SSO rest API for redirect is loaded if no SSO is configured

[dklimpel]

Description

Rest api is loaded and can be called if no SSO is configured.

API returns an error "Homeserver not configured for SSO." But I can not see why the server needs to be run this api.

Steps to reproduce

• setup a new homeserver
• request /_matrix/client/r0/login/sso/redirect?redirectUrl=www.example.org

Homeserver

another

Synapse Version

1.78.0

Installation Method

Docker (matrixdotorg/synapse)

Database

PostgreSQL

Workers

Single process

Platform

K8s

Configuration

only password login

Relevant log output

None

Anything else that would be useful to know?

Probably there could be a check here for SSO capabilities:

synapse/synapse/rest/client/login.py

Line 675 in 98fd558

SsoRedirectServlet(hs).register(http_server)

Similar to:

synapse/synapse/rest/client/login.py

Line 148 in 98fd558

if self.cas_enabled or self.saml2_enabled or self.oidc_enabled:

[erikjohnston]

I'm in two minds about this one. Firstly, I think you have a point that its unnecessary, however I think it is useful for debugging purposes to see that the URL is correct but SSO has been disabled.

[dklimpel]

IMO this kind of debugging or validating a configuration is not the right one for productive systems.
There is a feature flag. This flag is for disabling the feature and not only parts of it.
Loading the api also needs resources. Even if it is probably insignificant.