Rauthy - compatible upstream IdP

[sebadob]

This is not really a feature request, I only wanted to bring this to your attention, maybe you're interested in this.

Rauthy has been tested as an upstream OIDC IdP for MAS and it's working as expected. It might be interesting especially for people self-hosting their own homeservers and MAS, because it's a lot more lightweight and easier to set up than Keycloak, while not giving up on features.

It has been tested by @ChurchOfTheSubgenius and works in the following configurations on Rauthy's side:

• confidential client with S256 PKCE and RS256 for both access and id token signature
• public client with S256 PKCE and RS256 for both access and id token signature
• ephemeral client with S256 PKCE and RS256 for both access and id token signature - example JSON:

{
  "client_id": "https://path.to.this.json",
  "redirect_uris": [
    "https://your-app.com/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "access_token_signed_response_alg": "RS256",
  "id_token_signed_response_alg": "RS256"
}

MAS config example:

upstream_oauth2:
  providers:
    - id: 01JF4AMC9ZH4TT7VHJ4R9WDVAY
      human_name: "Rauthy"
      brand_name: "rauthy"
      token_endpoint_auth_method: "client_secret_post"
      issuer: "https://rauthy.example.com/auth/v1"
      client_id: "<client id from Rauthy's Admin UI>"
      client_secret: "<client secret from Rauthy's Admin UI -> client -> secret>"
      scope: "openid profile email"
      claims_imports:
        localpart:
          action: ignore
        displayname:
          action: suggest
          template: "{{ user.given_name }}"
        email:
          action: suggest
          template: "{{ user.email }}"

If you would like to add Rauthy to the list of the compatible providers in the Readme, please feel free to do so, or simply close this issue otherwise.

[sandhose]

Thanks for the heads up! I would appreciate a pull request to add the configuration example in the documentation here: https://github.com/element-hq/matrix-authentication-service/blob/main/docs/setup/sso.md#sample-configurations