matrix-org / matrix-org/matrix-spec
It's unclear what OpenID standard is actually meant by 'OpenID', if any at all
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
**Link to problem area**:
- https://spec.matrix.org/v1.9/client-server-api/#openid
- https://spec.matrix.org/v1.9/server-server-api/#openid
**Issue**
The OpenID section does not say which OpenID standard is in use. Is it v1, v2, OpenID Connect?
I am unfamiliar with v1/v2 of the original OpenID specs but from what I can tell they seem fairly unrelated. From #684 I think it is meant to be OpenID Connect.
However from personal experience with OIDC I would say that the spec we implement does not go far enough to make us actually compliant with OpenID Connect at all. For example, most of the things on the ['Mandatory to Implement' list](https://openid.net/specs/openid-connect-core-1_0.html#ServerMTI) are missing.
There are also some important details in the OIDC spec that we are missing; feel free to ask internally for my notes on this.
Overall it seems we should just rename it to something else, unrelated to OpenID altogether and explain that the `/openid` path is a historical misnomer.
Eventually the real 'OIDC native' work will hopefully give us something to use here instead?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the OpenID sections in the linked Matrix client-server and server-server API specifications, then compare the intended behavior with the OpenID Connect Core 1.0 requirements and the context from #684. Determine whether the `/openid` terminology should identify a standard or be replaced, and document the chosen scope and missing details clearly.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100