Next-generation Auth Support

[jevolk]

Specifications: matrix-org/matrix-spec-proposals/#3861

[filipesmedeiros]

I'm sorry for being not very well informed, but it is not clear to me how this is different from #7. Is there any documentation that clarifies it? Thanks!

[FreeSynergy]

One more Question about this:
Is there SCIM integrated?

https://scim.cloud/

Or should I open a new Issue fir that?

Greetings,
Kal

[FreeSynergy]

But, sorry, that I forgot to say:

Yeeeeaaaaahhhhhhhhhhhhhhh!!!!

THANK YOU!!!

[jevolk]

I'm sorry for being not very well informed, but it is not clear to me how this is different from #7. Is there any documentation that clarifies it? Thanks!

#7 Is called "legacy" auth, where the matrix server is an OIDC client to external identity providers. In next-gen auth, the matrix server is both an OIDC client to external identity providers and an OIDC server to matrix clients.

[filipesmedeiros]

#7 Is called "legacy" auth, where the matrix server is an OIDC client to external identity providers. In next-gen auth, the matrix server is both an OIDC client to external identity providers and an OIDC server to matrix clients.

I see! So my follow-up is: at the current moment, if I want to use OAuth/OIDC in my Tuwunel server, does that mean that in the client I will still have to input username/password, but the server will then use those credentials to authenticate with an external provider? Or will the client talk directly to the provider, and then to Tuwunel to say "Hey, see, I am authenticated with the provider that you deem trutworthy"?

Am I missing the mark completely? :P

[CEbbinghaus]

Lets differentiate between the old and new methods of logging in:
Old:

• Send username & password to server
• OR Open OAuth2 session in external window, and authenticate a 3rd party which the homeserver validates
• etc...

New:

• Start auth session, Get redirected to OAuth window in browser
• Enter username & password OR redirect to 3rd party OAuth Provider
• Homeserver issues token to client directly

In the new auth flow, the homeserver itself is required to be a OAuth2/OIDC provider and all clients to log into it. Which means to support basic password authentication, tuwunel needs to serve up a http website for the user to interact with allowing the user to enter their credentials, or at the very least redirect to a 3rd party auth provider. In any case, it is the homeserver issuing the token rather than a third party, that is the key

[filipesmedeiros]

Thank you for the very nice clarification :)

I think that is precisely what I expected, and what we are talking about in #266. In that issue, I kind of implicitly asked why the old method was not good enough, and why the spec for the new auth required that the homeserver be an OIDC provider. Maybe let's continue the conversation there. Better yet: I will read some of the discussions and blog posts written on other fora like Element's website and Matrix's repos.

Thank you again!