Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update MSC2965 support: discover the OIDC provider via C-S API instead of the well-known discovery #26908

Closed
sandhose opened this issue Jan 22, 2024 · 0 comments · Fixed by matrix-org/matrix-react-sdk#12245

Comments

@sandhose
Copy link
Member

Your use case

Both the OIDC-native login and the OIDC-aware implementation in Element Web rely on the first iteration of MSC2965, which uses the .well-known/matrix/client document to discover the OIDC provider and account management URL.

The MSC got updated to add a new C-S API endpoint used to discover the issuer. That endpoint got implemented in Synapse 1.99.0.
Note that the MSC also moves the account management URL to the OpenID Connect discovery document, which means that, even in OIDC-aware mode, if EW wants to discover this endpoint, it has to:

  • GET [hs]/_matrix/client/unstable/org.matrix.msc2965/auth_issuer
  • get the issuer property from that endpoint
  • GET [issuer]/.well-known/openid-configuration
  • get the account_management_uri and maybe account_management_actions_supported properties from that document

Have you considered any alternatives?

No response

Additional context

https://synapse-oidc.lab.element.dev/ is an up-to-date, OIDC-enabled server to help with testing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants