MSC3824: OIDC aware clients

[hughns]

Rendered

• Spec is feature complete
• Reviewed for consistency with MSC3861
• Implementations believed to be complete enough

Dependencies:

• MSC3861: Next-generation auth for Matrix, based on OAuth 2.0/OIDC #3861

Servers

• Synapse implementation: https://github.com/sandhose/synapse/tree/quenting/oauth-delegation
• Matrix Authentication Service support within it's compatibility layer: Implementation of MSC3824 actions for compat matrix-authentication-service#221

Clients

• Support in matrix-js-sdk: Implementation of MSC3824 to add action= param on SSO login matrix-js-sdk#2398
• Element Web implementation via matrix-react-sdk: Implementation of MSC3824 to make the client OIDC-aware matrix-react-sdk#8681
• Element Android implementation: Implementation of MSC3824 to make the client OIDC-aware element-hq/element-android#7920
• Element iOS implementation

[turt2live]

(implementation nor the MSC have been sufficiently reviewed to remove the label - when someone on the SCT is comfortable with where things are at, they'll remove the label. Personally, I haven't gotten as far as deciding if I'm comfortable with it 😅)

[sandhose]

I think an important part of this would also be to be able to advertise what actions are available with each login method, e.g.

{
  "flows": [{
    "type": "m.login.password",
    "actions": ["login"],
  }, {
    "type": "m.login.sso",
    "actions": ["login", "register"]
  }]
}

This would allow clients to properly display what's really available for each login method

[hughns]

I've had an initial go at Synapse support in matrix-org/synapse#12924.

Matrix Authentication Service support within it's compatibility layer is in matrix-org/matrix-authentication-service#221

[hughns]

The Web support has been merged so I think that this is ready for review. Android implementation is done too but not yet merged.

[clokep]

I think I'm missing something -- how would the client know whether it is logging in or registering?

[hughns]

The user would have told the client if they already have a Matrix account or not.

For example, by clicking buttons labelled as such.

[clokep]

Is it defined how m.login.password an be wrapped into OIDC? I guess doing the login itself?

[clokep]

Make use of it to do what?