SAML SSO broken on Synapse 1.27

[richvdh]

The 1.27 upgrade notes claim:

Note: a similar change is being made for SAML2; in this case the old URI [synapse public baseurl]/_matrix/saml2 is being deprecated, but will continue to work, so no immediate changes are required for existing installations.

In fact, as part of the SAML2 request, the expected callback URI is sent to the SAML2 IdP, which will check that it matches what is expected and fail if not.

Hence, upgrading to Synapse 1.27 will break login for anyone using SAML :/.

[callahad]

This is a docs-only fix, yes?

[richvdh]

I vote that yes, we fix this through updating the docs and letting people know about it, though there's an alternative approach where we roll back #9289 and attempt a more orderly deprecation.

[clokep]

So this essentially has the same behavior as the OIDC code where we have to jump from one callback URL to another in one go? I think fixing up the docs and removing the old URL sounds OK. At least than OIDC and SAML were done in the same release.

[clokep]

I backported the docs changes to the v1.27.0 branch so that they will appear properly when people check the upgrade doc / changelog, see d804285. (This was also merged to master and develop and I've updated https://github.com/matrix-org/synapse/releases/tag/v1.27.0 too.)