Unable to connect to homeserver after setting up MAS

[Sharparam]

After setting up MAS (Matrix Authentication Service), it seems the Telegram bridge is no longer able to start.

The following is logged when it tries to start:

/usr/lib/python3.12/site-packages/mautrix_telegram/web/public/__init__.py:26: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
[2025-08-11 04:21:18,546] [INFO@mau.init] Initializing mautrix-telegram 0.15.3+dev.b65a1cc6
[2025-08-11 04:21:18,571] [INFO@mau.init] Initialization complete in 0.3 seconds
[2025-08-11 04:21:18,645] [INFO@mau.mx] Ensuring connectivity to homeserver
[2025-08-11 04:21:18,659] [INFO@mau.as] Received ping from homeserver with transaction ID mautrix-python_1754886078654231813_1
[2025-08-11 04:21:18,661] [INFO@aiohttp.access] 172.18.0.2 [11/Aug/2025:04:21:18 +0000] "POST /_matrix/app/v1/ping HTTP/1.1" 200 161 "-" "Synapse/1.135.0"
[2025-08-11 04:21:18,672] [CRITICAL@mau.init] Unexpected error in main event loop
Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/mautrix/util/program.py", line 214, in _run
    self.loop.run_until_complete(self.start())
  File "/usr/lib/python3.12/asyncio/base_events.py", line 691, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/mautrix/bridge/bridge.py", line 254, in start
    await self.matrix.init_encryption()
  File "/usr/lib/python3.12/site-packages/mautrix/bridge/matrix.py", line 299, in init_encryption
    await self.e2ee.start()
  File "/usr/lib/python3.12/site-packages/mautrix/bridge/e2ee.py", line 250, in start
    flows = await self.client.get_login_flows()
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/mautrix/client/api/authentication.py", line 46, in get_login_flows
    resp = await self.api.request(Method.GET, Path.v3.login)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/mautrix/api.py", line 425, in request
    resp_data, resp = await self._send(
                      ^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/mautrix/api.py", line 265, in _send
    raise make_request_error(
mautrix.errors.request.MUnrecognized: Unrecognized request

Bridge and Synapse versions can be seen in the log, I'm using the latest stable Synapse and the "latest" tag for the bridge Docker image.

Edit: If I change the homeserver URL in the bridge config to the public URL instead it starts working, since the public URL has the compatibility routes for the login API. So as a workaround that makes it function seemingly as normal again, but ideally the bridge should be compatible with the new MAS stuff natively so it can go back to using the internal Docker hostnames.

Edit 2: And the above error still happens even if msc4190: true is set in the config, which AFAICT is explicitly supposed to not use the old /login API.

[Sharparam]

@tulir Does this mean support for MAS is not planned and legacy workarounds will have to be put in place? If so this should probably be put in the docs.

[tulir]

As with any multi-process/worker setup, bridges must be configured so that they can reach all endpoints, MAS is no different. Generally the best way to do it is to have a local non-tls listen port on the reverse proxy

[Sharparam]

The problem here is that the endpoint in question (/login) is now a legacy endpoint and shouldn't be used anymore, as far as I can tell. It's only part of the reverse proxy config to keep supporting software that has not yet updated to support the new scheme.

[Sharparam]

I looked into the file that was updated in mautrix/python#175 and it seems the support is only halfway there?

https://github.com/mautrix/python/blob/master/mautrix/bridge/e2ee.py#L249

Even if the MSC4190 flag is enabled, it still tries to do a GET request to the /login endpoint, it's only the POST request that has been moved under the check.

Edit: Compare this to the Go version:

https://github.com/mautrix/go/blob/main/bridgev2/matrix/crypto.go#L243-L253

Where both the GET and POST requests will not execute if MSC4190 is enabled.

[Sharparam]

@tulir Since there is an issue mautrix/python#177 and PR mautrix/python#178 to fix the MSC4190 support, I propose that this issue is re-opened until that PR can be merged, the issue closed, and this bridge updated to use the fixed version.

[olmari]

But this bridge already does work with MAS when all is set properly... We use both.

[Sharparam]

@olmari No, it only works if it communicates with Synapse through a reverse proxy that has the compatibility endpoints set up, not when communicating with Synapse directly (in which case the /login APIs are non-existent).

Edit: This is mentioned on https://areweoidcyet.com/:

Encrypted application-services currently rely on /login with the m.login.application_service method to create devices, which has been infamously removed from the implementation in Synapse/MAS.

(Emphasis mine.)

[olmari]

In the end, Go version of this bridge is coming hot, so it is unlikely Python version gets these kind of updates anymore... Tho I'm no dev.