Move the OpenID apis to /_matrix/openid

[turt2live]

When there's no federation listener, things can't use OpenID. The endpoints (specifically /_matrix/federation/v1/openid/userinfo) should always be available so that applications can make use of them. This would allow integration managers to work with synapse/riot without having federation enabled on a server.

This could be made a configuration option if people are concerned about having the endpoint exposed.

Current endpoints:

• /_matrix/client/{version}/user/{user_id}/openid/request_token
• /_matrix/federation/{version}/openid/userinfo

[ara4n]

good point. there are various APIs which aren't for HS<->HS but IS->HS (3pid binding callbacks) or AS->HS (openid) which have got stuck in _matrix/federation for no good reason, and should be moved into a different namespace. This is arguably a spec bug?

[turt2live]

I'm not sure what the new namespace would be to be honest. OpenID spans the client and federation apis (token requests are through the client api and the app then uses the federation endpoint).

The best current fit I can think of would be to put OpenID in the identity namespace, however identity servers aren't exactly intended for this.

The API is currently not specced, as per matrix-org/matrix-spec-proposals#857

[ara4n]

i vote we move this into its own namespace and we file a spec bug to do so.

[turt2live]

Reported as matrix-org/matrix-spec-proposals#1115

Going to repurpose this issue for "move the apis".

[letmp]

In your readme is written "install Dimension on the same server as your homeserver, only exposing federation to localhost."

I have done that and always get:
error [matrix] Error calling /_matrix/federation/v1/openid/userinfo
error [matrix] tunneling socket could not be established, statusCode=403

Has this something to do with this ticket? Or is something wrong in my configs for matrix-synapse / matrix-dimension ?

[turt2live]

I somehow missed this when I closed matrix-org/matrix-spec-proposals#1115.

TLDR is that moving the endpoints doesn't really make sense. Synapse can support the OpenID endpoints with a dedicated listener (#4420) without supporting the whole range of federation APIs. If we move namespaces, we'd probably have to figure out discovery again and that doesn't really make sense. Given the name of the spec is the "server to server API", and this is very much server to server, I've convinced myself we shouldn't move it.