WIP: act as a Matrix OIDC auth provider #810
2025-12-10
chore: Fixup (satisfy CI)
Some checks failed
Documentation / Build and Deploy Documentation (pull_request) Has been skipped
Update flake hashes / update-flake-hashes (pull_request) Successful in 13s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 2m11s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 11m47s
add some docstrings
Some checks failed
Documentation / Build and Deploy Documentation (pull_request) Has been skipped
Update flake hashes / update-flake-hashes (pull_request) Successful in 13s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
OIDC: reimplement using rocksdb and oxide-auth-async
devices and their tokens use the global registries and services::users commands, and some db registries are added : - clientid_oidcclient (stores OIDC client details) - oidcdeviceid_grant (stores oxide-auth grant details) - refreshtoken_userdeviceidexpiresat (stores refresh tokens' expiry date) - userdeviceid_oidcdevice (stores OIDC device details) This implementation lacks the owner consent dialog. This will be addressed in a future commit.
OIDC: improve web templates
- fixes CSP issues with localhost - better consent message -use askama urlencode_strict
impl persistent tokens + MSC4254 (token revoke)
adds an "issuer_secret" to config.auth that lets the issuer persist tokens between continuwuity restarts
fix oxide-auth's redirect_uri comparison
oxide-auth's `RegisteredUrl::IgnorePortOnLocalhost` doesn't work when the host is 127.0.0.1 or [::1]. This commit lets the authentication process translate the host. The new registrar already supports this.
OIDC: make response_mode optional
Fractal omits the `response_mode` field when in an auth flow (its value must be the literal "S256", so it's mainly here for OIDC compliance I guess). Accepting this lets it proceed to the next authentication step.
remove stale debugging logs
I don't have the hd space to do debug builds, so I use tracing::info to debug on release builds. Silly, right ?
fix: Don't crash when the client URL doesn't have a domain
Having a URL with an IP literal, for example, is allowed
feat(oidc_provider) use askama templates
Implements a custom OidcResponse with CSP headers and oxide-auth processing compatibility.
impl MSC2965: self-advertise as OIDC authentication provider
MSC2965 proposes to let the homeserver advertise its current OIDC authentication issuer. These changes let conduwuit advertise itself as the issuer when [global.auth.enable_oidc_login] is set. It also advertises its account management endpoint if [global.auth.enable_oidc_account_management] is set. None of these endpoints are implemented. This commit only implements the bare advertisement, as requested by the MSC.