Homeservers as OAuth authorization endpoints (resource owners) (SPEC-206)

[matrixbot]

Documentation: https://docs.google.com/document/d/1vEPFlX79oa1foBmar6i8nvw-hB4SXfVqg6o6Wsdl1kQ/edit
Author: @kegsay

We want third parties (ASes, random web apps which use OAuth to login as someone) to be able to act on behalf of real matrix users. Currently, they simply can't, as they can't authenticate as a given user_id.

We should probably expose a CS HTTP API endpoint /oauth which expects to be hit with a redirect_uri, scopes, etc and ideally a browser-sent access_token from the redirect (obviously not automatic given the token is a query param and not a Cookie :( ). If not logged in, you'd need to login as usual for that HS (e.g. m.login.password) and then go to the "Accept scopes" page. This will then return a token which the 3rd party service can use as an access_token.

Note that this is completely different to the role HSes play during reg/login where we ARE the "web app" wanting to authenticate on another 3rd party (FB/G+/etc).

This is becoming increasingly important as more services wish to authenticate as existing user IDs rather than having user ID fragmentation/namespace hell.

(Imported from https://matrix.org/jira/browse/SPEC-206)

(Reported by @kegsay)

[matrixbot]

Jira watchers: @kegsay

[matrixbot]

Links exported from Jira:

blocks BOTS-4
relates to SPEC-170

[leonerd]

Also matrix-org/matrix-appservice-gitter#33 could benefit from this most majorly.

[yangm97]

Was this abandoned or superseded by something better?

[ara4n]

neither. we still want this, but nobody has MSC'd it yet. unfortunately kegsay left the project during the funding disruption in 2017, so it hasn't really had a champion since. in other words: it's very much up for grabs! MSCs welcome!

[richvdh]

is this now implemetned by https://matrix.org/docs/spec/client_server/r0.5.0#id199 ?

[turt2live]

OAuth != OpenID, also an OpenID token from a homeserver doesn't give you permission to impersonate that user.

[richvdh]

if this is abandoned, it may as well be closed.