Code in "password_providers" is loaded, even if disabled

Description

I am (successfully) using a custom password provider for matrix-synapse:

password_providers:
  - module: "grouprise.auth.matrix_synapse_auth_grouprise.GroupriseAuthProvider"
    config:
      enabled: true
      settings_filename: /etc/grouprise/settings.py

The above snippets works as expected.

But when I disable the password provider (enabled: false), the python module is still loaded and the above class (GroupriseAuthProvider) is still initialized.

In order to prevent matrix-synapse from initializing the class, I need to comment/remove the above configuration snippet completely.

Steps to reproduce

• add a minimal (broken) configuration snippet to the synapse configuration:

password_providers:
  - module: "foo.bar"
    config:
      enabled: false

• restart matrix-synapse
• take a look at the logs and discover the following lines:

Traceback (most recent call last):
  File "/usr/lib/python3.7/runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "/usr/lib/python3.7/runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "/usr/lib/python3/dist-packages/synapse/app/homeserver.py", line 507, in <module>
    main()
  File "/usr/lib/python3/dist-packages/synapse/app/homeserver.py", line 502, in main
    hs = setup(sys.argv[1:])
  File "/usr/lib/python3/dist-packages/synapse/app/homeserver.py", line 333, in setup
    "Synapse Homeserver", config_options
  File "/usr/lib/python3/dist-packages/synapse/config/_base.py", line 727, in load_or_generate_config
    config_dict, config_dir_path=config_dir_path, data_dir_path=data_dir_path
  File "/usr/lib/python3/dist-packages/synapse/config/_base.py", line 749, in parse_config_dict
    data_dir_path=data_dir_path,
  File "/usr/lib/python3/dist-packages/synapse/config/_base.py", line 374, in invoke_all
    res[name] = getattr(config, func_name)(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/synapse/config/password_auth_providers.py", line 49, in read_conf
    ("password_providers", "<item %i>" % i),
  File "/usr/lib/python3/dist-packages/synapse/util/module_loader.py", line 49, in load_module
    module = importlib.import_module(module)
  File "/usr/lib/python3.7/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1006, in _gcd_import
  File "<frozen importlib._bootstrap>", line 983, in _find_and_load
  File "<frozen importlib._bootstrap>", line 965, in _find_and_load_unlocked
ModuleNotFoundError: No module named 'foo'

Instead of the above behavior, I expected synapse to ignore the disabled password_provider completely (i.e. not importing the module).

Version information

• Version: 1.28.0-1~bpo10+2
• Install method: Debian package (buster-backports)

[richvdh]

the config block (including the enabled setting shown here) contains options for the module, so of course we have to load the module, so that we can pass the option in. As it happens, some modules (including LdapAuthProvider) require an enabled option to enable them, though personally I think that is a misfeature. There is certainly nothing that says all modules need to implement enabled, nor that it necessarily means the same to all modules.

In short, I think having Synapse inspect the supposedly module-specific options and apply magic behaviour if there is one called enable would be extremely confusing.

If you want a way to temporarily avoid loading the password provider, just rename password_providers to something like _x_password_providers that will be ignored by Synapse.

[gramakri]

I opened https://github.com/matrix-org/matrix-synapse-ldap3/issues/124 for the invalid server address.