Harder better faster stronger auth with OpenID Connect
summary
A new browser‑redirect login replaces UIA by combining OAuth2/OpenID Connect with a dedicated auth service so credentials are domain‑bound and password managers work. Matrix Authentication Service runs alongside Synapse, issues a single‑use code the client exchanges for tokens, and adds an account management UI, client metadata (logo, privacy links) and scoped access tokens to limit what a client can do. Beta at beta.matrix.org is functional (Element X uses OAuth2; FluffyChat falls back to m.login.sso), but only Synapse currently implements it and some bridge/encryption and admin tooling work remains.
AI-written summary · about
chapters (11)
- 0:00User registration demo
- 2:51User-interactive auth overview
- 4:11New authentication stack demo
- 5:52Issues with existing UIA
- 7:23Credential and security flaws
- 10:39The case for browser-based auth
- 12:01Leveraging OAuth 2.0 and OIDC
- 14:03Matrix Authentication Service
- 15:36Roadmap and future features
- 26:04Availability and implementation
- 32:21Q&A and closing remarks
related talks
27mFrom AuthN to AuthZ: The Future of Identity
01h 12mIdentity 2.0: the what, why and how of social and federated login
23mOne Login to Rule Them All: Cross-App Access for MCP
36mTo Identity and Beyond
47mWho's your user? OpenID from the ground-up
58mOAUTH, OPENID CONNECT & .NET – THE GOOD PARTS
54mWho's your user? OpenID from the ground-up
37mCustomer Identity for Modern Apps and APIs