diff options
| author | Richard van der Hoff <1389908+richvdh@users.noreply.github.com> | 2021-03-09 15:03:37 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-09 15:03:37 +0000 |
| commit | eaada74075a4567c489fff6ae2206f2af8298fd4 (patch) | |
| tree | 5b57aaa4ecea74f84d53d651d45490dd859286ad /docs/sample_config.yaml | |
| parent | Retry 5xx errors in federation client (#9567) (diff) | |
| download | synapse-eaada74075a4567c489fff6ae2206f2af8298fd4.tar.xz | |
JWT OIDC secrets for Sign in with Apple (#9549)
Apple had to be special. They want a client secret which is generated from an EC key. Fixes #9220. Also fixes #9212 while I'm here.
Diffstat (limited to 'docs/sample_config.yaml')
| -rw-r--r-- | docs/sample_config.yaml | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml index c95a4f5970..c32ee4a897 100644 --- a/docs/sample_config.yaml +++ b/docs/sample_config.yaml @@ -1779,7 +1779,26 @@ saml2_config: # # client_id: Required. oauth2 client id to use. # -# client_secret: Required. oauth2 client secret to use. +# client_secret: oauth2 client secret to use. May be omitted if +# client_secret_jwt_key is given, or if client_auth_method is 'none'. +# +# client_secret_jwt_key: Alternative to client_secret: details of a key used +# to create a JSON Web Token to be used as an OAuth2 client secret. If +# given, must be a dictionary with the following properties: +# +# key: a pem-encoded signing key. Must be a suitable key for the +# algorithm specified. Required unless 'key_file' is given. +# +# key_file: the path to file containing a pem-encoded signing key file. +# Required unless 'key' is given. +# +# jwt_header: a dictionary giving properties to include in the JWT +# header. Must include the key 'alg', giving the algorithm used to +# sign the JWT, such as "ES256", using the JWA identifiers in +# RFC7518. +# +# jwt_payload: an optional dictionary giving properties to include in +# the JWT payload. Normally this should include an 'iss' key. # # client_auth_method: auth method to use when exchanging the token. Valid # values are 'client_secret_basic' (default), 'client_secret_post' and |