Difficulties with introspection endpoint for upstream OIDC

[ariep]

Hi, I'm in the process of setting up synapse+mas with an upstream OIDC provider based on Ory hydra. The first few steps are successful now: I get through to the screen for confirming upstream-provided account fields (username, email). After that I run into this issue though: element only shows a spinner, and the browser console shows 503s on /_matrix/client/v3/pushrules/ with result {"errcode":"M_UNKNOWN","error":"Unable to introspect the access token"}.

When following the steps outlined in that older issue, I noticed that the .well-known/openid-configuration for my upstream doesn't contain an introspection_endpoint. I first thought there was something wrong with my Hydra setup, but I learned that this omission is intentional, because the introspection endpoint is only for internal use so should not be advertised in the public discovery data.

Do I understand correctly that mas disagrees on that and really needs the introspection_endpoint to be present in the openid-configuration data? In the mas docs I did not see a setting for overriding this endpoint (failing discovery), unlike some other endpoints. Is that undocumented or just not currently possible?

[ariep]

Solved, with the help of people in #synapse:matrix.org: turned out I had synapse configured wrongly, and it was (partly) trying to contact my upstream SSO instead of MAS. Specifically, experimental_features.msc3861.issuer needed to be set to point to MAS.