SAML2: email validation links from auth0 sometimes fail and give a confusing error

[richvdh]

Steps to reproduce:

• Have a homeserver that authenticates against an auth0 instance via SAML2.
• When authenticating, follow auth0's authentication flow to register with a new email address; this will lead auth0 to send a validation email
• Wait for the link in that email to expire (alternatively: try to use it twice)
• Observe an error that looks like this:

[richvdh]

What seems to be happening here is that auth0 redirects to /_matrix/saml2/authn_response with an error encoded as a URI fragment, for example https://example.com/_matrix/saml2/authn_response#error=unauthorized&error_description=Wrong%20email%20or%20verification%20code.&state=<encoded state>.

This isn't a legitimate thing to do in SAML2: I think that sending errors back in URI fragments is an OAuth2 thing, so this seems to be mainly auth0's fault. To mitigate it, we could serve a static page with javascript that displays the error information.

(The fact that synapse claims only to support HEAD is #6894)

[ara4n]

This is biting a significant number of people - perhaps everyone who tries to auth via email:

https://www.reddit.com/r/firefox/comments/fdplxc/moznet_irc_is_dead_long_live_mozilla_matrix/fjldxdi/
https://news.ycombinator.com/item?id=22492150

etc

I'm unconvinced that it's only affecting expired/invalid links.

[babolivier]

It looks to me like Auth0 has quite a few failure modes when using passwordless auth, each of which has a different behaviour. For example, if the token has expired, then you get the same thing except the error is passed as a query parameter (e.g. https://example.com/_matrix/saml2/authn_response?error=unauthorized&error_description=Wrong%20email%20or%20verification%20code.&state=<encoded state>).

Therefore, for now, we're going with a configurable HTML file that tells users "oops, something went wrong", and that they should go back to their Matrix client and try to authenticate again. This was done in #7058, so I'm going to close this issue.