Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions bindings/matrix-sdk-ffi/src/client.rs
Original file line number Diff line number Diff line change
Expand Up @@ -400,10 +400,18 @@ impl Client {
/// * `prompt` - The desired user experience in the web UI. No value means
/// that the user wishes to login into an existing account, and a value of
/// `Create` means that the user wishes to register a new account.
///
/// * `login_hint` - A generic login hint that an identity provider can use
/// to pre-fill the login form. The format of this hint is not restricted
/// by the spec as external providers all have their own way to handle the hint.
/// However, it should be noted that when providing a user ID as a hint
/// for MAS (with no upstream provider), then the format to use is defined
/// by [MSC4198]: https://github.com/matrix-org/matrix-spec-proposals/pull/4198
pub async fn url_for_oidc(
&self,
oidc_configuration: &OidcConfiguration,
prompt: Option<OidcPrompt>,
login_hint: Option<String>,
) -> Result<Arc<OAuthAuthorizationData>, OidcError> {
let registration_data = oidc_configuration.registration_data()?;
let redirect_uri = oidc_configuration.redirect_uri()?;
Expand All @@ -413,6 +421,9 @@ impl Client {
if let Some(prompt) = prompt {
url_builder = url_builder.prompt(vec![prompt.into()]);
}
if let Some(login_hint) = login_hint {
url_builder = url_builder.login_hint(login_hint);
}

let data = url_builder.build().await?;

Expand Down
24 changes: 24 additions & 0 deletions crates/matrix-sdk/src/authentication/oauth/auth_code_builder.rs
Original file line number Diff line number Diff line change
Expand Up @@ -73,10 +73,34 @@ impl OAuthAuthCodeUrlBuilder {
self
}

/// Set a generic login hint to help an identity provider pre-fill the login
/// form.
///
/// Note: This is not the same as the [`Self::user_id_hint()`] method, which
/// is specifically designed to a) take a `UserId` and no other type of
/// hint and b) be used directly by MAS and not the identity provider.
Comment on lines +76 to +81
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, this overwrites whatever we set with user_id_hint(), we should mention this.

Out of interest, what will you set as the hint?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, I've added the same The following methods are mutually exclusive line that we use in the client builder.

It will likely be an email address but it depends on the upstream provider, we would pass through whatever is given to us without modifying it. The use case is an organisation creating provisioning links like https://app.example.com/?server_name=example.org&login_hint=alice where their upstream provider knows how to handle alice as a hint.

There are docs here: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah makes sense. Can we perhaps more explicitly mention this example use-case and link to these docs?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep makes sense, done in 079285d

///
/// The most likely use case for this method is to pre-fill the login page
/// using a provisioning link provided by an external party such as
/// `https://app.example.com/?server_name=example.org&login_hint=alice`
/// In this instance it is up to the external party to make ensure that the
/// hint is known to work with their identity provider. For more information
/// see `login_hint` in <https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest>
///
/// The following methods are mutually exclusive: [`Self::login_hint()`] and
/// [`Self::user_id_hint()`].
pub fn login_hint(mut self, login_hint: String) -> Self {
self.login_hint = Some(login_hint);
self
}

/// Set the hint to the Authorization Server about the Matrix user ID the
/// End-User might use to log in, as defined in [MSC4198].
///
/// [MSC4198]: https://github.com/matrix-org/matrix-spec-proposals/pull/4198
///
/// The following methods are mutually exclusive: [`Self::login_hint()`] and
/// [`Self::user_id_hint()`].
pub fn user_id_hint(mut self, user_id: &UserId) -> Self {
self.login_hint = Some(format!("mxid:{user_id}"));
self
Expand Down
Loading