Skip to content

MSC4108: Mechanism to allow OAuth 2.0 API sign in and E2EE set up via QR code#4108

Open
hughns wants to merge 71 commits into
mainfrom
element-hq/oidc-qr-login
Open

MSC4108: Mechanism to allow OAuth 2.0 API sign in and E2EE set up via QR code#4108
hughns wants to merge 71 commits into
mainfrom
element-hq/oidc-qr-login

Conversation

@hughns
Copy link
Copy Markdown
Member

@hughns hughns commented Feb 22, 2024 •
edited
Loading

Rendered

Dependencies:

Video demos:

New EX scans existing EW
MSC4108 v2025 New EX scans existing EW

Existing EX scans new EW
MSC4108 v2025 Existing EX scans new EW

New EX scans existing EX
MSC4108 v2025 New EX scans existing EX

The authors are employed by Element to write this MSC.

Major revisions

The is an older version of this proposal (referred to as "2024") that has some significant differences from the current proposal.

To help avoid confusion on the status, the following is hopefully helpful:

Version name Status Proposal revision Supported by Encryption scheme Discovery of support Proof-of-MSC implementation status
2025 MSC is feature complete and being reviewed Diff to 2024 version latest No production implementations. Experimental feature in Synapse. HPKE Discovery using GET /_matrix/client/v1/rendezvous Fully implemented (see below)
2024 Feature complete, but will be superseded by a new version 87f8317 Experimental feature in Synapse. Supported by Element Web/Desktop to generate QR. Supported by Element X to scan QR to login. ECIES unstable_features.org.matrix.msc4108 is true in /versions response from homeserver Fully implemented (see below)

Proof-of-MSC implementations

2025 version

Flows implemented

Flow Existing device New device
Existing device generates QR to sign in a new device EW or EX EX
Existing device scans QR to sign in a new device EX EW

2024 version

Implementations for 2024 version:

MSC4108 Element X-Web iOS demo

To-dos

The high-level to-do list for the latest version:

  • Update rendezvous session API to avoid issues with ETags
  • Update rendezvous session API so that stylistically it fits better with C-S API
  • Allow rendezvous session creation to require authentication
  • Replace ECIES with HPKE in secure channel
  • Revisit QR code format
  • Proof-of-MSC implementations for all of above
  • Review thread about sequence of protocol_accepted
  • Provide a discovery mechanism that works once the proposal is stabilised

@hughns hughns changed the title Mechanism to allow OIDC sign in and E2EE set up via QR code MSC4108: Mechanism to allow OIDC sign in and E2EE set up via QR code Feb 22, 2024
@turt2live turt2live added proposal A matrix spec change proposal client-server Client-Server API kind:core MSC which is critical to the protocol's success needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Feb 22, 2024
@cyrneko
Copy link
Copy Markdown

cyrneko commented Feb 22, 2024

finally, it is no longer just an idea presented at FOSDEM 🥳

@ara4n
Copy link
Copy Markdown
Member

ara4n commented Feb 22, 2024

tbf there was already MSC3906 - which this will presumably replace, by making it play nice with native OIDC (MSC3861) :)

@hughns hughns force-pushed the element-hq/oidc-qr-login branch from 5cd815f to 177a2db Compare April 3, 2024 15:58
dkasak
dkasak reviewed Apr 5, 2024
View reviewed changes
Comment thread proposals/4108-oidc-qr-login.md Outdated
dkasak
dkasak reviewed Apr 5, 2024
View reviewed changes
Comment thread proposals/4108-oidc-qr-login.md Outdated
This was referenced Apr 9, 2024
Closed
Closed
Closed
@derritter88 derritter88 mentioned this pull request Nov 21, 2025
Closed
@Johennes Johennes mentioned this pull request Nov 25, 2025
Merged
1 task
@manuroe manuroe mentioned this pull request Nov 28, 2025
Open
networkException
networkException reviewed Dec 12, 2025
View reviewed changes
Comment thread proposals/4108-oidc-qr-login.md Outdated
@hughns @networkException
Update proposals/4108-oidc-qr-login.md
c0431eb 
Co-authored-by: networkException <github@nwex.de>
@turt2live
Copy link
Copy Markdown
Member

turt2live commented Jan 6, 2026

This MSC is listed as "ready for FCP", but appears to have dependencies which are either WIP or not on the "ready for FCP" list themselves. When those dependencies make their way through the process to FCP, please re-raise this MSC in the SCT Office for reconsideration.

@dynamodan dynamodan mentioned this pull request Jan 10, 2026
Closed
poljar added a commit to matrix-org/matrix-rust-sdk that referenced this pull request Jan 29, 2026
@poljar
refactor(crypto): Create a MSC4108 submodule for the qr login types
ef8aa64 
Our current implementation of this QR code data type corresponds to the
data type defined in MSC4108. The data format has been updated a bit in
MSC4833 and thus we'll need to support both formats for a while.

This moves al the MSC4108-specific parts into a separate MSC-specific
submodule.

MSC4108: matrix-org/matrix-spec-proposals#4108
poljar added a commit to matrix-org/matrix-rust-sdk that referenced this pull request Jan 29, 2026
@poljar
refactor(crypto): Create a MSC and intent specific accessor for the Q…
6be280c 
…R login data type

This patch adds a view into the MSC-specific and intent specific data
fields of the QR login data type.

MSC4108 and MSC4388 have subtle differences in the way the rendezvous
URL and the server name are shared, this new getter allows us to access
all of those fields in a consistent manner.

