OIDC: Determine homeserver is OIDC enabled

[kerryarchibald]

Client implementation guide

Is homeserver OIDC enabled?

OIDC-aware Element Web examines the list of available login flows (see Login.ts) and if we find a OIDC one masquerading as an SSO flow, we only display that.

For native OIDC we will use the homeserver .well-known to determine OIDC support. When client .well-known includes a valid m.authentication section MSC2965 consider OIDC enabled.

This implementation will rely on .well-known to determine OIDC support. Not all Matrix servers have the well-known client discovery mechanism setup, so will be unable to discover the auth server. If a user enters a matrix server url instead of a server name, we will be unable to discover the auth server.
Alternative methods of auth server discovery might be addressed later.

AC:

• validate m.authentication section from client .well-known in buildValidatedConfigFromDiscovery
• when a valid m.authentication config is found, fetch .well-known/openid-configuration from the configured issuer
• validate the issuer configuration is valid for our use case. See hydrogen implementation
  Required properties are:
  • authorization_endpoint
  • token_endpoint
  • registration_endpoint
  • response_types_supported includes code
  • response_modes_supported includes fragment
  • grant_types_supported includes authorization_code
  • code_challenge_methods_supported includes S256

See https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oauth2-profile/proposals/2964-oauth2-profile.md#native-and-browser-based-clients

[kerryarchibald]

Closed by matrix-org/matrix-js-sdk#3419