dandri/synapse
1
0 Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2026-11-04 15:37:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

deploy: fe69e7f617

Browse Source
This commit is contained in:
clokep committed 2023-09-06 18:33:34 +00:00
1 parent 4431f805b1
commit b8bd769571
4 files changed
+78 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

develop/print.html
+38 -14
View File
@@ -6602,27 +6602,50 @@ claim MUST contain &quot;admin&quot;.</p>
<p>Enable Central Authentication Service (CAS) for registration and login.
Has the following sub-options:</p>
<ul>
<li><code>enabled</code>: Set this to true to enable authorization against a CAS server.
Defaults to false.</li>
<li><code>idp_name</code>: A user-facing name for this identity provider, which is used to
offer the user a choice of login mechanisms.</li>
<li><code>idp_icon</code>: An optional icon for this identity provider, which is presented
<li>
<p><code>enabled</code>: Set this to true to enable authorization against a CAS server.
Defaults to false.</p>
</li>
<li>
<p><code>idp_name</code>: A user-facing name for this identity provider, which is used to
offer the user a choice of login mechanisms.</p>
</li>
<li>
<p><code>idp_icon</code>: An optional icon for this identity provider, which is presented
by clients and Synapse's own IdP picker page. If given, must be an
MXC URI of the format <code>mxc://&lt;server-name&gt;/&lt;media-id&gt;</code>. (An easy way to
obtain such an MXC URI is to upload an image to an (unencrypted) room
and then copy the &quot;url&quot; from the source of the event.)</li>
<li><code>idp_brand</code>: An optional brand for this identity provider, allowing clients
and then copy the &quot;url&quot; from the source of the event.)</p>
</li>
<li>
<p><code>idp_brand</code>: An optional brand for this identity provider, allowing clients
to style the login flow according to the identity provider in question.
See the <a href="https://spec.matrix.org/latest/">spec</a> for possible options here.</li>
<li><code>server_url</code>: The URL of the CAS authorization endpoint.</li>
<li><code>protocol_version</code>: The CAS protocol version, defaults to none (version 3 is required if you want to use &quot;required_attributes&quot;).</li>
<li><code>displayname_attribute</code>: The attribute of the CAS response to use as the display name.
If no name is given here, no displayname will be set.</li>
<li><code>required_attributes</code>: It is possible to configure Synapse to only allow logins if CAS attributes
See the <a href="https://spec.matrix.org/latest/">spec</a> for possible options here.</p>
</li>
<li>
<p><code>server_url</code>: The URL of the CAS authorization endpoint.</p>
</li>
<li>
<p><code>protocol_version</code>: The CAS protocol version, defaults to none (version 3 is required if you want to use &quot;required_attributes&quot;).</p>
</li>
<li>
<p><code>displayname_attribute</code>: The attribute of the CAS response to use as the display name.
If no name is given here, no displayname will be set.</p>
</li>
<li>
<p><code>required_attributes</code>: It is possible to configure Synapse to only allow logins if CAS attributes
match particular values. All of the keys given below must exist
and the values must match the given value. Alternately if the given value
is <code>None</code> then any value is allowed (the attribute just must exist).
All of the listed attributes must match for the login to be permitted.</li>
All of the listed attributes must match for the login to be permitted.</p>
</li>
<li>
<p><code>enable_registration</code>: set to 'false' to disable automatic registration of new
users. This allows the CAS SSO flow to be limited to sign in only, rather than
automatically registering users that have a valid SSO login but do not have
a pre-registered account. Defaults to true.</p>
<p><em>Added in Synapse 1.93.0.</em></p>
</li>
</ul>
<p>Example configuration:</p>
<pre><code class="language-yaml">cas_config:
@@ -6633,6 +6656,7 @@ All of the listed attributes must match for the login to be permitted.</li>
required_attributes:
userGroup: &quot;staff&quot;
department: None
enable_registration: true
</code></pre>
<hr />
<h3 id="sso"><a class="header" href="#sso"><code>sso</code></a></h3>
develop/searchindex.js
+1 -1
View File
@@ -1 +1 @@
Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-generate_short_term_login_token-module-api-method","upgrade.html#changes-to-the-events-received-by-application-services-interest","upgrade.html#legacy-prometheus-metric-names-are-now-disabled-by-default","upgrade.html#upgrading-to-v1690","upgrade.html#changes-to-the-receipts-replLine truncated
Object.assign(window.search, {"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-generate_short_term_login_token-module-api-method","upgrade.html#changes-to-the-events-received-by-application-services-interest","upgrade.html#legacy-prometheus-metric-names-are-now-disabled-by-default","upgrade.html#upgrading-to-v1690","upgrade.html#changes-to-the-receipts-replLine truncated
develop/searchindex.json
+1 -1
View File
@@ -1 +1 @@
{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-generate_short_term_login_token-module-api-method","upgrade.html#changes-to-the-events-received-by-application-services-interest","upgrade.html#legacy-prometheus-metric-names-are-now-disabled-by-default","upgrade.html#upgrading-to-v1690","upgrade.html#changes-to-the-receipts-replication-streams","upgrade.htmLine truncated
