Struct UpstreamOAuth2Provider

pub struct UpstreamOAuth2Provider {

    pub enabled: bool,
    pub id: Ulid,
    pub synapse_idp_id: Option<String>,
    pub issuer: Option<String>,
    pub human_name: Option<String>,
    pub brand_name: Option<String>,
    pub client_id: String,
    pub client_secret: Option<String>,
    pub token_endpoint_auth_method: TokenAuthMethod,
    pub sign_in_with_apple: Option<SignInWithApple>,
    pub token_endpoint_auth_signing_alg: Option<JsonWebSignatureAlg>,
    pub id_token_signed_response_alg: JsonWebSignatureAlg,
    pub scope: String,
    pub discovery_mode: DiscoveryMode,
    pub pkce_method: PkceMethod,
    pub fetch_userinfo: bool,
    pub userinfo_signed_response_alg: Option<JsonWebSignatureAlg>,
    pub authorization_endpoint: Option<Url>,
    pub userinfo_endpoint: Option<Url>,
    pub token_endpoint: Option<Url>,
    pub jwks_uri: Option<Url>,
    pub response_mode: Option<ResponseMode>,
    pub claims_imports: ClaimsImports,
    pub additional_authorization_parameters: BTreeMap<String, String>,
    pub forward_login_hint: bool,
    pub on_backchannel_logout: OnBackchannelLogout,
}

Configuration for one upstream OAuth 2 provider.

Fields

enabled: bool

Whether this provider is enabled.

Defaults to true

id: Ulid

An internal unique identifier for this provider

synapse_idp_id: Option<String>

The ID of the provider that was used by Synapse. In order to perform a Synapse-to-MAS migration, this must be specified.

For providers that used OAuth 2.0 or OpenID Connect in Synapse

For oidc_providers:

This should be specified as oidc- followed by the ID that was configured as idp_id in one of the oidc_providers in the Synapse configuration. For example, if Synapse’s configuration contained idp_id: wombat for this provider, then specify oidc-wombat here.

For oidc_config (legacy):

Specify oidc here.

issuer: Option<String>

The OIDC issuer URL

This is required if OIDC discovery is enabled (which is the default)

human_name: Option<String>

A human-readable name for the provider, that will be shown to users

brand_name: Option<String>

A brand identifier used to customise the UI, e.g. apple, google, github, etc.

Values supported by the default template are:

• apple
• google
• facebook
• github
• gitlab
• twitter
• discord

client_id: String

The client ID to use when authenticating with the provider

client_secret: Option<String>

The client secret to use when authenticating with the provider

Used by the client_secret_basic, client_secret_post, and client_secret_jwt methods

token_endpoint_auth_method: TokenAuthMethod

The method to authenticate the client with the provider

sign_in_with_apple: Option<SignInWithApple>

Additional parameters for the sign_in_with_apple method

token_endpoint_auth_signing_alg: Option<JsonWebSignatureAlg>

The JWS algorithm to use when authenticating the client with the provider

Used by the client_secret_jwt and private_key_jwt methods

id_token_signed_response_alg: JsonWebSignatureAlg

Expected signature for the JWT payload returned by the token authentication endpoint.

Defaults to RS256.

scope: String

The scopes to request from the provider

Defaults to openid.

discovery_mode: DiscoveryMode

How to discover the provider’s configuration

Defaults to oidc, which uses OIDC discovery with strict metadata verification

pkce_method: PkceMethod

Whether to use proof key for code exchange (PKCE) when requesting and exchanging the token.

Defaults to auto, which uses PKCE if the provider supports it.

fetch_userinfo: bool

Whether to fetch the user profile from the userinfo endpoint, or to rely on the data returned in the id_token from the token_endpoint.

Defaults to false.

userinfo_signed_response_alg: Option<JsonWebSignatureAlg>

Expected signature for the JWT payload returned by the userinfo endpoint.

If not specified, the response is expected to be an unsigned JSON payload.

authorization_endpoint: Option<Url>

The URL to use for the provider’s authorization endpoint

Defaults to the authorization_endpoint provided through discovery

userinfo_endpoint: Option<Url>

The URL to use for the provider’s userinfo endpoint

Defaults to the userinfo_endpoint provided through discovery

token_endpoint: Option<Url>

The URL to use for the provider’s token endpoint

Defaults to the token_endpoint provided through discovery

jwks_uri: Option<Url>

The URL to use for getting the provider’s public keys

Defaults to the jwks_uri provided through discovery

response_mode: Option<ResponseMode>

The response mode we ask the provider to use for the callback

claims_imports: ClaimsImports

How claims should be imported from the id_token provided by the provider

additional_authorization_parameters: BTreeMap<String, String>

Additional parameters to include in the authorization request

Orders of the keys are not preserved.

forward_login_hint: bool

Whether the login_hint should be forwarded to the provider in the authorization request.

Defaults to false.

on_backchannel_logout: OnBackchannelLogout

What to do when receiving an OIDC Backchannel logout request.

Defaults to do_nothing.

Trait Implementations

impl Clone for Provider

fn clone(&self) -> Provider

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Provider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Provider

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Provider

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Serialize for Provider

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.