I wrote a proof of concept that allows the user to sign up to a service using their matrix ID e.g @user:server.test. The user then receives an activation link in an encrypted room from the service. It worked quite easily and within 2 days of fumbling around with the matrix SDK in python and FastAPI, here we are.
This has been in my head for a while and I just wanted to see if it’s possible (the proof is in the pudding code). Emails are insecure and national services are starting to implement communication services on top of matrix. It’s a not inconceivable that citizens might get a government issued Matrix account and communicate safely with the government over a secure protocol. Why not allow other services to do the same?
Imagine if instead of providing your email address for signing up to services you used matrix instead. Your host wouldn’t be able to read your messages and it could replace things like 2FA codes over SMS, activation links in emails, or health documents from your doctor’s CMS in your email inbox.
Should there be enough time, I’d like to try and contribute this login method to forgejo (the software behind codeberg that’s hosting this repository), but let’s see. First it would take learning go 😅
Hey @[email protected], are you talking about Synapse’s SSO implementation? I’ve had to deal with SAML before and it wasn’t a particularly joyful experience but since synapse makes it possible, it would indeed be a useful contribution to Forgejo too! Maybe it’s just a question of providing documentation and some example configs for Forgejo to make instance owners aware of the Synapse SSO capabilities.
The reason I went with this is implementation is because email just seems to be a notification and communication channel used by other services. Giving the additional option of using Matrix could be easier for devs than figuring out SAML or OIDC.
Question about continuwuity: how can I create an admin user? It might be missing from the doc and the docker image doesn’t have a register_new_matrix_user script.
I’m talking about https://github.com/element-hq/matrix-authentication-service which is the only implementation of https://github.com/matrix-org/matrix-doc/pull/3861 right now.
Yeah, saml is a nightmare! Never make me touch saml, please 🥺
In Continuwuity, the first user created is the admin user - so creating a user using either a registration token, or an admin command via --exec, the emergency password, the interactive console, etc would work.