suggestion: Bring this as an spec proposal for adding OAuth/OIDC support on homeservers

[ajhalili2006]

About this Issue

Currently, the implementation of Sign-in with Matrix is not compliant with OAuth 2.0 spec and OpenID because if I implement this on my app, how do I securely ask the user the minimum data it requires for authorization purposes or even authenticate against the client-to-server API without the need to ask somebody's password? Of course, there's no MSC regarding OAuth and OpenID stuff on server-side, yet.

Related Issues

• https://github.com/matrix-org/matrix-doc/issues/2615
• https://github.com/matrix-org/matrix-doc/issues/2889
• https://github.com/matrix-org/matrix-doc/issues/3347
• https://github.com/matrix-org/matrix-doc/issues/2615

[mishushakov]

there is actually an MSC
https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oauth2-profile/proposals/2964-oauth2-profile.md