{"doc_urls":["welcome_and_overview.html#introduction","welcome_and_overview.html#installing-and-using-synapse","welcome_and_overview.html#developing-on-synapse","welcome_and_overview.html#donating-to-synapse-development","welcome_and_overview.html#reporting-a-security-vulnerability","setup/installation.html#installation-instructions","setup/installation.html#choosing-your-server-name","setup/installation.html#installing-synapse","setup/installation.html#prebuilt-packages","setup/installation.html#installing-as-a-python-module-from-pypi","setup/installation.html#setting-up-synapse","setup/installation.html#using-postgresql","setup/installation.html#tls-certificates","setup/installation.html#client-well-known-uri","setup/installation.html#email","setup/installation.html#registering-a-user","setup/installation.html#setting-up-a-turn-server","setup/installation.html#url-previews","setup/installation.html#troubleshooting-installation","postgres.html#using-postgres","postgres.html#install-postgres-client-libraries","postgres.html#set-up-database","postgres.html#synapse-config","postgres.html#tuning-postgres","postgres.html#porting-from-sqlite","postgres.html#overview","postgres.html#using-the-port-script","postgres.html#troubleshooting","postgres.html#alternative-auth-methods","postgres.html#fixing-incorrect-collate-or-ctype","postgres.html#fixing-inconsistent-sequences-error","reverse_proxy.html#using-a-reverse-proxy-with-synapse","reverse_proxy.html#homeserver-configuration","reverse_proxy.html#reverse-proxy-configuration-examples","reverse_proxy.html#nginx","reverse_proxy.html#caddy-v2","reverse_proxy.html#apache","reverse_proxy.html#haproxy","reverse_proxy.html#relayd","reverse_proxy.html#health-check-endpoint","reverse_proxy.html#synapse-administration-endpoints","setup/forward_proxy.html#using-a-forward-proxy-with-synapse","setup/forward_proxy.html#configure","setup/forward_proxy.html#connection-types","setup/forward_proxy.html#troubleshooting","turn-howto.html#overview","turn-howto.html#requirements","turn-howto.html#synapse-setup","turn-howto.html#troubleshooting","setup/turn/coturn.html#coturn-turn-server","setup/turn/coturn.html#coturn-setup","setup/turn/coturn.html#initial-installation","setup/turn/coturn.html#configuration","setup/turn/eturnal.html#eturnal-turn-server","setup/turn/eturnal.html#eturnal-setup","setup/turn/eturnal.html#initial-installation","setup/turn/eturnal.html#configuration","setup/turn/eturnal.html#eturnalctl-opterations-script","delegate.html#delegation-of-incoming-federation-traffic","delegate.html#well-known-delegation","delegate.html#external-server","delegate.html#serving-a-well-knownmatrixserver-file-with-synapse","delegate.html#srv-dns-record-delegation","delegate.html#delegation-faq","delegate.html#when-do-i-need-delegation","delegate.html#should-i-use-a-reverse-proxy-for-federation-traffic","upgrade.html#upgrading-synapse","upgrade.html#rolling-back-to-older-versions","upgrade.html#upgrading-to-v1930","upgrade.html#minimum-supported-rust-version","upgrade.html#upgrading-to-v1900","upgrade.html#app-service-query-parameter-authorization-is-now-a-configuration-option","upgrade.html#upgrading-to-v1890","upgrade.html#removal-of-unspecced-user-property-for-register","upgrade.html#upgrading-to-v1880","upgrade.html#minimum-supported-python-version","upgrade.html#removal-of-worker_replication_-settings","upgrade.html#upgrading-to-v1860","upgrade.html#minimum-supported-rust-version-1","upgrade.html#upgrading-to-v1850","upgrade.html#application-service-registration-with-user-property-deprecation","upgrade.html#upgrading-to-v1840","upgrade.html#deprecation-of-worker_replication_-configuration-settings","upgrade.html#example-change","upgrade.html#upgrading-to-v1810","upgrade.html#application-service-path--authentication-deprecations","upgrade.html#upgrading-to-v1800","upgrade.html#reporting-events-error-code-change","upgrade.html#upgrading-to-v1790","upgrade.html#the-on_threepid_bind-module-callback-method-has-been-deprecated","upgrade.html#upgrading-to-v1780","upgrade.html#deprecate-the-_synapseadminv1mediadelete-admin-api","upgrade.html#upgrading-to-v1760","upgrade.html#faster-joins-are-enabled-by-default","upgrade.html#changes-to-the-account-data-replication-streams","upgrade.html#minimum-version-of-poetry-is-now-132","upgrade.html#upgrading-to-v1740","upgrade.html#unicode-support-in-user-search","upgrade.html#user-directory-rebuild","upgrade.html#upgrading-to-v1730","upgrade.html#legacy-prometheus-metric-names-have-now-been-removed","upgrade.html#upgrading-to-v1720","upgrade.html#dropping-support-for-postgresql-10","upgrade.html#upgrading-to-v1710","upgrade.html#removal-of-the-generate_short_term_login_token-module-api-method","upgrade.html#changes-to-the-events-received-by-application-services-interest","upgrade.html#legacy-prometheus-metric-names-are-now-disabled-by-default","upgrade.html#upgrading-to-v1690","upgrade.html#changes-to-the-receipts-replication-streams","upgrade.htmLine truncated
develop/usage/configuration/config_documentation.html
+38 -14
View File
@@ -3060,27 +3060,50 @@ claim MUST contain &quot;admin&quot;.</p>
<p>Enable Central Authentication Service (CAS) for registration and login.
