How does OpenID Connect integration work?

[dutch]

I've deployed Synapse 1.0.0-alpha5.20 in a K8s cluster, and it's doing exactly what I want with a static token for authentication. I'd love to move on to integrating it with my existing OIDC identity infrastructure, but I'm not exactly sure how it works. I've added SYNAPSE_API_AUTH_OIDC_* environment variables to the API pod, and it seemed to take them, but the dashboard still just shows a static bearer token login screen when visiting it.

Can you help me understand how to integrate Synapse with outside authentication?

Much appreciated!

[cdavernas]

@JBBianchi Any idea?

[dutch]

I found the /authentication/oidc/login endpoint, and tried manually visiting that instead of what it defaults to (/authentication/bearer/login). I'm seeing a blank page with an error toast at the bottom saying "An unhandled error has occurred," but I'm not seeing any errors in the API pod logs.

Any idea how I can debug this? Thanks again.

[JBBianchi]

Here are some pieces of info:

• There is a "Redirect" component that uses the ApplicationOptions.Authentication.Oidc option to either display /authentication/oidc/login or /authentication/bearer/login.

• The /authentication/oidc/login view uses RemoteAuthenticatorView .

• In the Dashboard's Program.cs, the config seems to be bound with:
  

  synapse/src/dashboard/Synapse.Dashboard/Program.cs

  Lines 63 to 66 in 55032da

  	builder.Services.AddOidcAuthentication(options =>
  	{
  	builder.Configuration.Bind("Authentication:OIDC", options.ProviderOptions);
  	});

But then, I'm not sure how to actually config the Authentication.OIDC option. @cdavernas probably is more likely to help.