oidc: add client_secret_path as alternative for client_secret

That way you don't have to leak your bind password into your config. Useful for e.g. NixOS where config is stored in a world-readable location. Tested against a live synapse instance with authentik as OIDC provider. Signed-off-by: Maximilian Bosch <[email protected]>
matrix-org · Aug 12, 2023 · b1197c0 · b1197c0
1 parent 68b2611
commit b1197c0
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 1 deletion.
diff --git a/changelog.d/16030.feature b/changelog.d/16030.feature
@@ -0,0 +1 @@
+Allow specifying `client_secret_path` as alternative to `client_secret` for OIDC providers. That way, the client secret doesn't need to be leaked into the homeserver config. Contributed by @Ma27.
diff --git a/docs/usage/configuration/config_documentation.md b/docs/usage/configuration/config_documentation.md
@@ -3170,6 +3170,10 @@ Options for each entry include:
 * `client_secret`: oauth2 client secret to use. May be omitted if
   `client_secret_jwt_key` is given, or if `client_auth_method` is 'none'.
 
+* `client_secret_path`: path to the oauth2 client secret to use. With that
+   it's not necessary to leak secrets into the config file itself.
+   Mutually exclusive with `client_secret`.
+
 * `client_secret_jwt_key`: Alternative to client_secret: details of a key used
    to create a JSON Web Token to be used as an OAuth2 client secret. If
    given, must be a dictionary with the following properties:

diff --git a/synapse/config/oidc.py b/synapse/config/oidc.py
@@ -280,6 +280,20 @@ def _parse_oidc_config_dict(
         for x in oidc_config.get("attribute_requirements", [])
     ]
 
+    # Read from either `client_secret_path` or `client_secret`. If both exist, error.
+    client_secret = oidc_config.get("client_secret")
+    client_secret_path = oidc_config.get("client_secret_path")
+    if client_secret_path is not None:
+        if client_secret is None:
+            client_secret = read_file(
+                client_secret_path, config_path + ("client_secret_path",)
+            ).rstrip("\n")
+        else:
+            raise ConfigError(
+                "Cannot specify both client_secret and client_secret_path",
+                config_path + ("client_secret",),
+            )
+
     return OidcProviderConfig(
         idp_id=idp_id,
         idp_name=oidc_config.get("idp_name", "OIDC"),
@@ -288,7 +302,7 @@ def _parse_oidc_config_dict(
         discover=oidc_config.get("discover", True),
         issuer=oidc_config["issuer"],
         client_id=oidc_config["client_id"],
-        client_secret=oidc_config.get("client_secret"),
+        client_secret=client_secret,
         client_secret_jwt_key=client_secret_jwt_key,
         client_auth_method=oidc_config.get("client_auth_method", "client_secret_basic"),
         pkce_method=oidc_config.get("pkce_method", "auto"),
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Allow specifying `client_secret_path` as alternative to `client_secret` for OIDC providers. That way, the client secret doesn't need to be leaked into the homeserver config. Contributed by @Ma27.