This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Experimental MSC3861 support: delegate auth to an OIDC provider#15582

Merged

clokep merged 24 commits intomatrix-org:developfrom sandhose:quenting/oauth-delegation-pr

May 30, 2023

+2,524-401

Commits on May 30, 2023

Make the api.auth.Auth a Protocol
sandhose
committed
Initial MSC3964 support: delegation of auth to OIDC server
sandhose
committed
Expose the public keys used for client authentication on an endpoint
sandhose
committed
MSC2965 : OIDC Provider discovery via well-known document
sandhose
committed
Save the scopes in the requester
sandhose
committed
Handle the Synapse admin scope
sandhose
committed
Record the sub claims as an external_id
sandhose
committed
Use name claim as display name when registering users on the fly.

hughns
authored and
sandhose
committed
MSC2967 : Check access token scope for use as user and add guest support

hughns
authored and
sandhose
committed
Initial tests for OAuth delegation

hughns
authored and
sandhose
committed
Actually enforce guest + return www-authenticate header

hughns
authored and
sandhose
committed
Disable account related endpoints when using OAuth delegation
sandhose
committed
Test MSC2965 implementation: well-known discovery document

hughns
authored and
sandhose
committed
Refactor config to be an experimental feature

hughns
authored and
sandhose
committed
Tests for JWKS endpoint

hughns
authored and
sandhose
committed
Add an admin token for MAS -> Synapse calls
sandhose
committed
Make AS tokens work & allow ASes to /register
sandhose
committed
Disable incompatible Admin API endpoints
sandhose
committed
Newsfile.
sandhose
committed
Handle errors when introspecting tokens
sandhose
committed
Make OIDC scope constants
sandhose
committed
Reject tokens with multiple device scopes
sandhose
committed
Make the config tests spawn the homeserver only when needed
sandhose
committed
Enforce that an admin token also has the basic Matrix API scope
sandhose
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Experimental MSC3861 support: delegate auth to an OIDC provider#15582

Commits on May 30, 2023

Make the api.auth.Auth a Protocol

Initial MSC3964 support: delegation of auth to OIDC server

Expose the public keys used for client authentication on an endpoint

MSC2965 : OIDC Provider discovery via well-known document

Save the scopes in the requester

Handle the Synapse admin scope

Record the `sub` claims as an external_id

Use `name` claim as display name when registering users on the fly.

MSC2967 : Check access token scope for use as user and add guest support

Initial tests for OAuth delegation

Actually enforce guest + return www-authenticate header

Disable account related endpoints when using OAuth delegation

Test MSC2965 implementation: well-known discovery document

Refactor config to be an experimental feature

Tests for JWKS endpoint

Add an admin token for MAS -> Synapse calls

Make AS tokens work & allow ASes to /register

Disable incompatible Admin API endpoints

Newsfile.

Handle errors when introspecting tokens

Make OIDC scope constants

Reject tokens with multiple device scopes

Make the config tests spawn the homeserver only when needed

Enforce that an admin token also has the basic Matrix API scope