Compatibility with Matrix auth

[erlend-sh]

The Matrix comms spec is changing to be built on top of the OAuth and OpenID standards:

matrix-org/matrix-spec-proposals#2964
https://github.com/matrix-org/matrix-authentication-service

We are looking into Hydra for Commune’s id/auth component, so if it works out we’ll probably make some glue layer between Hydra and Matrix.

Might there be interest in having any such compatibility extension upstreamed?

[zepatrik]

Depends a bit on the kind of changes, but as long as it is following OAuth/OIDC standards sure. You can keep us updated here and maybe sketch out what is needed once you figured it out 👍

[vinckr]

I would be happy to feature such an integration in our documentation as well 🙏

[micheljung]

Yes please! I'm currently trying to authenticate to Matrix via Hydra but after login, hydra/kratos doesn't send me back to my Matrix client. No idea if it's just not compatible or what. In the Synapse docs they say it has been tested with hydra but no documentation can be found anywhere.

[vinckr]

They probably tested it just with Ory Hydra, but thanks for pointing that out!
Would you be open to share a repo with your current progress? Maybe @erlend-sh and me can help out a bit.

In general the Hydra/Kratos integration will get much easier with this: ory/kratos#273

[micheljung]

My issue was a missing configuration for sub-domain cookies, which was already documented.

So far it's really just OAuth configuration. The missing puzzle piece now is the login/consent screen - exactly what ory/kratos@273 is about. Even though I don't understand what Kratos has to do with it, since it's API-only. I rather see this in https://github.com/ory/kratos-selfservice-ui-node/ where implemented it in a branch hydra-integration-2021. But it does no longer seem to be compatible, I also get the redirect loop

[erlend-sh]

There’s now a more complete spec and tracking issue for this work:
matrix-org/matrix-spec-proposals#3861

https://matrix.org/blog/2022/08/10/areweoidcyet-com-matrix-and-open-id-connect
https://areweoidcyet.com/

According to this, Synapse has already been tested with Hydra as an OpenID Connect provider. Further testing with Ory is tracked here.

(As for upstreaming anything from the aforementioned Commune, that’s unfortunately an uncertainty still, as my dev collaborator lives in a tumultuous part of the world and so their availability varies.)