Has the following sub-options:</p>
<ul>
<li><code>enabled</code>: Set this to true to enable authorization against a CAS server.
Defaults to false.</li>
<li><code>idp_name</code>: A user-facing name for this identity provider, which is used to
offer the user a choice of login mechanisms.</li>
<li><code>idp_icon</code>: An optional icon for this identity provider, which is presented
<li>
<p><code>enabled</code>: Set this to true to enable authorization against a CAS server.
Defaults to false.</p>
</li>
<li>
<p><code>idp_name</code>: A user-facing name for this identity provider, which is used to
offer the user a choice of login mechanisms.</p>
</li>
<li>
<p><code>idp_icon</code>: An optional icon for this identity provider, which is presented
by clients and Synapse's own IdP picker page. If given, must be an
MXC URI of the format <code>mxc://&lt;server-name&gt;/&lt;media-id&gt;</code>. (An easy way to
obtain such an MXC URI is to upload an image to an (unencrypted) room
and then copy the &quot;url&quot; from the source of the event.)</li>
<li><code>idp_brand</code>: An optional brand for this identity provider, allowing clients
and then copy the &quot;url&quot; from the source of the event.)</p>
</li>
<li>
<p><code>idp_brand</code>: An optional brand for this identity provider, allowing clients
to style the login flow according to the identity provider in question.
See the <a href="https://spec.matrix.org/latest/">spec</a> for possible options here.</li>
<li><code>server_url</code>: The URL of the CAS authorization endpoint.</li>
<li><code>protocol_version</code>: The CAS protocol version, defaults to none (version 3 is required if you want to use &quot;required_attributes&quot;).</li>
<li><code>displayname_attribute</code>: The attribute of the CAS response to use as the display name.
If no name is given here, no displayname will be set.</li>
<li><code>required_attributes</code>: It is possible to configure Synapse to only allow logins if CAS attributes
See the <a href="https://spec.matrix.org/latest/">spec</a> for possible options here.</p>
</li>
<li>
<p><code>server_url</code>: The URL of the CAS authorization endpoint.</p>
</li>
<li>
<p><code>protocol_version</code>: The CAS protocol version, defaults to none (version 3 is required if you want to use &quot;required_attributes&quot;).</p>
</li>
<li>
<p><code>displayname_attribute</code>: The attribute of the CAS response to use as the display name.
If no name is given here, no displayname will be set.</p>
</li>
<li>
<p><code>required_attributes</code>: It is possible to configure Synapse to only allow logins if CAS attributes
match particular values. All of the keys given below must exist
and the values must match the given value. Alternately if the given value
is <code>None</code> then any value is allowed (the attribute just must exist).
All of the listed attributes must match for the login to be permitted.</li>
All of the listed attributes must match for the login to be permitted.</p>
</li>
<li>
<p><code>enable_registration</code>: set to 'false' to disable automatic registration of new
users. This allows the CAS SSO flow to be limited to sign in only, rather than
automatically registering users that have a valid SSO login but do not have
a pre-registered account. Defaults to true.</p>
<p><em>Added in Synapse 1.93.0.</em></p>
</li>
</ul>
<p>Example configuration:</p>
<pre><code class="language-yaml">cas_config:
@@ -3091,6 +3114,7 @@ All of the listed attributes must match for the login to be permitted.</li>
required_attributes:
userGroup: &quot;staff&quot;
department: None
enable_registration: true
</code></pre>
<hr />
<h3 id="sso"><a class="header" href="#sso"><code>sso</code></a></h3>