MSC4108: matrix-org/matrix-spec-proposals#4108
MSC4388: matrix-org/matrix-spec-proposals#4388
poljar added a commit to matrix-org/matrix-rust-sdk that referenced this pull request Jan 30, 2026
@poljar
refactor(crypto): Create a MSC4108 submodule for the qr login types
2d4053b 
Our current implementation of this QR code data type corresponds to the
data type defined in MSC4108. The data format has been updated a bit in
MSC4833 and thus we'll need to support both formats for a while.

This moves al the MSC4108-specific parts into a separate MSC-specific
submodule.

MSC4108: matrix-org/matrix-spec-proposals#4108
poljar added a commit to matrix-org/matrix-rust-sdk that referenced this pull request Jan 30, 2026
@poljar
refactor(crypto): Create a MSC and intent specific accessor for the Q…
c4a04ee 
…R login data type

This patch adds a view into the MSC-specific and intent specific data
fields of the QR login data type.

MSC4108 and MSC4388 have subtle differences in the way the rendezvous
URL and the server name are shared, this new getter allows us to access
all of those fields in a consistent manner.

MSC4108: matrix-org/matrix-spec-proposals#4108
MSC4388: matrix-org/matrix-spec-proposals#4388
@hughns hughns mentioned this pull request Feb 4, 2026
Open
@hughns
Copy link
Copy Markdown
Member Author

hughns commented Mar 30, 2026

The dependent MSC4388 has not been undrafted and is ready for review.

The sample implementations are now linked and I have added videos demonstrating the full set of flows.

All outstanding conversations have been resolved.

@turt2live turt2live added implementation-needs-checking The MSC has an implementation, but the SCT has not yet checked it. and removed needs-implementation This MSC does not have a qualifying implementation for the SCT to review. The MSC cannot enter FCP. labels Mar 30, 2026
@turt2live
Copy link
Copy Markdown
Member

turt2live commented Mar 30, 2026

The author believes this is ready for FCP. Next steps are for SCT members to review the MSC and implementation(s), add the checklist, then propose FCP if appropriate.

@github-project-automation github-project-automation Bot moved this to Tracking for review in Spec Core Team Workflow Mar 30, 2026
@turt2live turt2live moved this from Tracking for review to Proposed for FCP readiness in Spec Core Team Workflow Mar 30, 2026
@hughns hughns requested a review from turt2live April 23, 2026 11:00
@turt2live turt2live removed their request for review April 27, 2026 21:57
msk pushed a commit to msk/pkgsrc that referenced this pull request May 11, 2026
chat/matrix-synapse: Update to 1.109.0
5a3187a 
# Synapse 1.109.0 (2024-06-18)

- Add the ability to auto-accept invites on the behalf of users. See
  the
  [`auto_accept_invites`](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#auto-accept-invites)
  config option for
  details. ([\#17147](element-hq/synapse#17147))

- Add experimental
  [MSC3575](matrix-org/matrix-spec-proposals#3575)
  Sliding Sync `/sync/e2ee` endpoint for to-device messages and device
  encryption
  info. ([\#17167](element-hq/synapse#17167))

- Support
  [MSC3916](matrix-org/matrix-spec-proposals#3916)
  by adding unstable media endpoints to
  `/_matrix/client`. ([\#17213](element-hq/synapse#17213))

- Add logging to tasks managed by the task scheduler, showing CPU and
  database
  usage. ([\#17219](element-hq/synapse#17219))


# Synapse 1.108.0 (2024-05-28)

- Add a feature that allows clients to query the configured federation
  whitelist. Disabled by
  default. ([\#16848](element-hq/synapse#16848),
  [\#17199](element-hq/synapse#17199))

- Add the ability to allow numeric user IDs with a specific prefix
  when in the CAS flow. Contributed by Aurélien
  Grimpard. ([\#17098](element-hq/synapse#17098))


Synapse 1.107.0 (2024-05-14)

- Add preliminary support for [MSC3823: Account
  Suspension](matrix-org/matrix-spec-proposals#3823).
  ([\#17051](element-hq/synapse#17051))

- Declare support for [Matrix
  v1.10](https://matrix.org/blog/2024/03/22/matrix-v1.10-release/). Contributed
  by
  @clokep. ([\#17082](element-hq/synapse#17082))

- Add support for [MSC4115: membership metadata on
  events](matrix-org/matrix-spec-proposals#4115).
  ([\#17104](element-hq/synapse#17104),
  [\#17137](element-hq/synapse#17137))


# Synapse 1.106.0 (2024-04-30)

- Send an email if the address is already bound to an user
  account. ([\#16819](element-hq/synapse#16819))

- Implement the rendezvous mechanism described by
  [MSC4108](matrix-org/matrix-spec-proposals#4108).
  ([\#17056](element-hq/synapse#17056))

- Support delegating the rendezvous mechanism described
  [MSC4108](matrix-org/matrix-spec-proposals#4108)
  to an external
  implementation. ([\#17086](element-hq/synapse#17086))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dkasak dkasak dkasak left review comments

@poljar poljar poljar left review comments

@uhoreg uhoreg uhoreg left review comments

@erikjohnston erikjohnston erikjohnston left review comments

@turt2live turt2live turt2live requested changes

+6 more reviewers

@Johennes Johennes Johennes left review comments

@tonkku107 tonkku107 tonkku107 left review comments

@davidegirardi davidegirardi davidegirardi left review comments

@networkException networkException networkException left review comments

@zecakeh zecakeh zecakeh left review comments

@noelportillo noelportillo noelportillo left review comments

Reviewers whose approvals may not affect merge requirements

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

client-server Client-Server API implementation-needs-checking The MSC has an implementation, but the SCT has not yet checked it. kind:core MSC which is critical to the protocol's success proposal A matrix spec change proposal

Projects

Spec Core Team Workflow
Status: Proposed for FCP readiness

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.