/pull/2140), an `id_access_token` is required only if an `id_server` is supplied.