start_sso doesn't work without guest access

[hmenke]

On my instance of Element the #/start_sso endpoint doesn't to work. When I visit https://chat.example.com/#/start_sso I just get redirected back to https://chat.example.com/#/welcome, but when I click "Sign In" => "Sign in with single sign-on" then I am correctly redirected to my SSO provider.

To make it work guest access has to enabled, i.e. I need to have

"disable_guests": false

in Element's config.json and also

allow_guest_access: true

in Synapse's homeserver.yaml.

However, this is a private instance of Synapse and I don't want to allow guest access. Is there a way around?

Related: #16434

[jryans]

Seems like there might be some bug in the SSO flow expecting an account where it should not.

[t3chguy]

I would not say this is p1 due to this being an internal route with no documentation/guarantees about exact function

[hmenke]

I'm not so familiar with the internals but I think this might be quite a severe bug because this has the potential of creating an enormous number of guests on the homeserver (which are not pruned btw matrix-org/synapse#669). It might even be possible to DoS the homeserver through this route.

EDIT: Forget about the attack vector. You can also create guests through the regular API, but this might still lead to an unexpected increase in the number of guests from people just passing by.