MSC2967: API scopes #2967
MSC2967: API scopes #2967
Conversation
turt2live
changed the title
turt2live
added
kind:feature
turt2live
added
the
needs-implementation
|
|
||
| #### Device ID handling | ||
|
|
||
| Presently a device ID is typically generated by the homeserver and is associated with a specific access token. In OAuth 2.0 there is no such thing as a session and so a mapping cannot be handled using the same mechanism. |
There was a problem hiding this comment.
Is this still true after refresh tokens (MSC2918)? I thought we did a bunch of work in Synapse related to this recently, but maybe I'm confusing different types of tokens.
proposals/2967-api-scopes.md
Outdated
|
|
||
| The Device ID handling involves a change in where device IDs are generated. This is discussed in MSC2964. On the OIDC Provider side the device ID proposal requires the use of dynamic scopes. That is, the specific scope is a templated form rather than being static. This is not currently supported by some OpenID Providers (e.g. Okta and Auth0). | ||
|
|
||
| The addition of the `WWW-Authenticate` header could cause issue with some clients. |
There was a problem hiding this comment.
The header itself or attempting to parse it? We could also provider a matching errcode if that's useful?
Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>
|
|
||
| #### Device ID handling | ||
|
|
||
| Presently a device ID is typically generated by the homeserver and is associated with a specific access token. In OAuth 2.0 there is no such thing as a session and so a mapping cannot be handled using the same mechanism. |
There was a problem hiding this comment.
In OAuth 2.0 there is no such thing as a session and so a mapping cannot be handled using the same mechanism.
In OIDC they define a sid (Session ID) claim within the id_token in the Front-Channel Logout spec (also referenced in other specs)
I would also like to mention that since clients are expected to use dynamic registration, client_ids resemble device IDs quite a bit
- Remove insufficient privilege response - Remove guest scopes - Reword some parts
Rendered
urn:matrixnamespaceDependencies:
Implementations:
Homeservers
Homeservers:
urn:matrix:client:api:*urn:matrix:client:device:XXXXClients
Clients need to request scopes appropriately.
urn:matrix:client:api:*urn:matrix:client:device:XXXXurn:matrix:client:api:*urn:matrix:client:device:XXXXurn:matrix:client:api:*urn:matrix:client:device:XXXXurn:matrix:client:api:*urn:matrix:client:device:XXXX