MSC2416: Add m.login.jwt authentication type #2416
Conversation
proposals/2416-login-token.md
Outdated
| A `m.login.password` auth provider could be used to log in as someone as a special user. This, | ||
| however, feels rather hacky and not the intended purpose of `m.login.password`. | ||
|
|
||
| Synapses `m.login.jwt` could be introduced properly in the spec, however, as it seems to be |
There was a problem hiding this comment.
I think I would prefer that, since it lets the server know which token validator to use. Otherwise the HS needs to guess, which type of token it has to validate (from what I can tell). It would also make it easier for clients to know, what login token types are supported.
There was a problem hiding this comment.
Otherwise the HS needs to guess, which type of token it has to validate (from what I can tell).
it could guess, and on failure try other token validators.
There was a problem hiding this comment.
Yeah, but while m.login.jwt and m.login.token do follow the same schema, putting them in the same type fails to communicate semantic information. Maybe that isn't an issue in practice, but it would seem like an issue to me as a client dev. How would I know, what token to send to a server? Just try it?
There was a problem hiding this comment.
Yeah, you could just try it out. That being said, the JWT proposed here would be mainly for appservices to use, probably
I think this MSC is talking about login types (ie, the |
|
It is also worth noting that |
|
Updated to introduce |
Synapse has also dropped support for |
|
As per matrix-org/matrix-spec#370 (comment): this makes more sense as a custom extension rather than something to spec. (Inherently: if you've acquired a JWT somewhere, then you don't have a regular matrix client, you have a custom deployment which links together your client and server). In any case, login is being replaced by OAuth2. @mscbot fcp close |
|
Team member @richvdh has proposed to close this. The next step is review by the rest of the tagged people: Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up! See this document for information about what commands tagged team members can give me. |
|
🔔 This is now entering its final comment period, as per the review above. 🔔 |
|
The final comment period, with a disposition to close, as per the review above, is now complete. |
Rendered
Soru is interested in providing a synapse implementation for this.
Signed-off-by: Sorunome mail@sorunome.de
SCT Stuff:
FCP closure tickyboxes
No checklist.