From 39861031eefd62b503e89b49093ceb4825939d6e Mon Sep 17 00:00:00 2001 From: squahtx Date: Tue, 20 Dec 2022 18:10:08 +0000 Subject: deploy: 774e20b57047b9f8700e62e7f4689717f4fa094c --- latest/openid.html | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'latest/openid.html') diff --git a/latest/openid.html b/latest/openid.html index bc42e6c8c8..2d1a1f2865 100644 --- a/latest/openid.html +++ b/latest/openid.html @@ -676,6 +676,37 @@ needed to add OAuth2 capabilities to your Django projects. It supports display_name_template: "{{ user.first_name }} {{ user.last_name }}" email_template: "{{ user.email }}" +

Mastodon

+

Mastodon instances provide an OAuth API, allowing those instances to be used as a single sign-on provider for Synapse.

+

The first step is to register Synapse as an application with your Mastodon instance, using the Create an application API (see also here). There are several ways to do this, but in the example below we are using CURL.

+

This example assumes that:

+ +

Send the following request, substituting the value of synapse_public_baseurl from your Synapse installation.

+
curl -d "client_name=my_synapse_app&redirect_uris=https://[synapse_public_baseurl]/_synapse/client/oidc/callback" -X POST https://your.mastodon.instance.url/api/v1/apps
+
+

You should receive a response similar to the following. Make sure to save it.

+
{"client_id":"someclientid_123","client_secret":"someclientsecret_123","id":"12345","name":"my_synapse_app","redirect_uri":"https://[synapse_public_baseurl]/_synapse/client/oidc/callback","website":null,"vapid_key":"somerandomvapidkey_123"}
+
+

As the Synapse login mechanism needs an attribute to uniquely identify users, and Mastodon's endpoint does not return a sub property, an alternative subject_claim has to be set. Your Synapse configuration should include the following:

+
oidc_providers:
+  - idp_id: my_mastodon
+    idp_name: "Mastodon Instance Example"
+    discover: false
+    issuer: "https://your.mastodon.instance.url/@admin"
+    client_id: "someclientid_123"    
+    client_secret: "someclientsecret_123"
+    authorization_endpoint: "https://your.mastodon.instance.url/oauth/authorize"
+    token_endpoint: "https://your.mastodon.instance.url/oauth/token"
+    userinfo_endpoint: "https://your.mastodon.instance.url/api/v1/accounts/verify_credentials"
+    scopes: ["read"]
+    user_mapping_provider:
+      config:
+        subject_claim: "id"
+
+

Note that the fields client_id and client_secret are taken from the CURL response above.

-- cgit 1.5.1