Use registration_token with SSO?

[TheBrigandier]

Tried configuring SSO earlier and got it working, but noticed it doesn't ask for the registration token and instead lets the user straight through. Is it possible to gate this with the registration token after SSO login succeeds?

Edit: My use case is I would like to set up SSO with common providers (i.e. Google, Facebook, Discord, etc), but still have new user registration limited to those who know the token.

[AlexandarY]

I encountered the same thing and did some digging.

It appears with an identity_provider, the user registration happens during the execution of the callback_url. After it does some session management, it will check if the user already exists and if not, create an user. As per matrix spec here, it appears the registration_token is valid only on the /register endpoint, so not here.

I'm hoping something can be done to restrict who can log in/register via an identity_provider. It seems @jevolk worked on this feature, so might be the best place to start/ask?

[TheBrigandier]

I encountered the same thing and did some digging.

It appears with an identity_provider, the user registration happens during the execution of the callback_url. After it does some session management, it will check if the user already exists and if not, create an user. As per matrix spec here, it appears the registration_token is valid only on the /register endpoint, so not here.

I'm hoping something can be done to restrict who can log in/register via an identity_provider. It seems @jevolk worked on this feature, so might be the best place to start/ask?

This was my worry, but thought I would check 😅. It makes sense, most software that supports identity providers in this way expects you to go handle all that stuff in your provider. Since it's not part of the Matrix spec, I will go ahead and close this one.